Menu
Microsoft plans monster security update for next week

Microsoft plans monster security update for next week

Microsoft will issue 16 security updates on Tuesday, the most in more than three years, to patch Internet Explorer, Windows, Office, Exchange Server and SharePoint Server.

Microsoft today said it will issue 16 security updates on Tuesday, the most in more than three years, to patch Internet Explorer (IE), Windows, Office, Exchange Server and SharePoint Server.

The 16 "bulletins," as Microsoft calls its updates, listed in today's advance notice were nearly double the previous 2014 record of nine set in May and August, trumped 2013's record of 13, and came within an ace of the all-time 17 last set in April 2011.

Russ Ernst, director of product management with security firm Lumension, called November's slate "whopping" in an email today, while Jon Rudolph, senior software engineer at Core Security, christened it "overwhelming."

Five of the 16 were pegged "critical," Microsoft's most serious threat ranking. Nine were tagged "important," the next step down in the four-step scoring system, while two were labeled "moderate."

A quintet were identified as fixing vulnerabilities that, if exploited, could result in "remote code execution," meaning that successful hackers could hijack a system and install malware on the machine. Seven others will patch less dire "elevation of privilege" bugs.

As is now rote, Microsoft will patch all supported versions of its IE browser, from the almost-retired IE6 on Windows Server 2003 to the newest IE11. The fix for IE on Windows' client editions -- Vista, Windows 7 and Windows 8/8.1 -- was ranked critical for IE7, IE8, IE9, IE10 and IE11.

Microsoft did not put a number to the individual IE vulnerabilities it will patch, but in the last five months the company has quashed 161 bugs in the browser, or an average of 32 each month. The largest number of IE flaws fixed in a single month during that stretch was 60 in June, but September (with 37) and August (26) weren't far behind.

Other critical updates will tackle vulnerabilities in various flavors of Windows, including the intriguing Bulletin 5, which affects only the server operating systems. Microsoft said that the one or more bugs set for quashing by Bulletin 5 were not present in the client editions, but that they would be updated nonetheless to provide "additional defense-in-depth hardening" as protection against similar vulnerabilities that may pop up in the future.

A pair of the important updates will address vulnerabilities in SharePoint Server 2010 and Exchange Server 2007, 2010 and 2013. Fixes applied by those updates will deal with elevation of privilege flaws, and may require restarting the servers, often a dicey deal for IT staffs as both SharePoint and Exchange -- but especially the latter -- are mission-critical systems that cannot be offline for any but the very shortest stretches.

"Exchange server patching is always tricky because the systems are mission critical and often deployed on the perimeter," agreed Ross Barrett, senior manager of security engineering at Rapid7, in an email. "Administrators will have to balance the risk of exploit with their perceived exposure and their tolerance for downtime."

Microsoft will release the 16 updates on Nov. 11 around 10 a.m. PT (1 p.m. ET).

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags Malware & VulnerabilitiesLumensionantispamMicrosoftsecurity

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments