News

Patch Tuesday To Deliver Six Security Fixes

• By Jabulani Leffall
• 12/04/2009

There's no rest for the weary, as Microsoft is planning to release six security bulletins for this coming Patch Tuesday.

Redmond expects to close out the year with three "critical" and three "important" fixes in its proposed December security patch. As usual, remote code execution (RCE) exploits will dominate the risk considerations in this cycle.

The December patch will contain a mix of Windows components to fix, as well as security updates for Microsoft Office and Internet Explorer. There will be one denial-of-service exploit on tap as well.

Critical Patches
The first critical RCE patch affects all versions of Windows, but the fix for Windows Server 2008 is the highlight, according to Microsoft. Critical hotfix No. 2 touches Microsoft Project 2000, 2002 and 2003.

But it's the third and last critical patch -- a cumulative hotfix for Internet Explorer -- that IT pros will be looking to patch the quickest next week.

"[It's] the big one, and Microsoft has been pretty open about that," said Sheldon Malm, senior director of security strategy at Rapid7. "There is proof-of-concept code for the invalid pointer reference issue in IE 6 and 7 and it is listed as 'critical' on all platforms except Server 2008."

The problem was noteworthy enough that Microsoft issued a security advisory on the matter just before Thanksgiving.

Important Patches
Windows 2000, XP and Windows Server 2003 are on the agenda for the first important fix, which will address the sole denial-of-service exploit risk.

The second important fix just touches on Windows Server 2003 and 2008. Meanwhile, the third important fix will address an RCE consideration for Windows 2000, XP and Windows Server 2003.

All of the patches for this month may require a restart.

One bug seems to be off December slate so far, according to Don Leatham, senior director of solutions and strategy at Lumension.

"It appears that Microsoft is not issuing a patch for the recently announced TLS flaw that will most likely force updates to all brands of browsers and all SSL/TLS Internet servers using SSL/TLS," Leatham said.

IT pros will have to wait until Patch Tuesday to know for sure whether Microsoft is leaving out such a fix, but Leatham added that "we are led to believe that Microsoft has chosen not to address this vulnerability in this round of patches."

On top of the patch, those interested in nonsecurity updates via Windows Server Update Services, Windows Update and Microsoft Update services, can find information in this KnowledgeBase article.