16 Major Microsoft Patches for Tuesday October 12, 2010 at 1p.m ET

Microsoft said it will deliver a record 16 security updates next week to patch a whopping 49 vulnerabilities in Windows, Internet Explorer (IE), Office and SharePoint.

Andrew Storms, director of security operations for nCircle Security, called the massive update "daunting, again."




Four of the 16 updates were tagged with Microsoft's "critical" label, the highest threat ranking in its four-step scoring system. Another 10 were marked "important," the second-highest rating, while the remaining pair were labeled as "moderate."

Nine of the updates could be exploited by attackers to inject malicious code into vulnerable PCs, Microsoft said in its usual bare-bones advance notification of the updates scheduled for release October 12. Microsoft often labels remote code executable bugs -- the most dangerous -- as important when the vulnerable components are not switched on by default or when other mitigating factors, such as defensive measures like ASLR and DEP, may protect some users.

Next week's Patch Tuesday is a record on almost every count.

The 16 updates -- Microsoft dubs them "bulletins" -- are a record, beating the count from August 2010 by two. The 49 individual patches easily exceeds the single-month record of 34, which was first set in October 2009 and repeated in this past June and August.

Microsoft has been shipping alternating large and small batches of fixes, with the larger-sized updates landing in even-numbered months, so October's big numbers shouldn't come as a shock. In August, for example, the company issued 14 bulletins patching 34 vulnerabilities. September's batch , however, included 9 bulletins that fixed 11 flaws.

"I have a theory about the large October updates," said Storms, pointing out that Microsoft released 13 bulletins and patched 34 vulnerabilities in the month last year, and issued 12 updates and fixed 21 flaws in October 2008. "It's the year-end financial and retail push by most companies, which go into lockdown mode the last two months of the year, when they don't update their systems," he said.

Twelve of the 16 bulletins are aimed at Windows, either the desktop or server editions, or in some cases both. Two from next week's slate affect Office -- Word and Excel, specifically -- and are likely patches for one or more file format vulnerabilities in those applications, said Storms.

One of the bulletins will address a problem in SharePoint, Microsoft's enterprise-grade collaboration server software. According to the advance notification, the SharePoint update will be related in some way to Office Web Apps, the online editions of Microsoft's Word, Excel, PowerPoint and OneNote applications.

Other than the sheer number of updates users will have to apply, Storms also noted that several apply to the newest versions of Microsoft's operating system, Windows 7 on the desktop and Windows Server 2008 R2 on the server side.

Both have been patched numerous times since their introduction last year.

Nine of Tuesday's Windows updates will apply to Windows 7 -- including all three of those marked critical -- while Windows Server 2008 R2 will also receive nine updates, two of them critical.

While Microsoft has touted Windows 7 as its most-secure OS ever, and wants Windows XP users to ditch the nine-year-old software for the new edition, fewer of next week's updates apply to the aged operating system than to Windows 7. XP will be affected by eight of the 13 bulletins, and just two of the three pegged as critical.

The critical IE update will affect IE6, IE7 and IE8. Microsoft did not reply to questions about whether it will also update IE9, which was released as a beta three weeks ago.

"It's the token IE update, and totally expected," said Storms. Microsoft has been patching IE on an every-other-month schedule for some time, and last fixed flaws in the browser two months ago.

Microsoft did not say whether next week's updates would include fixes for vulnerabilities that could be exploited by "DLL load hijacking" attacks .

Also called "binary planting" by some researchers, the attacks leverage design flaws in Windows applications to place malicious files on PCs disguised as DLLs (dynamic link libraries), then have them execute automatically.

Although several vendors have patched their programs to deflect DLL load hijacking attacks, Microsoft has declined to confirm whether any of its applications are vulnerable, and if so, which ones.

Researchers, however, have claimed that IE , Word, PowerPoint and a number of lesser-known Microsoft-made Windows programs are flawed and should be updated.

Even minus a round of DLL patching, next week's updates will stress out IT administrators, said Storms.
"It doesn't look entirely complex," he said. "There's no Exchange update, or SQL Server or IIS. But it will be daunting...again. The overwhelming part is for those organizations that do their due diligence, and test before they deploy the updates."

Other vendors have recently issued large updates. Adobe, for instance, pushed a 23-patch update for its popular Reader PDF viewing software to users earlier this week.

"I continue to harp on Apple for their giant numbers [in their security updates]," said Storms. "Then I look here and realize I can't give Microsoft any breaks this month."

Microsoft will release the 16 updates at approximately 1 p.m. ET on Oct. 12.

Posted in: Micrososft patches