Microsoft to Release 7 Patches

The last batch of updates this year focuses on security fixes for Windows and Internet Explorer.


A Round of Patches from Microsoft
Microsoft corporation promised to end the year with a bang by scheduling
seven security updates Tuesday to fix flaws in Windows and Internet Explorer.

Even though Microsoft pledged that Windows Vista, the year-old operating system, is the most secure version of Windows ever, it will still be affected by five of the seven updates. "That's no small percentage," noted Andrew Storms, director of security operations at nCircle Inc. "The perpetuates the fact that even though Microsoft said it was secure, it still needs plenty of patches."

Three of the seven updates will be rated "critical" - Microsoft's highest ranking, while the remaining four will be labeled "important", the next lower rating. Microsoft has revealed limited amount of information about the updates in a prepatch notification posted to its website last Sunday.

One of the seven is a sure bet, Storms said, referring to an update for Windows dubbed as important that will affect Windows XP, and Windows Server 2003. "The Macrovision patch is the most likely candidate for what they're calling bulletin 5," said Storms.

Early last month, Microsoft confirmed that attackers were actively exploiting a bug in third-party anti-piracy software bundled with Windows. The software, which Microsoft licenses from Macrovision Inc., had been updated for Vista, which was why that OS was not at risk. Although Macrovision quickly issued a replacement driver for Windows XP and Server 2003, Microsoft said it needed time to prepare and test the update, which meant it missed the November patch deadline.

"The rest of these are a complete surprise to me," admitted Storms. With one exception, he also hesitated at guessing the contents of the remaining half-dozen updates. His one prediction: "Bulletin 7 might be the fix for the WPAD vulnerability."

On Monday, the Microsoft Security Response Center advised users of a bug in the way Windows looks up other computers on the Internet that has resurfaced. The flaw could allow attackers to steer users to an untrustworthy Web Proxy Auto-Discovery (WPAD) server, where they would receive directions to, say, malicious Web sites rather than the legitimate destinations.
"That would be a very quick fix, and unlikely Microsoft behavior, but if the fix is as simple as some have said, it's possible," said Storms.

Unless it yanks one or more from the list at the last minute, Microsoft will end the year having released 69 security bulletins in 2007, nine fewer than 2006's total but 14 more than in 2005.