News
No Microsoft Security Patches Expected This Month
Get ready for an anti-climactic Patch Tuesday. Following on the heels of
last
month’s gonzo Patch Tuesday event -- wherein Microsoft Corp. released
12 new patches -- Redmond this month
doesn’t
plan to patch any security-related flaws.
Zero. Nada. Zilch. This is in spite of the fact that Microsoft has already
confirmed the existence of at
least one extant Word zero-day exploit, which surfaced shortly after last
month’s Patch Tuesday festivities. In a posting last month on Microsoft’s
Security Research Center Blog, researcher Alexandra Huft confirmed that Redmond
was investigating the vulnerability.
The probable non-appearance of a patch
at this time is hardly without precedent, of course: The first of four Word
zero-day exploits came to light in early December of 2006, followed by the appearance
of three others through January and February; it wasn’t until Feb. 13
(Patch Tuesday), however, that Microsoft issued patches for them.
Thursday's advance notification isn't always the last word in Patch Tuesday deliverables, either In January, for example, Microsoft yanked several promised Windows patches from its Patch Tuesday payload. The company has also been known to add patches at the last minute.
"Microsoft occasionally has months when it has not released security updates," commented a Microsoft spokesperson via e-mail. "The last time Microsoft did not offer security updates as part of its monthly update cycle was September 2005."
"There are many factors that impact the length of time between the discovery of a vulnerability and the release of a security update, and every vulnerability presents its own unique challenges," read another part of the e-mailed statement.
Redmond does plan to release two non-security high-priority updates
on Windows Update (WU) and Software Update Services (SUS); and four non-security
high-priority updates on Microsoft Update (MU) and Windows Server Update Services
(WSUS). Microsoft is also prepping still another update for its Windows Malicious
Software Removal Tool on Tuesday. That update will be available via WU, MU,
SUS and WSUS.
About the Author
Stephen Swoyer is a Nashville, TN-based freelance journalist who writes about technology.