Microsoft set to release nine patches for 10 security bugs

Share this article:

Microsoft on Tuesday is planning to release nine security patches to repair 10 vulnerabilities across its product line.

Five of the fixes are graded "critical," the software giant's highest severity rating, and address bugs in Windows, Internet Explorer, Exchange, SQL Server, Server Software, and Developer Tools, according to a pre-release notification. The remaining four are deemed "important" and rectify weaknesses in Windows and Office.

One of the critical holes being plugged is an Exchange vulnerability that Microsoft disclosed July 24. According to an advisory released on that day, the flaw involves third-party code in Oracle Outside In, a set of libraries that software developers use to decode hundreds of file formats. Specifically, the vulnerability involves the way in which Oracle Outside In processes Exchange files.

"In the most severe case of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010, it is possible under certain conditions for the vulnerabilities to allow an attacker to take control of the server process that is parsing a specially crafted file," the advisory, which advised on a workaround, said. "An attacker could then install programs; view, change, or delete data; or take any other action that the server process has access to do."

In an email statement to SCMagazine.com on Thursday, Alex Horan, senior product manager at Core Security, a penetration testing software company, called the patches a  "hacker's playground" because all but one involves remedying vulnerabilities that could lead to remote code execution. He said the bulletins addressing Windows and Internet Explorer could be the most appealing for attackers.

Meanwhile, Adobe, also on Tuesday, plans to release new versions of Acrobat and Reader to correct a number of critical vulnerabilities.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.