Microsoft plans colossal Patch Tuesday next week

Daunting patch day to fix 49 flaws in IE, Windows, Office and SharePoint

Microsoft today said it will deliver a record 16 security updates next week to patch a whopping 49 vulnerabilities in Windows, Internet Explorer (IE), Office and SharePoint.

Andrew Storms, director of security operations for nCircle Security, called the massive update "daunting, again."

Four of the 16 updates were tagged with Microsoft's "critical" label, the highest threat ranking in its four-step scoring system. Another 10 were marked "important," the second-highest rating, while the remaining pair were labeled as "moderate."

Nine of the updates could be exploited by attackers to inject malicious code into vulnerable PCs, Microsoft said in its usual bare-bones advance notification of the updates scheduled for release Oct. 12. Microsoft often labels remote code executable bugs -- the most dangerous -- as important when the vulnerable components are not switched on by default or when other mitigating factors, such as defensive measures like ASLR and DEP, may protect some users.

Next week's Patch Tuesday is a record on almost every count.

The 16 updates -- Microsoft dubs them "bulletins" -- are a record, beating the count from August 2010 by two. The 49 individual patches easily exceeds the single-month record of 34, which was first set in October 2009 and repeated in this past June and August.

Microsoft has been shipping alternating large and small batches of fixes, with the larger-sized updates landing in even-numbered months, so October's big numbers shouldn't come as a shock. In August, for example, the company issued 14 bulletins patching 34 vulnerabilities. September's batch , however, included 9 bulletins that fixed 11 flaws.

"I have a theory about the large October updates," said Storms, pointing out that Microsoft released 13 bulletins and patched 34 vulnerabilities in the month last year, and issued 12 updates and fixed 21 flaws in October 2008. "It's the year-end financial and retail push by most companies, which go into lockdown mode the last two months of the year, when they don't update their systems," he said.

12 of the 16 bulletins are aimed at Windows, either the desktop or server editions, or in some cases both. Two from next week's slate affect Office -- Word and Excel, specifically -- and are likely patches for one or more file format vulnerabilities in those applications, said Storms.

One of the bulletins will address a problem in SharePoint, Microsoft's enterprise-grade collaboration server software. According to the advance notification, the SharePoint update will be related in some way to Office Web Apps, the online editions of Microsoft's Word, Excel, PowerPoint and OneNote applications.

Other than the sheer number of updates users will have to apply, Storms also noted that several apply to the newest versions of Microsoft's operating system, Windows 7 on the desktop and Windows Server 2008 R2 on the server side.

Both have been patched numerous times since their introduction last year.

Nine of Tuesday's Windows updates will apply to Windows 7 -- including all three of those marked critical -- while Windows Server 2008 R2 will also receive nine updates, two of them critical.

While Microsoft has touted Windows 7 as its most-secure OS ever, and wants Windows XP users to ditch the nine-year-old software for the new edition, fewer of next week's updates apply to the aged operating system than to Windows 7. XP will be affected by eight of the 13 bulletins, and just two of the three pegged as critical.

The critical IE update will affect IE6, IE7 and IE8. Microsoft did not reply to questions about whether it will also update IE9, which was released as a beta three weeks ago.

"It's the token IE update, and totally expected," said Storms. Microsoft has been patching IE on an every-other-month schedule for some time, and last fixed flaws in the browser two months ago.

Microsoft did not say whether next week's updates would include fixes for vulnerabilities that could be exploited by "DLL load hijacking" attacks .

Also called "binary planting" by some researchers, the attacks leverage design flaws in Windows applications to place malicious files on PCs disguised as DLLs (dynamic link libraries), then have them execute automatically.

Although several vendors have patched their programs to deflect DLL load hijacking attacks, Microsoft has declined to confirm whether any of its applications are vulnerable, and if so, which ones.

Researchers, however, have claimed that IE , Word, PowerPoint and a number of lesser-known Microsoft-made Windows programs are flawed and should be updated.

Even minus a round of DLL patching, next week's updates will stress out IT administrators, said Storms.

"It doesn't look entirely complex," he said. "There's no Exchange update, or SQL Server or IIS. But it will be daunting...again. The overwhelming part is for those organizations that do their due diligence, and test before they deploy the updates."

Other vendors have recently issued large updates. Adobe, for instance, pushed a 23-patch update for its popular Reader PDF viewing software to users earlier this week.

"I continue to harp on Apple for their giant numbers [in their security updates]," said Storms. "Then I look here and realize I can't give Microsoft any breaks this month."

Microsoft will release the 16 updates at approximately 1 p.m. ET on Oct. 12.

Join the PC World newsletter!

Error: Please check your email address.

Tags MicrosoftsecurityWindowssoftwareoperating systems

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest News Articles


PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?