Microsoft to release patches for IE, Exchange bugs

By Dan Kaplan on Aug 10, 2012 8:05 AM
Filed under Security

Nine for 10.

Microsoft is planning to release nine security patches next Tuesday to repair 10 vulnerabilities across its product line.

Five of the fixes are graded "critical," the software giant's highest severity rating, and address bugs in Windows, Internet Explorer, Exchange, SQL Server, Server Software, and Developer Tools. The remaining four are deemed "important" and rectify weaknesses in Windows and Office.

One of the critical holes being plugged is an Exchange vulnerability that Microsoft disclosed July 24. The flaw involves third-party code in Oracle Outside In, a set of libraries that software developers use to decode hundreds of file formats. Specifically, the vulnerability involves the way in which Oracle Outside In processes Exchange files.

"In the most severe case of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010, it is possible under certain conditions for the vulnerabilities to allow an attacker to take control of the server process that is parsing a specially crafted file," an advisory, which advised on a workaround, said. "An attacker could then install programs; view, change, or delete data; or take any other action that the server process has access to do."

Alex Horan, senior product manager at Core Security, a penetration testing software company, called the patches a "hacker's playground" because all but one involves remedying vulnerabilities that could lead to remote code execution. He said the bulletins addressing Windows and Internet Explorer could be the most appealing for attackers.

Meanwhile, Adobe, also on Tuesday, plans to release new versions of Acrobat and Reader to correct a number of critical vulnerabilities.

This article originally appeared at scmagazineus.com

 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, US edition

Microsoft to release patches for IE, Exchange bugs
 
 
 
 
 
Top Stories
Cash-strapped, poor strategy: why IT companies fail
ASIC reveals why firms collapse.
 
Brennan armed with $30m for acquisitions
Follows "record-breaking" September for managed services provider.
 
Channel to fill services void, as Lenovo-IBM x86 deal closes
Lenovo's smaller professional services unit is good news for resellers.
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
What's the best protection against bad debts?



Latest Comments
CRN Magazine

Issue: 331 | September 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.