Menu
Microsoft plans patches for 'hacker's playground'

Microsoft plans patches for 'hacker's playground'

Slates at least 14 bug fixes for Exchange, SQL Server, Windows, Office; will update IE for third month running

Microsoft today said it will patch at least 14 vulnerabilities next week, including four in Internet Explorer (IE), making it three months in a row that the company has plugged holes in its browser.

Of the nine updates set for Aug. 14, five will be labeled "critical," the most serious of the four ratings Microsoft uses. The other four will be pegged "important," the next-lower threat ranking.

The big story for next week will be the one-two punch of patches for Exchange and SQL Server.

"Those are two of the three things that are most important to IT in enterprises," said Andrew Storms, director of security operations at nCircle Security. "Thank goodness SharePoint's not included. But Microsoft is hitting two out of three in just one month."

In the advanced notification of next week's updates, Microsoft outlined patches for Exchange, the email server software used by most companies, and SQL Server, the database that runs many corporations' internal and external processes, including powering websites and providing workers with everything from business intelligence to financial information.

The problem with patching those systems -- Exchange and SQL Server -- is their criticality to business, said Storms.

"In most companies, security and operations are split into two groups," said Storms. "That sets up a classic conflict. Security cares about patching, operations cares about uptime."

Some firms deal with the conflict by running a lab where the security team can replicate the firm's production systems and use those for patch testing. Other companies rely on redundancy to prevent a company-wide failure of email and databases.

In any case, IT administrators like to go slowly when dealing with Exchange and SQL Server to ensure that updates don't cause unexpected downtime. "It could take some enterprises months to patch all their Exchange nodes," Storms said.

The last time Microsoft patched any version of Exchange was December 2010, when it updated Exchange Server 2007. The update set for next week will affect Exchange Server 2007 and the current Exchange Server 2010.

"And it's not like you can ignore the Exchange patch," said Storms. "It's a zero-day."

Storms was referring to the security advisory Microsoft issued July 24 that warned of critical vulnerabilities in code licensed from Oracle that could give attackers access to Exchange Server 2007 and Exchange Server 2010 systems.

Oracle patched the vulnerabilities in its "Oracle Outside In" code libraries as part of a massive update on July 17 that fixed nearly 90 flaws.

Along with the Exchange, SQL Server and IE updates, others will address bugs in Windows, Office and Visual Basic, the company's widely-used development platform.

The IE update will be the third in three months for the browser: Microsoft also patched IE in June and July.

Last month, Microsoft announced it would ditch the every-other-month schedule for IE -- for years it updated the browser only on even-numbered months -- saying that it had "increased our Internet Explorer resources to the point where we will be able to release an update during any month instead of on our previous, bi-monthly cadence."

Security experts applauded Microsoft for the move last month.

"It looks like IE will be the story every month now," said Storms, who noted there seems to be no shortage of IE vulnerabilities. "I don't think they're proving a point, that they're patching just because they said they can every month, but because they have to."

The IE update was rated critical for all client editions of Windows and all versions of the browser, from the 11-year-old IE6 to the current IE9. According to Paul Henry, a security and forensic analyst at Lumension, the IE update will patch four separate vulnerabilities.

Updates singled out by other researchers include those pegged "Bulletin 4" and "Bulletin 2" by Microsoft.

Lumension's Henry cited Bulletin 4 -- the one that will patch SQL Server -- as his most important, with Bulletin 2 not far behind.

"[Bulletin 4] addresses an ActiveX component that's redistributed in many places in Windows," Henry wrote in an email today. "It's an issue that was previously patched and this patch cleans up the previous patch."

Bulletin 2, meanwhile, applies only to Windows XP, the still-dominant-but-aging operating system. "If you're running a remote desktop protocol in Windows XP, then Bulletin 2 should be another very important update," argued Henry. "This is a remote code execution issue and ... no authentication is needed."

The wide range of next week's updates -- two will address bugs in Office 2003, 2007 and 2010 on Windows, for instance, while others will tackle Visual Basic and Visual FoxPro 8.0 -- prompted another expert, Alex Horn, a senior product manager with CORE Security, to call August's bunch "a hacker's playground."

Microsoft will release the nine updates at approximately 1 p.m. ET on Aug 14.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Read more about security in Computerworld's Security Topic Center.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments