Microsoft to release patches for IE, Exchange bugs

Nine for 10.

Microsoft is planning to release nine security patches next Tuesday to repair 10 vulnerabilities across its product line.

Five of the fixes are graded "critical," the software giant's highest severity rating, and address bugs in Windows, Internet Explorer, Exchange, SQL Server, Server Software, and Developer Tools. The remaining four are deemed "important" and rectify weaknesses in Windows and Office.

One of the critical holes being plugged is an Exchange vulnerability that Microsoft disclosed July 24. The flaw involves third-party code in Oracle Outside In, a set of libraries that software developers use to decode hundreds of file formats. Specifically, the vulnerability involves the way in which Oracle Outside In processes Exchange files.

"In the most severe case of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010, it is possible under certain conditions for the vulnerabilities to allow an attacker to take control of the server process that is parsing a specially crafted file," an advisory, which advised on a workaround, said. "An attacker could then install programs; view, change, or delete data; or take any other action that the server process has access to do."

Alex Horan, senior product manager at Core Security, a penetration testing software company, called the patches a "hacker's playground" because all but one involves remedying vulnerabilities that could lead to remote code execution. He said the bulletins addressing Windows and Internet Explorer could be the most appealing for attackers.

Meanwhile, Adobe, also on Tuesday, plans to release new versions of Acrobat and Reader to correct a number of critical vulnerabilities.

This article originally appeared at scmagazineus.com