Microsoft plans two patches, no SharePoint fix

Share this article:

Microsoft is prepping two patches for next week's monthly security update, according to an advance notification released Thursday, but there are no plans to release a fix for a dangerous SharePoint flaw that was disclosed last week.

The patches, to arrive on Tuesday, fix one vulnerability each. One of the flaws resides in Windows, the other in Office. Users running Windows 7 and 2008 R2 are not impacted by either of the bugs, Jerry Bryant, group manager of response communications at Microsoft, said in a blog post Thursday.

Not scheduled for a fix is the vulnerability in Microsoft's business collaborative platform, SharePoint, which could allow hackers to elevate privileges and steal sensitive data. The flaw was disclosed to Microsoft in early April by Swiss security firm High-Tech Bridge. On April 29, High-Tech Bridge, whose policy is to go public with bug details two weeks after notifying the vendor, issued an advisory, which included a link to a proof-of-concept code that exploits the vulnerability.

Microsoft has said it is not aware of any in-the-wild attacks targeting the vulnerability. It has released its own advisory, offering suggested workarounds, such as restricting access to the SharePoint help.aspx XML files.

"Our teams are still working on an update for that issue," Bryant said. "In the meantime, we recommend customers review the advisory and apply the workarounds."

Share this article:

Sign up to our newsletters

More in News

Report: SQL injection a pervasive threat, behavioral analysis needed

Report: SQL injection a pervasive threat, behavioral analysis ...

Long lag times between detection and resolution and reliance on traditional methods impair an organization's ability to combat SQL injection attacks.

WhatsApp bug allows for interception of shared locations

Researchers identified a vulnerability in WhatsApp that could enable an attacker to intercept shared locations using a man-in-the-middle attack, or a rogue access point.

Google tweaks its terms of service for clarity on Gmail scanning

The company is currently dealing with a lawsuit that challenges its email scanning practices.