Microsoft Issues First Security Patch Of 2010

Microsoft is kicking off the new year with a single Windows security bulletin.

The first Patch Tuesday release of 2010 will contain a fix rated “critical” for Windows 2000 users and low for others. According to Microsoft’s pre-Patch Tuesday notification, the bulletin addresses a remote code execution vulnerability, and the exploitability index – the rating system that predicts the likelihood of a successful exploit – is not high.

The single bulletin means that a fix for the SMB (Server Message Block) protocol vulnerability the company warned users about in November is not on the menu to be fixed by 12 January. According to Microsoft Security Program Manager Jerry Bryant, the company is still working on the issue.

“We are not aware of any active attacks using the exploit code that was made public for this vulnerability and continue to encourage customers to follow the guidance in the advisory which outlines best practices to help protect systems against attacks that originate outside of the enterprise perimeter,” Bryant wrote on the Microsoft Security Response Center blog.

Microsoft is also not releasing a patch for the IIS (Internet Information Services) problem reported in late December. According to Microsoft, the issue is not an actual vulnerability in IIS 6.0, but an inconsistency in how it handles semicolons that can only be exploited if IIS is configured in a vulnerable setting.

This month’s Patch Tuesday release is slated to be available at 1 pm EST, 12 January.