Microsoft Patch Load Lightens for November

After two straight gargantuan rollouts, IT pros are getting a break with November's patch load.

This month's security update rollout will only have three patches: one "critical" and two "important." This may come as a welcome reprieve in a historic year for bulky security bulletin rollouts.

On this patch slate, products affected are Microsoft Office and Microsoft's Forefront Unified Access Gateway. One of the Microsoft Office vulnerabilities is rated "Critical" and affects all version of Office, including Office 2010.

There are two remote code execution risk factors and one elevation of privilege risk across the three patches, which are designed to plug 11 vulnerabilities.

Critical and Important Items
The lone critical item affects most modern service packs of Microsoft Office including Office XP, Office 2003, 2007 and 2010.

"A critical rating on an Office program is fairly rare," said Wolfgang Kandek, CTO of Qualys. "Most vulnerabilities on the Office suite are categorized as 'Important' because they typically require user interaction to get a successful exploitation. Critical here indicates a vulnerability that can be used to take control of the target machine without user interaction."

Meanwhile, the two important items touch Microsoft Office PowerPoint and Microsoft Forefront Unified Access Gateway respectively.

All three patches might require a restart.

No patch for Internet Explorer
One notable aspect of this month's rollout is that it doesn't seem likely that problems with Internet Explorer will be resolved with a patch before Thanksgiving, according to Paul Henry, Security Analyst for Lumension.

Microsoft released Security Advisory 2458511 on Wednesday, sharing guidance and mitigation regarding the in-the-wild bugs that Redmond said could impact Internet Explorer users "if they visit a Web site hosting malicious code."

"There continues to be no mention of the IE vulnerability that was found in the wild being used in 'drive-by' hacks that allow an attacker to perform a remote code execution, installing malware on the visiting user's system," said Paul Henry of Lumension. "It affects IE versions 6,7 and 8, while users of IE 9 Beta are safe."

Microsoft has published a workaround, for the mean time. Henry commented that Redmond is not expected to release an out-of-band patch until next month.

"It is interesting to note that Microsoft still doesn't believe it represents a significant threat, despite reports that it has been seen in the wild," said Henry.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Microsoft and SAP Enhance Partnership with Teams Integration

    Microsoft and SAP this week described continuing partnership efforts on Microsoft Azure, while also planning a Microsoft Teams integration with SAP's enterprise resource planning product and other solutions.

  • Blue Squares Graphic

    Microsoft Previews Azure IoT Edge for Linux on Windows

    Microsoft announced a preview of Azure IoT Edge for Linux on Windows, which lets organizations tap Linux virtual machine processes that also work with Windows- and Azure-based processes and services.

  • How To Automate Tasks in Azure SQL Database

    Knowing how to automate tasks in the cloud will make you a more productive DBA. Here are the key concepts to understand about cloud scripting and a rundown of the best tools for automating code in Azure.

  • Microsoft Open License To End Next Year for Government and Education Groups

    Microsoft's "Open License program" will end on Jan. 1, 2022, and not just for commercial customers, but also for government, education and nonprofit organizations.

comments powered by Disqus