Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Microsoft plans patches for 'hacker's playground'

Gregg Keizer | Aug. 10, 2012
Microsoft will patch at least 14 vulnerabilities next week, including four in Internet Explorer (IE), making it three months in a row that the company has plugged holes in its browser.

Last month, Microsoft announced it would ditch the every-other-month schedule for IE -- for years it updated the browser only on even-numbered months -- saying that it had "increased our Internet Explorer resources to the point where we will be able to release an update during any month instead of on our previous, bi-monthly cadence."

Security experts applauded Microsoft for the move last month.

"It looks like IE will be the story every month now," said Storms, who noted there seems to be no shortage of IE vulnerabilities. "I don't think they're proving a point, that they're patching just because they said they can every month, but because they have to."

The IE update was rated critical for all client editions of Windows and all versions of the browser, from the 11-year-old IE6 to the current IE9. According to Paul Henry, a security and forensic analyst at Lumension, the IE update will patch four separate vulnerabilities.

Updates singled out by other researchers include those pegged "Bulletin 4" and "Bulletin 2" by Microsoft.

Lumension's Henry cited Bulletin 4 -- the one that will patch SQL Server -- as his most important, with Bulletin 2 not far behind.

"[Bulletin 4] addresses an ActiveX component that's redistributed in many places in Windows," Henry wrote in an email today. "It's an issue that was previously patched and this patch cleans up the previous patch."

Bulletin 2, meanwhile, applies only to Windows XP, the still-dominant-but-aging operating system. "If you're running a remote desktop protocol in Windows XP, then Bulletin 2 should be another very important update," argued Henry. "This is a remote code execution issue and ... no authentication is needed."

The wide range of next week's updates -- two will address bugs in Office 2003, 2007 and 2010 on Windows, for instance, while others will tackle Visual Basic and Visual FoxPro 8.0 -- prompted another expert, Alex Horn, a senior product manager with CORE Security, to call August's bunch "a hacker's playground."

Microsoft will release the nine updates at approximately 1 p.m. ET on Aug 14.


Previous Page  1  2 

Sign up for CIO Asia eNewsletters.