Microsoft Patch Load Lightens for November

After two straight gargantuan rollouts, IT pros are getting a break with November's patch load.

This month's security update rollout will only have three patches: one "critical" and two "important." This may come as a welcome reprieve in a historic year for bulky security bulletin rollouts.

On this patch slate, products affected are Microsoft Office and Microsoft's Forefront Unified Access Gateway. One of the Microsoft Office vulnerabilities is rated "Critical" and affects all version of Office, including Office 2010.

There are two remote code execution risk factors and one elevation of privilege risk across the three patches, which are designed to plug 11 vulnerabilities.

Critical and Important Items
The lone critical item affects most modern service packs of Microsoft Office including Office XP, Office 2003, 2007 and 2010.

"A critical rating on an Office program is fairly rare," said Wolfgang Kandek, CTO of Qualys. "Most vulnerabilities on the Office suite are categorized as 'Important' because they typically require user interaction to get a successful exploitation. Critical here indicates a vulnerability that can be used to take control of the target machine without user interaction."

Meanwhile, the two important items touch Microsoft Office PowerPoint and Microsoft Forefront Unified Access Gateway respectively.

All three patches might require a restart.

No patch for Internet Explorer
One notable aspect of this month's rollout is that it doesn't seem likely that problems with Internet Explorer will be resolved with a patch before Thanksgiving, according to Paul Henry, Security Analyst for Lumension.

Microsoft released Security Advisory 2458511 on Wednesday, sharing guidance and mitigation regarding the in-the-wild bugs that Redmond said could impact Internet Explorer users "if they visit a Web site hosting malicious code."

"There continues to be no mention of the IE vulnerability that was found in the wild being used in 'drive-by' hacks that allow an attacker to perform a remote code execution, installing malware on the visiting user's system," said Paul Henry of Lumension. "It affects IE versions 6,7 and 8, while users of IE 9 Beta are safe."

Microsoft has published a workaround, for the mean time. Henry commented that Redmond is not expected to release an out-of-band patch until next month.

"It is interesting to note that Microsoft still doesn't believe it represents a significant threat, despite reports that it has been seen in the wild," said Henry.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • What's Behind Microsoft's Sudden Teams Push?

    As Skype for Business slowly gets phased out and Slack's enterprise dominance becomes less of a sure thing, the time is right for Microsoft to focus its marketing energies on its upstart collaboration tool.

  • Microsoft Releases PowerShell 7 Preview 3

    Microsoft announced on Wednesday that the PowerShell 7 Preview 3 scripting solution is now available.

  • SQL Server 2019 Release Candidate Now Available

    Microsoft on Wednesday announced the release of SQL Server 2019 release candidate (RC).

  • Confidential Computing Consortium Formed To Protect Processed Data

    A new Confidential Computing Consortium was announced on Wednesday by the Linux Foundation to boost the security of processed data.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.