Microsoft plans two patches, no SharePoint fix

Share this article:

Microsoft is prepping two patches for next week's monthly security update, according to an advance notification released Thursday, but there are no plans to release a fix for a dangerous SharePoint flaw that was disclosed last week.

The patches, to arrive on Tuesday, fix one vulnerability each. One of the flaws resides in Windows, the other in Office. Users running Windows 7 and 2008 R2 are not impacted by either of the bugs, Jerry Bryant, group manager of response communications at Microsoft, said in a blog post Thursday.

Not scheduled for a fix is the vulnerability in Microsoft's business collaborative platform, SharePoint, which could allow hackers to elevate privileges and steal sensitive data. The flaw was disclosed to Microsoft in early April by Swiss security firm High-Tech Bridge. On April 29, High-Tech Bridge, whose policy is to go public with bug details two weeks after notifying the vendor, issued an advisory, which included a link to a proof-of-concept code that exploits the vulnerability.

Microsoft has said it is not aware of any in-the-wild attacks targeting the vulnerability. It has released its own advisory, offering suggested workarounds, such as restricting access to the SharePoint help.aspx XML files.

"Our teams are still working on an update for that issue," Bryant said. "In the meantime, we recommend customers review the advisory and apply the workarounds."

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

LEADS Act addresses gov't procedure for requesting data stored abroad

LEADS Act addresses gov't procedure for requesting data ...

Senators introduced the legislation last week as a means of amending the Electronic Communications Privacy Act (ECPA).

Report: Intrustion prevention systems made a comeback in 2013

Report: Intrustion prevention systems made a comeback in ...

A new report indicates that intrusion prevention systems grew 4.2 percent in 2013, with growth predicted to continue.

Mobile device security sacrificed for productivity, study says

Mobile device security sacrificed for productivity, study says

A Ponemon Institute study, sponsored by Raytheon, revealed that employees increasingly use mobile devices for work but cut corners and circumvent security.