Feeds

Clear next Tues: Incoming Outlook, IE, Windows critical security patches

Maybe the NSA doesn't need those remote execution holes any more

The Essential Guide to IT Transformation

Microsoft will squash 14 sets of security vulnerabilities - four of which are deemed critical - in the next edition of its monthly batch of Patch Tuesday updates, due next week.

Those four critical patches will address flaws in the Sharepoint server software, the Outlook component of Microsoft Office 2007 and 2010, Internet Explorer (versions 6, 7 and 8) and older versions of Windows (XP and Server 2003). All four critical bugs, plus four "important" ones, allow attackers to remotely execute code on a vulnerable system.

In fact, besides those four critical holes, all the remaining 10 so-called bulletins are rated "important". Redmond is holding off details on the vulnerabilities pending the delivery of fixes this coming Tuesday, so for now we only know which software packages are due to be fixed without knowing why they need updating.

Ziv Mador, director of security research at infosec firm Trustwave, said: "This month Microsoft continues the recent tradition of large Patch Tuesday with fourteen bulletins this month. No less than eight of them are categorised as remote code execution but only four of them are rated as critical."

In the first three quarters of 2013, Microsoft has issued 80 security patches, well ahead of the 63 released in the nine months to September 2012. "The increased numbers come from the important [bugs], not the critical [vulnerabilities]," notes Paul Henry, a security and forensics analyst at Lumension. "Microsoft told us this would be the case this year."

The vulnerability in Microsoft Office 2007 and 2010, which "can be triggered simply by previewing an email in Outlook, even without explicitly opening the email", obviously needs to be patched as soon as possible. The Internet Explorer fixes also need to be rushed through.

Microsoft's prerelease announcement can be found here. Additional comment from Wolfgang Kandek, CTO at cloud security firm Qualys, is here.

Tuesday will also mark the delivery of a critical update for Adobe's Reader and Acrobat PDF software packages. Adobe Reader/Acrobat XI (11.0.03) and earlier versions for Windows and Mac OS X as well as Adobe Reader/Acrobat X (10.1.7) and earlier 10.x for Windows and OS X will all need updating, as explained in an advisory by Adobe here. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.