Network Security, Patch/Configuration Management, Vulnerability Management

Microsoft’s October update to fix 23 flaws

Microsoft expects to release eight patches to address 23 security vulnerabilities in Windows and other products, the company said Thursday.

The bulletins, of which two are rated “critical” and six deemed “important,” are due Tuesday, Oct. 11 at about 2 p.m. EST.

The critical patches will address flaws in Microsoft Windows, Internet Explorer, Silverlight, and the company's .NET framework that could allow for the propagation of an internet worm without user action, according to an advance notification advisory. The important fixes will correct issues that could result in users' data being compromised or cause a denial of service.

One of the important bulletins is particularly interesting because it affects ­Forefront Unified Access Gateway, security software used by employees for remote access, Marcus Carey, security researcher at vulnerability management firm Rapid7, said in a statement sent to SCMagazineUS.com on Thursday.

“No one wants to hear that software that is designed for security is vulnerable to remote code execution,” Carey said. “This bulletin and the related vulnerabilities will definitely pique a lot of attackers' interest. Organizations should keep an eye out for suspicious activity on servers running this software.”

Nearly all of the patches, meanwhile, will require a restart, which will cause widespread disruptions across both internet-connected servers and user community desktops, Paul Henry, security and forensic analyst at vulnerability management firm Lumension, warned in a statement sent to SCMagazineUS.com on Thursday.

Microsoft last month released five security bulletins correcting six vulnerabilities in SharePoint, Excel, Office, Windows and the Windows Internet Name Service (WINS).

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.