Microsoft to release patches for IE, Exchange bugs

By Dan Kaplan on Aug 10, 2012 8:05 AM
Filed under Security

Nine for 10.

Microsoft is planning to release nine security patches next Tuesday to repair 10 vulnerabilities across its product line.

Five of the fixes are graded "critical," the software giant's highest severity rating, and address bugs in Windows, Internet Explorer, Exchange, SQL Server, Server Software, and Developer Tools. The remaining four are deemed "important" and rectify weaknesses in Windows and Office.

One of the critical holes being plugged is an Exchange vulnerability that Microsoft disclosed July 24. The flaw involves third-party code in Oracle Outside In, a set of libraries that software developers use to decode hundreds of file formats. Specifically, the vulnerability involves the way in which Oracle Outside In processes Exchange files.

"In the most severe case of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010, it is possible under certain conditions for the vulnerabilities to allow an attacker to take control of the server process that is parsing a specially crafted file," an advisory, which advised on a workaround, said. "An attacker could then install programs; view, change, or delete data; or take any other action that the server process has access to do."

Alex Horan, senior product manager at Core Security, a penetration testing software company, called the patches a "hacker's playground" because all but one involves remedying vulnerabilities that could lead to remote code execution. He said the bulletins addressing Windows and Internet Explorer could be the most appealing for attackers.

Meanwhile, Adobe, also on Tuesday, plans to release new versions of Acrobat and Reader to correct a number of critical vulnerabilities.

This article originally appeared at

Follow us on Facebook and Twitter

Copyright © SC Magazine, US edition


Microsoft to release patches for IE, Exchange bugs
Top Stories
Generation-e acquires Paradyne
Creates 1,000-client powerhouse in UC and cloud.
Crunching the numbers: how the 2015 CRN Fast50 did it
Unearthing secrets of their success.
Squeezed in cloud, Rackspace bets on 'co-opetition'
AWS and Azure deals follow dark years for Rackspace.
Sign up to receive CRN email bulletins
Was your most important vendor the same in 2015 as in 2014?

Latest Comments
CRN Magazine

Issue: 343 | October 2015

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.