News

Microsoft Readying 6 Fixes for April's Security Update

For the second month in a row, Microsoft will release six bulletin items in its April security update, according to the Microsoft Security Bulletin Advance Notification.

"So far this year Microsoft has been issuing a fairly stable number of patch Tuesday bulletins every month," said Andrew Storms, director of security operations for nCircle in an e-mail. "We saw seven bulletins in January, nine in February, and six in both March and April. This is quite a bit different than their historical pattern of dramatic swings in bulletin volume from month to month."

The monthly patch will feature four "critical" items and two "important" bulletins. All four of the critical bulletins will address remote code execution vulnerabilities in Windows, Internet Explorer, Microsoft .NET Framework, Microsoft Office, Microsoft SQL Server, Microsoft Server Software and Microsoft Developer Tools.

As for the two important bulletin items, the first addresses an information disclosure flaw in Microsoft Forefront United Access Gateway, and the second targets an additional remote code execution hole in Microsoft Office.

After last month's alleged leak of RCP code, Marcus Carey, security researcher at Rapid7, discussed the possible tightening of security procedures when it comes to releasing security information to Microsoft partners.

"After the Microsoft MAPP exploit proof-of-concept leak regarding MS12-020, I wouldn't be surprised if Microsoft attempts to batten down the hatches on the amount of information they disclose prior to the monthly patch cycle," said Carey. "Based on that leaked proof-of-concept code, exploit developers were able to create a denial of service exploit."

Microsoft has yet made a statement regarding its ongoing investigation of the information leak.

April's security bulletin is set to arrive at 10 a.m. PST on Tuesday.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Microsoft Shifting Away from Office 365 Brand Name in April

    Microsoft on Monday announced coming product naming changes, where "Office 365" is mostly getting replaced by the "Microsoft 365" brand.

  • Microsoft Grows Services Amid COVID-19

    Microsoft in a Saturday announcement recapped how its services have been affected by "shelter-in-place" governmental mandates in the last week, providing details on growth stats and prioritizations.

  • Microsoft Adds 6 More Months to Expiring Certification Programs

    Microsoft has announced an extension to the end date of three certification programs slated for retirement.

  • Microsoft's Surface Pro X: It's Like the Surface RT, But Better

    There's a lot about the Surface Pro X that's reminiscent of the ill-fated Surface RT. But despite the similarities, this might just be one of the rare cases where the sequel is better than the original.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.