Microsoft to release patches for IE, Exchange bugs

By Dan Kaplan on Aug 10, 2012 8:05 AM
Filed under Security

Nine for 10.

Microsoft is planning to release nine security patches next Tuesday to repair 10 vulnerabilities across its product line.

Five of the fixes are graded "critical," the software giant's highest severity rating, and address bugs in Windows, Internet Explorer, Exchange, SQL Server, Server Software, and Developer Tools. The remaining four are deemed "important" and rectify weaknesses in Windows and Office.

One of the critical holes being plugged is an Exchange vulnerability that Microsoft disclosed July 24. The flaw involves third-party code in Oracle Outside In, a set of libraries that software developers use to decode hundreds of file formats. Specifically, the vulnerability involves the way in which Oracle Outside In processes Exchange files.

"In the most severe case of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010, it is possible under certain conditions for the vulnerabilities to allow an attacker to take control of the server process that is parsing a specially crafted file," an advisory, which advised on a workaround, said. "An attacker could then install programs; view, change, or delete data; or take any other action that the server process has access to do."

Alex Horan, senior product manager at Core Security, a penetration testing software company, called the patches a "hacker's playground" because all but one involves remedying vulnerabilities that could lead to remote code execution. He said the bulletins addressing Windows and Internet Explorer could be the most appealing for attackers.

Meanwhile, Adobe, also on Tuesday, plans to release new versions of Acrobat and Reader to correct a number of critical vulnerabilities.

This article originally appeared at scmagazineus.com

 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, US edition

Microsoft to release patches for IE, Exchange bugs
 
 
 
 
 
Top Stories
Data#3's John Grant to step down
Channel leader names successor.
 
10 things we learned this week
Cloud is closer to God than on-prem.
 
Photos: Naval-gazing at Avnet's pirate party
Who dressed up for the distie's end-of-year bash on Sydney Harbour?
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
What would help your business most?


Latest Comments
CRN Magazine

Issue: 333 | November 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.