Microsoft five critical updates won't include IIS

A patch repairing a critical zero-day flaw in Microsoft's IIS Web server will not be ready in time for Patch Tuesday, the software giant said.
To get security news and tips delivered to your inbox, click here to sign up for our free newsletter.

Microsoft said it plans to release five critical patches next week, repairing flaws in Microsoft Windows that could be remotely attacked by hackers.

In its advance notification issued Thursday, the software giant said two of the updates require mandatory restarts. The patches affect Windows 2000, XP and Vista, as well as all three of Microsoft's server platforms 2000, 2003 and 2008.

Microsoft said it won't have a patch ready for a vulnerability affecting the FTP Service in Microsoft Internet Information Services 5.0. A security advisory was issued earlier this week warning users about the flaw.

Exploit code was published, but so far there have been no reported ongoing attacks in the wild, Microsoft said. The exploit code began circulating on the Milw0rm site on Monday.

While a patch is being tested, Microsoft issued recommendations alerting customers to a workaround. Companies can modify the NTFS file system permissions to bar FTP users from creating directories.

Dig deeper on Windows Security: Alerts, Updates and Best Practices



Enjoy the benefits of Pro+ membership, learn more and join.



Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: