Microsoft To Patch 40 Vulnerabilities Tuesday

Security update will close the last known Stuxnet vulnerability, but wont address a zero-day bug reported Thursday in Internet Explorer.

Slideshow: Microsoft Internet Explorer 9 Beta Revealed

(click image for larger view and for full slideshow)
On Thursday, Microsoft announced that this Patch Tuesday it will release fixes for 40 separate flaws in Microsoft Windows, Office, Internet Explorer (IE), SharePoint, and Exchange. All told, there will be 17 individual security bulletins, with two rating as critical.
One of the forthcoming patches will close the last remaining vulnerability being exploited by
Stuxnet
. According to a
blog post
by Mike Reavey, director of Microsoft Security Response Center, this is a local elevation of privilege vulnerability and weve seen no evidence of its use in active exploits aside from the Stuxnet malware.
Microsoft is also patching a
bug in IE
thats currently being exploited by attackers, though Reavey rates the number of related exploits as being pretty low, and notes that customers running Internet Explorer 8 remained protected by default due to the extra protection provided by Data Execution Prevention (DEP).
Expect enterprises to punt many of these patches until 2011. The high number of advisories will present a challenge to all Windows system administrators, especially with the holidays shortening the available working hours, said
Wolfgang Kandek
, CTO of Qualys.
Decembers Patch Tuesday brings the total number of security bulletins Microsoft released in 2010 to 106 -- the highest number yet. This isnt really surprising when you think about product lifecycles and the nature of vulnerability research, said Reavey, highlighting both the fact that Microsoft supports products for 10 years, as well as ongoing improvements in vulnerability research, meaning that researchers are finding more bugs. On that note, he said that 80% of Microsoft product vulnerabilities are reported to us cooperatively, meaning that Microsoft has a heads-up before knowledge of the bug goes public.
One new bug, however, wont make the count. On Thursday, IT security research firm Vupen disclosed a new, zero-day vulnerability in Internet Explorer 6, 7, and 8. Vupen rates the vulnerability as critical, because attackers could use it to comprise a system. According to its
security advisory
, the issue stems from a use-after-free error within the mshtml.dll library when processing a web page referencing a CSS (cascading style sheets) file that includes various @import rules, which could allow remote attackers to execute arbitrary code via a specially crafted Web page.
The bug will not be addressed by the forthcoming Patch Tuesday.

Last News
▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security	▸ Making use of a homemade Android army ◂ Discovered: 23/12/2024 Category: security	▸ CryptoWall is more widespread but less lucrative than CryptoLocker. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft To Patch 40 Vulnerabilities Tuesday