News
11 Fixes Expected for Patch Tuesday
Fixes touch on a wide range of Windows OS releases and components
Microsoft's October patch release cycle promises to be a busy one as Redmond announced plans to roll out 11 security bulletins in its Tuesday security release. Four are "critical," six are deemed "important" and one received a "moderate" rating.
All four critical patches have remote code execution (RCE) exploit considerations. The six important items are split between RCE and elevation-of-privilege bug implications. The moderate item is focused on preventing information disclosure hacks.
Overall, the fixes touch on a wide range of Windows OS releases, as well as Windows components such as Active Directory and applications such as Internet Explorer and Office, plus a rare fix involving Microsoft's Host Integration Server program.
Critical Items
The first critical item planned for the slate will be an Active Directory fix, affecting only Windows 2000 Service Pack 4. This security update is designed to stop an RCE attack.
Next up will be IE fixes affecting specific Internet Explorer versions -- IE 5.01 through IE 7 -- sitting on Windows 2000 SP4, XP, Vista, and Windows Server 2003 and 2008.
The third item expected in the critical category is seldom seen by IT pros. It involves Microsoft Host Integration Server (HIS), a gateway program fostering interoperability between Microsoft Windows networks and legacy operating systems, as well as IBM mainframe and AS/400. The patch covers HIS 2000 and HIS 2004 on both the client and server side and HIS 2006 for 32-bit and 64-bit systems.
The fourth and final critical fix that Microsoft expects to deliver will focus on Excel in Office 2000 SP3, XP SP3, and Office 2003 SP2 and SP3; it also touches on Microsoft Office 2007. Additional apps affected by this fix include Office 2004 for Mac, XML file converter for Mac, Excel Viewer, Office 2007 Compatibility Pack, and SharePoint Server.
Important and Moderate Items
All six "important" items will be Windows OS patches, according to Microsoft's announcement.
One fix will touch on XP and Windows Server 2003. Others will address Windows 2000 SP4 along with XP, Vista and the Windows Server series 2003 and 2008. One of the six fixes will concentrate solely on Windows 2000 SP4.
As for the "moderate" fix, it is a single update to XP SP3.
All but two of the projected 11 patches will require restarts.
IT pros and Windows enterprise professionals interested in perusing items pertaining to general updates and other nonsecurity content can look at this knowledgebase article. It describes such updates as delivered through Microsoft Update, Windows Update and Windows Server Update Services.
The final slate for the October patch cycle will not arrive until Tuesday, and Microsoft may have some last-minute changes. Still, with the fixes projected here, there will be much patching for IT administrators to consider this month.
-- Jabulani Leffall