Microsoft to Plug Windows Security Holes on Patch Tuesday

Microsoft plans to release 13 security bulletins in a massive patch Tuesday update next week.

Eight of the 13 bulletins are rated "critical," and the remaining five are classified as "important." All totaled, the bulletins cover 34 vulnerabilities affecting Microsoft Windows, Internet Explorer, Office, Silverlight, Forefront, Developer Tools and SQL Server.

Among the bulletins being issued is one covering a zero-day vulnerability in the Microsoft Server Message Block (SMB) protocol that was disclosed last month. The vulnerability is caused when the SMB implementation does not properly parse SMBv2 negotiation requests, and could allow an attacker to take control of a vulnerable system. The bug impacts Windows Vista and Windows Server 20008, and while the company has yet to report seeing any attacks leveraging it, exploit code is known to be publicly available.

The company is also releasing a fix for vulnerabilities in the FTP Service in Microsoft Internet Information Services (IIS) versions 5.0, 5.1, 6.0, and 7.0. The vulnerabilities could allow remote code execution (RCE) on systems running FTP Service on IIS 5.0, or denial of service (DoS) on systems running FTP Service on IIS 5.0, IIS 5.1, IIS 6.0 or IIS 7.0.

For more about Windows 7 and security, please click here. 

The FTP vulnerabilities came under attack last month. While organizations wait for a patch, Microsoft has advised administrators to not allow FTP write access to anonymous users. In addition, the NTFS file system permissions can be modified to disallow directory creation by FTP users. Information about how to do both those things is contained in Microsoft's advisory.

“Most of these updates require a restart so please factor that into your deployment planning,” blogged Jerry Bryant, of the Microsoft Security Response Center team.  “Usually we do not go into this level of detail in the advance notification but we felt that it is important guidance so customers can plan accordingly and deploy these updates as soon as possible.”

The patches are scheduled to be released Oct. 13.