Microsoft to Ship 6 Security Bulletins, 2 Critical

As part of its monthly security patch distribution, Microsoft will issue five bulletins covering Windows vulnerabilities and one for its Visual Studio package, with critical updates coming for both programs.

Microsoft reported on Dec. 7 that it will ship six individual security bulletins as part of its monthly Patch Tuesday update next week, with at least two of the fixes aimed at addressing critical issues in its products.

In a preview of the patch release scheduled for Dec. 12, Microsoft said it would release five bulletins targeting vulnerabilities in its Windows operating system, at least one of which will address a flaw ranked by the company as critical, its most severe security rating. The sixth bulletin released by the company will attempt to close a critical hole in its Visual Studio development package.

For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

Microsoft did not provide further details regarding the nature of the bulletins or how many individual patches each release will involve, but it could be that the Visual Studio fix will aim to solve a vulnerability identified in the software by security researchers during the final week of October.

Resource Library:

The Redmond, Wash., software giant has offered few additional details about a flaw it said it was investigating that involved a problem with the ActiveX control in Visual Studio 2005 on Windows. Researchers have published proof-of-concept code meant to exploit the glitch, and Microsoft said it had received word of limited attacks using the reported vulnerability.

The December Patch Tuesday installment does not appear to include a fix for an unpatched vulnerability in its Word software program that is being used in targeted, zero-day attacks. On Dec. 5, the company issued a security advisory that said the flaw can be exploited if a user simply opens a rigged Word document.

Click here to read more about the zero-day attacks against Microsoft Word.

Microsoft said it would also ship four high-priority nonsecurity Windows updates via its Windows Update and Software Update Services automated patch delivery systems as part of the release, as well as an updated version of its Windows Malicious Software Removal Tool. The malware removal kit will be distributed on Microsofts Windows Update, Microsoft Update, Windows Server Update Services and Download Center resources, but not via its Software Update Service.

In addition, the company plans to distribute 10 other high-priority nonsecurity updates over its Microsoft Update and Windows Server Update Services.

In November, Microsoft released a critical cumulative update for its Internet Explorer browser to fix a flaw that had been being used in targeted zero-day attacks since early October, along with five other security bulletins, four of which were meant to address critical issues.

Microsoft isnt the only software maker being forced to issue sizeable security bulletins in recent weeks. In late November Apple Computer shipped a monster security update to correct a total of 22 vulnerabilities in its Mac OS X operating system.

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraines eWEEK Security Watch blog.

Reader Comments: Microsoft to Ship 6 Security Bulletins, 2 Critical >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By Matt Hines