Microsoft warns of giant Patch Tuesday

Microsoft will issue 11 security updates next week to fix bugs in Windows, Active Directory, Internet Explorer (IE), Office and Host Integration Server.

Share

Microsoft will issue 11 security updates next week to fix bugs in Windows, Active Directory, Internet Explorer (IE), Office and Host Integration Server.

Four of the 11 updates will be "critical," Microsoft's highest threat ranking, with six deemed "important," the next-lowest rating, and one tagged as "moderate."

Seven of the 11 updates will address vulnerabilities that Microsoft acknowledged can be used to execute remote code.

This means hackers could exploit those vulnerabilities to inject their own malicious code into vulnerable PCs, often by convincing users to open a file attachment or tricking them into visiting a rogue Web site.

Bugs in Active Directory, Internet Explorer, Excel and Microsoft Host Integration Server were all tagged critical.

The Active Directory fix will apply only to Windows 2000 Server, said Microsoft, which has patched the component several times, most recently in June when it fixed a broader problem in validating client LDAP requests.

On the other hand, the patch for Host Integration Server (HIS) is a first for that software, a little-known enterprise product that connects Windows-based networks to IBM mainframe and AS/400 systems. HIS 2000, HIS 2004 and HIS 2006 are all affected, said Microsoft.

The Excel update is likely to patch a file format problem; both Windows and Mac editions of the spreadsheet program will have to be patched, said Microsoft. When that has happened in the past, the update has usually addressed file format bugs.

The IE patch, meanwhile, will fix flaws rated critical in IE5 and IE6, but which Microsoft ranked as only important for the newer IE7. According to Danish bug tracker Secunia, which lists several vulnerabilities in IE that need attention, the most-pressing problem is a cross-domain scripting bug in IE6 reported more than three months ago.

Other updates, including all six marked important, will address bugs in various versions of Windows; the one bulletin labelled moderate affects only Office XP Service Pack 3 (SP3).

In a related note, Microsoft said last month that Tuesday's updates would be the last for Office 2003 SP2; after next week, the company will only support that version of Office as Service Pack 3.


Find your next job with computerworld UK jobs