Microsoft set to release nine patches for 10 security bugs

Share this article:

Microsoft on Tuesday is planning to release nine security patches to repair 10 vulnerabilities across its product line.

Five of the fixes are graded "critical," the software giant's highest severity rating, and address bugs in Windows, Internet Explorer, Exchange, SQL Server, Server Software, and Developer Tools, according to a pre-release notification. The remaining four are deemed "important" and rectify weaknesses in Windows and Office.

One of the critical holes being plugged is an Exchange vulnerability that Microsoft disclosed July 24. According to an advisory released on that day, the flaw involves third-party code in Oracle Outside In, a set of libraries that software developers use to decode hundreds of file formats. Specifically, the vulnerability involves the way in which Oracle Outside In processes Exchange files.

"In the most severe case of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010, it is possible under certain conditions for the vulnerabilities to allow an attacker to take control of the server process that is parsing a specially crafted file," the advisory, which advised on a workaround, said. "An attacker could then install programs; view, change, or delete data; or take any other action that the server process has access to do."

In an email statement to SCMagazine.com on Thursday, Alex Horan, senior product manager at Core Security, a penetration testing software company, called the patches a  "hacker's playground" because all but one involves remedying vulnerabilities that could lead to remote code execution. He said the bulletins addressing Windows and Internet Explorer could be the most appealing for attackers.

Meanwhile, Adobe, also on Tuesday, plans to release new versions of Acrobat and Reader to correct a number of critical vulnerabilities.

Share this article:

Sign up to our newsletters

More in News

In Cisco probe, misuse or compromise spotted on all firms' networks

In Cisco probe, misuse or compromise spotted on ...

Cisco analyzed the business networks of 30 multinational companies last year, and revealed the findings in its 2014 Annual Security Report.

Fareit trojan observed spreading Necurs, Zbot and CryptoLocker

The Necurs and Zbot trojans, as well as CryptoLocker ransomware, has been observed by researchers as being spread through another trojan, known as Fareit.

Post Heartbleed, tech giants join initiative to bolster open source

Post Heartbleed, tech giants join initiative to bolster ...

The newly formed Core Infrastructure Initiative, created to boost under-funded open source projects, will tackle OpenSSL first.