Microsoft to release patches for IE, Exchange bugs

By Dan Kaplan on Aug 10, 2012 8:05 AM
Filed under Security

Nine for 10.

Microsoft is planning to release nine security patches next Tuesday to repair 10 vulnerabilities across its product line.

Five of the fixes are graded "critical," the software giant's highest severity rating, and address bugs in Windows, Internet Explorer, Exchange, SQL Server, Server Software, and Developer Tools. The remaining four are deemed "important" and rectify weaknesses in Windows and Office.

One of the critical holes being plugged is an Exchange vulnerability that Microsoft disclosed July 24. The flaw involves third-party code in Oracle Outside In, a set of libraries that software developers use to decode hundreds of file formats. Specifically, the vulnerability involves the way in which Oracle Outside In processes Exchange files.

"In the most severe case of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010, it is possible under certain conditions for the vulnerabilities to allow an attacker to take control of the server process that is parsing a specially crafted file," an advisory, which advised on a workaround, said. "An attacker could then install programs; view, change, or delete data; or take any other action that the server process has access to do."

Alex Horan, senior product manager at Core Security, a penetration testing software company, called the patches a "hacker's playground" because all but one involves remedying vulnerabilities that could lead to remote code execution. He said the bulletins addressing Windows and Internet Explorer could be the most appealing for attackers.

Meanwhile, Adobe, also on Tuesday, plans to release new versions of Acrobat and Reader to correct a number of critical vulnerabilities.

This article originally appeared at scmagazineus.com

 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, US edition

Microsoft to release patches for IE, Exchange bugs
 
 
 
 
 
Top Stories
Datacom takes heathy bite of Canberra software firm
Signals hospital push with SmartWard purchase.
 
Lack of 'coke and hookers in the cloud' is good for channel
[Blog post] If the vendor isn't showing love, partners can pick up the slack.
 
Small reseller called in to fix mess Telstra left behind
Acurus rescues client that used to be telco's promotional case study.
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
My business strategy is to:

Latest Comments
CRN Magazine

Issue: 330 | August 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.