News

Microsoft Overhauls Advance Notification, 8 Security Bulletins Coming Tuesday

• By Scott Bekker
• 04/07/2005

Microsoft's security team will deliver about eight security bulletins on April 12, Microsoft's monthly "Patch Tuesday." Four Microsoft product platforms come in for bulletins addressing security issues deemed "critical" in Microsoft's rating system. The number of security bulletins is deliberately vague in the advance notifications, and the fine print notes that the number could change.

Five security bulletins will affect Windows, with at least one of the bulletins earning a critical rating. One security bulletin each will affect Microsoft Office, MSN Messenger and Microsoft Exchange. The maximum security for the Office, Messenger and Exchange bulletins is critical.

The bulletins come after Microsoft formally released none in March following a February that brought 12 bulletins covering 17 security vulnerabilities, 10 of them critical.

Microsoft's advance notification service does not provide details about vulnerabilities. Among outstanding known security problems in Microsoft software are two remote code execution vulnerabilities reported to Microsoft by researchers at eEye Digital Security. The security firm rates both vulnerabilities highly severe. Both affect Internet Explorer, Outlook and several versions of Windows. One was reported to Microsoft March 16, and the other was reported March 29.

Two high-priority updates for Windows that are not security related will also be delivered on the Windows Update site on Tuesday. It is the first time Microsoft has used the Advance Notification to warn users that non-security issues are being patched. In another notification, Microsoft said it will offer an update to the malicious software removal tool, which is available on Windows Update and at the Microsoft Download Center.

On its advance notification page, Microsoft billed the change as "a response to consumer feedback." Critics recently accused the company of trying to slip non-security updates into the code-base quietly through update sites.

Despite the change, Microsoft is reserving the right to make unannounced updates at any time. "This information will pertain ONLY to updates on Windows Update and only about updates being released on the same day as security updates. Information will NOT be provided about Non-security updates released on other days," according to the company's advance notification page.

Microsoft launched the public version of early notification program in November after running the program for a limited group of customers for about a year.

The official Microsoft Webcast to discuss the month's bulletins and security updates will be held April 13 at 11 a.m. Pacific Time. More information is available here.