Microsoft plans two patches, no SharePoint fix

Share this article:

Microsoft is prepping two patches for next week's monthly security update, according to an advance notification released Thursday, but there are no plans to release a fix for a dangerous SharePoint flaw that was disclosed last week.

The patches, to arrive on Tuesday, fix one vulnerability each. One of the flaws resides in Windows, the other in Office. Users running Windows 7 and 2008 R2 are not impacted by either of the bugs, Jerry Bryant, group manager of response communications at Microsoft, said in a blog post Thursday.

Not scheduled for a fix is the vulnerability in Microsoft's business collaborative platform, SharePoint, which could allow hackers to elevate privileges and steal sensitive data. The flaw was disclosed to Microsoft in early April by Swiss security firm High-Tech Bridge. On April 29, High-Tech Bridge, whose policy is to go public with bug details two weeks after notifying the vendor, issued an advisory, which included a link to a proof-of-concept code that exploits the vulnerability.

Microsoft has said it is not aware of any in-the-wild attacks targeting the vulnerability. It has released its own advisory, offering suggested workarounds, such as restricting access to the SharePoint help.aspx XML files.

"Our teams are still working on an update for that issue," Bryant said. "In the meantime, we recommend customers review the advisory and apply the workarounds."

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

President signs Executive Order to improve payment security

President signs Executive Order to improve payment security

President Obama signed an Executive Order at the Consumer Financial Protection Bureau calling for enhanced security measures, including microchips and PINs.

Security, tech firm coalition fights Hikit actors, other advanced groups

Security, tech firm coalition fights Hikit actors, other ...

The coalition began as an effort to stop the spread of the Hikit trojan, previously known for targeting U.S. defense contractors.

Phishing email delivers keylogger malware, also takes screenshots

Phishing email delivers keylogger malware, also takes screenshots

The malware has various features, including the ability to start persistently, take screenshots and bypass user access controls.