Patch Tuesday omits critical Word fix
470743
Less than zero-day September's Patch Tuesday leaves users waiting for a fix to defend against a zero-day exploit in Microsoft Word, targeted by malware authors over recent days.â¦
335332
While today's Patch Tuesday featured a patch for every level of importance -- one "critical," one "important," and one "moderate -- experts are saying the bigger story is what was not fixed.
78946
Microsoft released 11 security updates Tuesday to&#160;fix critical flaws in its products, including a publicly known ActiveX bug that affects users of the Visual FoxPro database.In total, 17 individual software flaws were patched in the updates. Microsoft rates six updates as critical, meaning they should be installed as soon as possible, while the remaining five updates are considered &quot;important.&quot; Last month was an easier month on IT administrators, when Microsoft released just two updates.Microsoft surprised some by releasing one&#160;fewer update than expected. Last Thursday, the software vendor had said that it was&#160;readying a fix&#160;for critical VBScript and JScript flaws in Windows 2000, XP, and Windows Server 2003. That update wasn&#39;t included in this week&#39;s patches, but on Tuesday, Microsoft wouldn&#39;t confirm that it had actually dropped the update because &quot;this could put customers at risk,&quot; according a spokeswoman for the company&#39;s public relations agency.Security experts said Tuesday that the MS08-010 update, which fixes four bugs in Internet Explorer, should take top priority this week. &quot;There are four vulnerabilities within that particular patch and all of them are remote-code executable,&quot; said Jonathan Bitle, director of technical account management with Qualys.&quot;The way we&#39;re looking at it, our prioritization would put MS08-010 at the top, followed by MS08-007,&quot; said Don Leatham, director of solutions and strategy with Lumension Security.MS08-010 fixes a publicly disclosed ActiveX bug that affects Visual FoxPro users. Although hackers have already posted code showing how to exploit this vulnerability, the buggy ActiveX control is not included in Internet Explorer 7&#39;s default list of controls, so the flaw should not affect most users.The MS08-007 update fixes a critical flaw in the Windows XP and Vista WebDAV redirector software. WebDAV is a Web-based document sharing protocol. The flaw is rated important for Windows Server 2003 users.Microsoft&#39;s Office products are also a major source of patches this month. Tuesday&#39;s updates include critical fixes for Microsoft Word, Office Publisher, and Office itself. There is also a critical update for Windows&#39; Object Linking and Embedding (OLE) Automation software. The remaining updates, rated important, are for Active Directory, the Vista TCP/IP stack, the Microsoft Works file converter, and two bugs in the Internet Information Services (IIS) Web server.The Patch Tuesday updates show that client-side bugs continue to be a much higher risk than server-side vulnerabilities, said Andrew Storms, director of security operations with nCircle. &quot;One would have assumed that the IIS and Active Directory vulnerabilities would have been the most serious because they stand at the core of an enterprise and provide more critical services,&quot; he said via instant message. &quot;But with this month&#39;s patches, the hacker&#39;s best bet is to take advantage of the client-side attacks.&quot;
159505
Microsoft Corp. has patched critical flaws in Internet Explorer, Windows Media Player and Visual Basic with its last "Patch Tuesday" release of 2006.
716380
Fix for critical security hole in Windows Media Format was added to Microsoft's Patch Tuesday updates at the last moment.
592740
Microsoft issued seven patches on Tuesday as part of its monthly Patch Tuesday cycle, with three updates receiving the dreaded "critical" rating. While Redmond did not issue an update for the newly discovered Word vulnerabilities, the software giant said it is still working on a fix for the two critical flaws that have been the target of numerous hack attacks since last week.
71719
As Redmond unwraps 'comments disabled' vuln research blog Microsoft plans to issue two security patches next Tuesday, one of which earns the dreaded rating of critical, in this year's first edition of its regular Patch Tuesday update cycle.â¦
717255
Microsoft will have patches for Windows and Visual Studio on Tuesday, but apparently not for a Word flaw being used in cyberattacks.
660592
(InfoWorld) - After handling 19 sets of patches inÂ JulyÂ andÂ August, system administrators will catch a bit of a break next week when Microsoft Corp. is expected to release just three security updates for its Windows and Office products. On Thursday, Microsoft said that only one of these updates, for Office, is rated as critical. The updates will be released Tuesday in line with Microsoft's monthly patch release schedule. Microsoft'sÂ advance notification on the updatesÂ can be found at its Web site. The other two updates, which fix problems with Windows, are rated no higher than Important, meaning that user action would be required before an attack based on these flaws could succeed. As usual, Microsoft did not release any further details on the patches. That information will be divulged when the patches are made available Tuesday. But the company may be planning to patch aÂ recently reported flaw in its Word 2000 software. Earlier this week Symantec Corp. warned that the flaw was being exploited by attackers to run unauthorized software on a victim's computer. Â
425600
December's Patch Tuesday finds Vista in bad guys' sights. Plus: Get Office 2007 SP1, get your fix for Flash, and avoid an HP laptop disaster.
696261
September's set of security patches from Microsoft is a comparatively light one. The three fixes include a repair for a recently revealed hole in Microsoft Publisher, but a similar gap in Word continues to go unaddressed.
321788
Microsoft on Tuesday issued a patch for an earlier discovered flaw in Visual Studio 2005, while yet another cumulative patch for Internet Explorer was released, as well as one for a vulnerability within the Windows Media Format.
17746
SEATTLE -- Microsoft released a patch for its latest &quot;critical&quot; rated security flaw affecting its Windows, Office and developer tools software programs, the company said Tuesday.
430010
Microsoft releases patches for three security holes, but does not have a fix for a Word 2000 flaw being used in attacks.
768888
By recent standards, September's Patch Tuesday will be mild, with only five patches and one being rated "critical." In the past several months, Microsoft has dealt with more critical errors in its products with four in June, three in July, and six in August.
738931
In sharp contrast to last month&#39;s barrage of critical patches, Microsoft today offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
766773
(InfoWorld) - With its monthly security updates due out Tuesday, Microsoft Corp. has a new problem to worry about: Word flaws. The software vendor on Sunday confirmed a report that criminals are e-mailing maliciously crafted Word attachments to victims. While these attacks are not widespread, they are dangerous because the attacker could run unauthorized software on the victim's computer if the attachment is opened. This is the second such Word attack to be confirmed by Microsoft in the past week. Last Tuesday, MicrosoftÂ warned of a similar Word flaw, saying that it was aware of "limited attacks attempting to use the vulnerability." Over the past year, hackers have increasingly looked to Microsoft's Office suite as a source of new bugs. Attacks based on flaws in Excel and PowerPoint have been reported as well. Exploits of this latest flaw appear to be even rarer than those based on last week's Word bug. "The vulnerability is being exploited on a very, very limited and targeted basis," Microsoft said in its alert. Neither problem is expected to be fixed in Tuesday's software patches, which will address flaws in Windows and Visual Studio. This second bug affects Word 2000, 2002, 2003 and the Word Viewer 2003, which are all vulnerable to last week's bug as well. The most recent version of the software, Word 2007, which was released to business users in late November, is not affected, Microsoft said. Â