Menu
Microsoft plans monster security update for next week

Microsoft plans monster security update for next week

Microsoft will issue 16 security updates on Tuesday, the most in more than three years, to patch Internet Explorer, Windows, Office, Exchange Server and SharePoint Server.

Microsoft today said it will issue 16 security updates on Tuesday, the most in more than three years, to patch Internet Explorer (IE), Windows, Office, Exchange Server and SharePoint Server.

The 16 "bulletins," as Microsoft calls its updates, listed in today's advance notice were nearly double the previous 2014 record of nine set in May and August, trumped 2013's record of 13, and came within an ace of the all-time 17 last set in April 2011.

Russ Ernst, director of product management with security firm Lumension, called November's slate "whopping" in an email today, while Jon Rudolph, senior software engineer at Core Security, christened it "overwhelming."

Five of the 16 were pegged "critical," Microsoft's most serious threat ranking. Nine were tagged "important," the next step down in the four-step scoring system, while two were labeled "moderate."

A quintet were identified as fixing vulnerabilities that, if exploited, could result in "remote code execution," meaning that successful hackers could hijack a system and install malware on the machine. Seven others will patch less dire "elevation of privilege" bugs.

As is now rote, Microsoft will patch all supported versions of its IE browser, from the almost-retired IE6 on Windows Server 2003 to the newest IE11. The fix for IE on Windows' client editions -- Vista, Windows 7 and Windows 8/8.1 -- was ranked critical for IE7, IE8, IE9, IE10 and IE11.

Microsoft did not put a number to the individual IE vulnerabilities it will patch, but in the last five months the company has quashed 161 bugs in the browser, or an average of 32 each month. The largest number of IE flaws fixed in a single month during that stretch was 60 in June, but September (with 37) and August (26) weren't far behind.

Other critical updates will tackle vulnerabilities in various flavors of Windows, including the intriguing Bulletin 5, which affects only the server operating systems. Microsoft said that the one or more bugs set for quashing by Bulletin 5 were not present in the client editions, but that they would be updated nonetheless to provide "additional defense-in-depth hardening" as protection against similar vulnerabilities that may pop up in the future.

A pair of the important updates will address vulnerabilities in SharePoint Server 2010 and Exchange Server 2007, 2010 and 2013. Fixes applied by those updates will deal with elevation of privilege flaws, and may require restarting the servers, often a dicey deal for IT staffs as both SharePoint and Exchange -- but especially the latter -- are mission-critical systems that cannot be offline for any but the very shortest stretches.

"Exchange server patching is always tricky because the systems are mission critical and often deployed on the perimeter," agreed Ross Barrett, senior manager of security engineering at Rapid7, in an email. "Administrators will have to balance the risk of exploit with their perceived exposure and their tolerance for downtime."

Microsoft will release the 16 updates on Nov. 11 around 10 a.m. PT (1 p.m. ET).

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags Malware & VulnerabilitiesLumensionantispamMicrosoftsecurity

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments