On September
14th, Microsoft will release nine security related updates to fix 13
bugs in Windows, Office and Web server software. Four updates are listed as “critical”, which
is Microsoft’s highest threat level, and an additional five updates were labeled
as “important”, the second highest level.
The patch is twice the size of a typical patch for the odd numbered months,
such as September, which would typically be a month with a smaller batch of
fixes.
Some experts
had speculated that the patch is targeting the DLL or dynamic-link libraries vulnerabilities
identified three weeks ago by HD More, chief security officer at Rapid7. Some of the vulnerabilities are tied to
Microsoft’s office suite including PowerPoint 2007 and 2010, and Word 2007,
which are can be subject to “DLL load hijacking”. "I don't think it's likely that they'll
have something [in Windows] on the DLL problem," stated Wolfgang Kandek,
chief security officer of Qualys. "I'd
like to see it, but it's a tough decision for them because that has the
potential of making apps stop working."
Don Leatham senior director of solutions and strategy at Lumension
pointed out that the update mix focuses on older versions of Windows. According to a recent Leatham email, "These
results show that organizations running Windows 7 are running much more secure
environments, and as an added benefit, this Patch Tuesday will practically be a
non-event for them," Leatham said. "Organizations stuck on Windows XP
need to take a hard look at the cost and risk factors associated with staying
on that dated platform."
Related Link:
http://www.computerworld.com/s/article/9184372/Microsoft_plans_double_sized_Patch_Tuesday_next_week