News Stay informed about the latest enterprise technology news and product updates.

Microsoft to fix 26 flaws in Windows, Office

The Microsoft Advance Notification warns of five critical bulletins across its product line. A total of 13 bulletins address 26 vulnerabilities.

Microsoft plans to issue a bevy of bulletins next week repairing more than two dozen Windows vulnerabilities across its product line.

We encourage customers to upgrade to the latest versions of both Windows and Office.
Jerry Bryant,
senior managerMicrosoft Security Response Center (MSRC)

In the Microsoft Advance Notification Service issued Thursday, the software giant said five of the bulletins are rated critical and seven bulletins are rated important. One bulletin was given a moderate rating.

According to Jerry Bryant, a senior manager with the Microsoft Security Response Center (MSRC), bulletins repairing flaws in Microsoft Office will not affect users of Office 2007 or Office 2008. The bulletins repair older versions of the software giant's popular productivity software. Bryant said the Office updates were given an important rating.

"We encourage customers to upgrade to the latest versions of both Windows and Office," Bryant wrote on the MSRC blog. "As this bulletin release shows, the latest versions are less impacted overall due to the improved security protections built in to these products."

Microsoft will also address a low-impact Windows Kernel zero-day vulnerability in which the core underlying operating system fails to handle certain exceptions. The vulnerability exists in nearly all versions of Windows. If successfully exploited, the problem could result in freezing or a forced restart of some systems.

Microsoft updates:
Jan. - Microsoft issues critical security update, blocks IE 6 attacks: Microsoft issued an emergency patch today blocking ongoing attacks against corporate networks that have been exploiting a vulnerability in Internet Explorer 6.

Jan. - Microsoft releases Windows OpenType Font Engine patch: Lone security bulletin is critical for Windows 2000 users.

Dec. - Microsoft gives Internet Explorer a major security overhaul: The final regular Microsoft update of 2009 repairs five critical vulnerabilities in IE and blocks public exploit code, which surfaced in November. 

The Windows Kernel vulnerability is considered low-impact because an attacker would need valid login credentials and must be able to log on locally to exploit it. Bryant said Microsoft is unaware of any attacks targeting the vulnerability.

Bryant released a Windows bulletin summary table describing the total number of bulletins and their rating for each version of Windows. Four of the bulletins are given a priority rating of 1, the highest priority given to a bulletin.

Despite the high number of vulnerabilities being patched there is some good news for IT departments, said Don Leatham, senior director of solutions strategy at Scottsdale, Ariz.-based vulnerability management vendor Lumension Security Inc., in a prepared statement.

"The Microsoft Office Suite doesn't have any critical patches coming out, but overall, IT departments are facing the need to deploy a large number of patches to all Microsoft computers in the organization with many forced reboot situations," Leatham said. "Therefore, it will be imperative to plan ahead this month on how these patches should be deployed throughout their enterprises to minimize the possibility of widespread disruption."

Patches not ready for SMB zero-day, Internet Explorer flaws
Microsoft engineers are still working on patches to address known zero-day vulnerabilities in the Server Message Block and Internet Explorer.

Microsoft issued an advisory outlining the SMB zero-day vulnerability in November. The issue, which could be exploited to cause a denial of service (DoS) condition, affects both SMBv1 and SMBv2 running on all Windows systems. A successful exploit would result in freezing a system, but would not enable an attacker to execute code. Microsoft said that it is unaware of any active attacks targeting the flaw despite the availability. The issue is unrelated to a critical SMBv2 vulnerability that was patched in October.

A patch is also still being tested to address new vulnerabilities discovered in Internet Explorer. Microsoft issued an advisory on the IE information disclosure vulnerabilities. Until a patch is issued, Microsoft issued a temporary Microsoft Fix-it (direct download) for Windows XP users.

Dig Deeper on Microsoft Windows security

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.