Menu
Microsoft plans monster security update for next week

Microsoft plans monster security update for next week

Microsoft will issue 16 security updates on Tuesday, the most in more than three years, to patch Internet Explorer, Windows, Office, Exchange Server and SharePoint Server.

Microsoft today said it will issue 16 security updates on Tuesday, the most in more than three years, to patch Internet Explorer (IE), Windows, Office, Exchange Server and SharePoint Server.

The 16 "bulletins," as Microsoft calls its updates, listed in today's advance notice were nearly double the previous 2014 record of nine set in May and August, trumped 2013's record of 13, and came within an ace of the all-time 17 last set in April 2011.

Russ Ernst, director of product management with security firm Lumension, called November's slate "whopping" in an email today, while Jon Rudolph, senior software engineer at Core Security, christened it "overwhelming."

Five of the 16 were pegged "critical," Microsoft's most serious threat ranking. Nine were tagged "important," the next step down in the four-step scoring system, while two were labeled "moderate."

A quintet were identified as fixing vulnerabilities that, if exploited, could result in "remote code execution," meaning that successful hackers could hijack a system and install malware on the machine. Seven others will patch less dire "elevation of privilege" bugs.

As is now rote, Microsoft will patch all supported versions of its IE browser, from the almost-retired IE6 on Windows Server 2003 to the newest IE11. The fix for IE on Windows' client editions -- Vista, Windows 7 and Windows 8/8.1 -- was ranked critical for IE7, IE8, IE9, IE10 and IE11.

Microsoft did not put a number to the individual IE vulnerabilities it will patch, but in the last five months the company has quashed 161 bugs in the browser, or an average of 32 each month. The largest number of IE flaws fixed in a single month during that stretch was 60 in June, but September (with 37) and August (26) weren't far behind.

Other critical updates will tackle vulnerabilities in various flavors of Windows, including the intriguing Bulletin 5, which affects only the server operating systems. Microsoft said that the one or more bugs set for quashing by Bulletin 5 were not present in the client editions, but that they would be updated nonetheless to provide "additional defense-in-depth hardening" as protection against similar vulnerabilities that may pop up in the future.

A pair of the important updates will address vulnerabilities in SharePoint Server 2010 and Exchange Server 2007, 2010 and 2013. Fixes applied by those updates will deal with elevation of privilege flaws, and may require restarting the servers, often a dicey deal for IT staffs as both SharePoint and Exchange -- but especially the latter -- are mission-critical systems that cannot be offline for any but the very shortest stretches.

"Exchange server patching is always tricky because the systems are mission critical and often deployed on the perimeter," agreed Ross Barrett, senior manager of security engineering at Rapid7, in an email. "Administrators will have to balance the risk of exploit with their perceived exposure and their tolerance for downtime."

Microsoft will release the 16 updates on Nov. 11 around 10 a.m. PT (1 p.m. ET).


Follow Us

Join the newsletter!

Or
Error: Please check your email address.

Tags securityMicrosoftantispamLumensionMalware & Vulnerabilities

Featured

Slideshows

Bumper channel crowd kicks off first After Hours of 2018

Bumper channel crowd kicks off first After Hours of 2018

After Hours made a welcome return to the channel social calendar with a bumper crowd of partners, distributors and vendors descending on The Jefferson in Auckland to kick-start 2018. Photos by Gino Demeer.

Bumper channel crowd kicks off first After Hours of 2018
Looking back at the top 15 M&A deals in NZ during 2017

Looking back at the top 15 M&A deals in NZ during 2017

In 2017, merger and acquisitions fever reached new heights in New Zealand, with a host of big name deals dominating the headlines. Reseller News recaps the most important transactions of the Kiwi channel during the past 12 months.

Looking back at the top 15 M&A deals in NZ during 2017
Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Show Comments