Patch/Configuration Management, Vulnerability Management

Six fixes this Patch Tuesday, but Microsoft mum on Word flaw

Microsoft is planning to push out six patches on Tuesday, presumably including one for a critically flawed ActiveX control in Visual Studio 2005.

The Redmond, Wash. software giant is issuing five other patches to correct unnamed vulnerabilities in Windows, at least one of which is labeled critical.

Some security observers were upset Microsoft did not offer a patch for the Visual Studio bug in its November release.

Redmond first warned of active attacks early last month that take advantage of a flawed WMI Object Broker ActiveX control. Attackers who exploit the vulnerability could take complete control of an affected system, earning full user rights.

Experts have said the flaw needs a prompt fix because many developers use the Visual Studio platform.

Microsoft will not offer a fix for a dangerous, zero-day flaw that exists in a number of Word versions. The company, which warned about the flaw this week, said it was investigating reports of proof-of-concept code.

In the Patch Tuesday release, Microsoft also is scheduled to release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update (WU), Microsoft Update (MU), Windows Server Update Services (WSUS) and the Download Center. However, the tool will not be distributed through Software Update Services (SUS).

It also plans to release 14 non-security, high-priority updates for WU, SUS, MU and WSUS.

Click here to email Dan Kaplan.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.