Microsoft plans monster Patch Tuesday next week

Unlucky 13 sets record as biggest-ever patch day, includes first-ever for Windows 7 RTM

Microsoft today said it will deliver its largest-ever number of security updates on Tuesday to fix flaws in every version of Windows, as well as Internet Explorer (IE), Office, SQL Server, important developer tools and the enterprise-grade Forefront Security client software.

Among the updates will be the first for the final, or release to manufacturing, code of Windows 7, Microsoft's newest operating system.

The company will ship a total of 13 updates next week, eight of them pegged "critical," the highest threat ranking in its four-step scoring system, beating the previous record of 12 updates shipped in February 2007 and again in October 2008.

"Thirteen is not a lucky number," said Andrew Storms, director of security operations at nCircle Network Security, reacting to the massive slate scheduled for Oct. 13. "They've been a busy bunch at Microsoft, that's for sure."

Storms was unable to parse today's advance notification - Microsoft's way of forewarning customers with the barest of details, including the number of updates, their ranking and the software they impact - to determine whether the company will patch the still-unfixed vulnerability in SBM 2. "There's just too much data here to use the deduction method," said Storms. "But with all that's here, you have to imagine that it's going to be patched."

The bug in SMB (Server Message Block) 2, a Microsoft-made network file- and print-sharing protocol that ships with Windows, was first revealed by Microsoft Sept. 7 . Since then, attack code has gone public, although security researchers have not seen any in-the-wild attacks . The flaw affects Windows Vista, Windows Server 2008 and preview releases of Windows 7.

Of the 13 updates, Storms put the patches scheduled for SQL Server, Visual Studio and IE at the top of his list.

"The SQL Server update will affect a lot of people, especially those who use it as the back-end for their Web sites. And the Visual Studio update makes me wonder if it's another fix for ATL," Storms said, referring to the Active Template Library (ATL) bug that Microsoft itself introduced in its popular development platform.

Microsoft patched a number of bugs in the ATL code "library," which the company and others rely on to create their programs, in August.

"There's also the token IE update," added Storms. "Even IE8 is critical this month."

Windows 7 will receive its first official patches next week: Five of the 13 bulletins were marked today by Microsoft as affecting the new operating system. "At this point, Windows 7 is essentially released," said Storms.

Although Windows 7 won't reach retail or be available on new PCs until later this month, some customers - primarily enterprises with volume licensing agreements - have been able to obtain the OS for the last two months.

Both consumers and company administrators should gear up for a busy Tuesday, Storms warned. The latter will especially have a tough time with the monster update, since businesses typically try to test updates before they roll them out to their servers or client systems. "The problem for enterprises will be staying diligent with their patch management policies," said Storms. "But with this many updates, there should be places to cut corners to get the most critical updates out according to their own schedules."

Testing 13 updates may also give system administrators fits, he warned. "There are so many potential interactions with this many," Storms concluded. "It's going to be a full month of testing for some."

Microsoft will release the 13 updates at approximately 1 p.m. ET on Oct. 13.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Microsoftmicrosoft patchessecurity patch

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?