Patch Tuesday: Windows 8, Exchange in danger

Patch Tuesday: Windows 8, Exchange in danger

Microsoft is issuing critical patches for flaws found in Windows 7, 8 and RT desktops as well as for the spam and malware filter for Microsoft Exchange server.

The first affects not only the Windows clients but also Windows Server 2008 and 2012, and if unpatched leaves them vulnerable to attacks that could result in interlopers remotely executing code on victim machines.

+ Also on Network World: How Microsoft and Mobilespaces are using the cloud for MDM | Satya Nadella and Bill Gates's apron strings | So you think you know networking? Quiz II +

The second critical bulletin flags a vulnerability in Windows Forefront, which is security for Exchange. It could lead to attackers disabling Forefront, leaving mail recipients open to malware in emails or give attackers entry into the Mail server itself, says Wolfgang Kandek, the CTO of Qualys.

That makes this patch worth paying attention to, says Ross Barrett, a senior manager of security engineering at Rapid7. "Given a remote code execution in a perimeter service like Forefront, I'd have to say that this is the highest priority patching issue this month," he says.

With a total of only five bulletins overall, that makes for the second light patching month in a row, he notes.

"This month's bulletins are unusual in that they don't touch older versions of Windows or Internet Explorer," says Tyler Reguly, manager of security research for Tripwire.

Kandek says usually Microsoft issues Internet Explorer patches every other month, so it's unusual that there were none in January and none again this month. But he expects a thorough patching next month just days before the annual Pwn2own browser-hacking contest. "I think it would make sense to have a fully patched browser at that point," he says. Successful hacks from the competition may prey on flaws that are known now and could be patched by the time exploits against them come out at Pwn2own, he says.

He notes that separately, Adobe has issued an update to its Flash Player because there are live exploits for a vulnerability. Generally the Adobe patches align with Microsoft's Patch Tuesday, but because an exploit has been found in the wild, it issued the fix early. Users should install the update right away, he says.

Tim Greene covers Microsoft and unified communications for Network World and writes the Mostly Microsoft blog. Reach him at and follow him on Twitter@Tim_Greene.

Read more about software in Network World's Software section.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags managementMicrosoftpatch managementNetworkingsoftwarequalysRapid7



Access4 holds inaugural A/NZ Annual Conference

Access4 holds inaugural A/NZ Annual Conference

​Access4 held its inaugural Annual Conference in Port Douglass, Queensland, for Australia and New Zealand from 9-11 October, hosting partners from across the region with presentations on Access4 product updates, its 2023 Partner of the Year awards and more.

Access4 holds inaugural A/NZ Annual Conference
Show Comments