Microsoft to patch four bugs on Tuesday

Three "critical," fixes in Windows, Word, Publisher and all of the company's anti-malware applications

Microsoft said it plans to post four security updates next week, three of them "critical," to patch Windows, Word, Publisher and all of the company's anti-malware applications.

Among the critical fixes will be one that quashes bugs in Microsoft's Jet Database Engine that go back as far as 2005. The other critical patches will close holes in Microsoft's word processor and desktop publishing programs.

"Finally, the expected fix for Jet," said Andrew Storms, director of security operations at nCircle.

Seven weeks ago, Microsoft rang an alarm over critical vulnerabilities in Jet Database Engine, a Windows component that provides data access to applications such as Microsoft Access and Visual Basic. The company posted a security advisory on March 22 that acknowledged "public reports of very limited, targeted attacks" using Word documents that triggered the Jet Database bug.

Several days later, Microsoft's security team admitted it had known of the Jet Database bugs for more than two years, but had not patched the problems because it thought it had blocked the obvious attack vectors. In a post to the Microsoft Security Response Center (MSRC) blog, Mike Reavey, the group's operations manager, said it might replace the version of Jet in Windows 2000, XP and Server 2003 SP1 to fix the flaws.

The Jet Database Engine included in Windows Vista, Windows Server 2003 SP2 and the just-released Windows XP SP3 is not vulnerable to the attacks, and doesn't require replacement.

According to Microsoft's prepatch notification, which it issued Thursday, Microsoft will swap out the buggy Jet in Windows 2000, XP SP2 and Server 2003 SP1.

It also appears that Microsoft will fix Word to shut down that attack vector, said nCircle's Storms. "I have a strong feeling that they're patching both ends of the problem," he said. "They're covering all the bases, which is the right thing to do."

The single non-critical patch slated for release is a fix marked "important" by Microsoft that will affect the company's consumer and enterprise anti-malware products. The patch will address what Microsoft called a denial-of-service issue in Antigen, Forefront Security, Windows Live OneCare and Windows Defender.

Storms said that the bug is likely minor. "Given that it's a denial-of-service, it's probably one of those things like a specially-crafted Zip file that makes the scanning engine chug and chug and chug," he said. "It's probably not a big deal." It would be a different story, he said, if Microsoft had said that the vulnerability could crash the security software. If that were the case, he added, attackers might be able to inject malicious code onto a vulnerable system.

All in all, it looks like a lighter Patch Tuesday -- the name some give to the second Tuesday of the month, when Microsoft regularly issues security updates -- than last month. "I think it will probably be an easy week," Storms said.

The four security updates will be posted on Tuesday around 1 p.m. EST. If Microsoft issues all of the expected updates, it will have released 29 through the first five months of 2008, the same number it unveiled through May of last year.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?