Microsoft to Plug Windows Security Holes on Patch Tuesday
Microsoft is issuing 13 security bulletins next week, eight of them critical. In the batch are two critical Windows security bulletins - one for the zero-day in the Server Message Block protocol and the other for vulnerabilities in the FTP service in Microsoft Internet Information Services.Microsoft plans to release 13 security bulletins in a massive patch Tuesday update next week. Eight of the 13 bulletins are rated "critical," and the remaining five are classified as "important." All totaled, the bulletins cover 34 vulnerabilities affecting Microsoft Windows, Internet Explorer, Office, Silverlight, Forefront, Developer Tools and SQL Server.
Among the bulletins being issued is one covering a zero-day vulnerability in the Microsoft Server Message Block (SMB) protocol that was disclosed last month. The vulnerability is caused when the SMB implementation does not properly parse SMBv2 negotiation requests, and could allow an attacker to take control of a vulnerable system. The bug impacts Windows Vista and Windows Server 20008, and while the company has yet to report seeing any attacks leveraging it, exploit code is known to be publicly available.