Microsoft Readies Small Patch Tuesday Update

IT administrators will be spared a hefty download this month as Microsoft readies only two security bulletins in May’s Patch Tuesday. Redmond released 17 bulletins in April.

Both scheduled bulletins in May’s Patch Tuesday release will address security vulnerabilities in Windows and the Office suite, Microsoft said in its advance notice on 5 May. One bulletin is categorised as “critical” and the other is “important.”

In contrast, there were nine “critical” bulletins in April.

Heavy Then Light

Microsoft tends to follow months with heavy update loads with light releases, according to Jason Miller, a data team manager with Shavlik Technologies.

Despite the small release, system administrators should prioritise the updates. “Both bulletins are for remote code-execution vulnerabilities, so IT administrators should track them closely and address them quickly,” said Wolfgang Kandek, CTO at vulnerability scanning services firm Qualys.

The “critical” bulletin will affect all supported versions of Windows Server, including 2003, 2008 and 2008 R2. The update applies to both Windows Server 2008 and 2008 R2 regardless of whether or not the operating system was installed with the Server Core option, the company said. The security hole exposes the server to a remote code execution attack.

The desktop versions, Windows XP, Vista and 7 will not need the update. Microsoft did not disclose at this time any details regarding the security flaw being fixed.

The “important” bulletin addresses a security flaw that, if left unpatched, would allow attackers to remotely execute arbitrary code on the system. The vulnerability affects Microsoft Office XP and 2003 on Windows and Office 2004 and 2008 for Mac OS X. PowerPoint XP, 2003 and 2007 will be patched as well as core Office files and the Office Compatibility Pack.

The latest version, Office 2010, is not affected by the flaw, according to Microsoft.

Threat Prioritising

Microsoft separately announced it will be modifying its Exploitability Index, a rating system that indicate the likelihood of a security flaw being used in an attack within the next 30 days, Maarten Van Horenbeeck, senior security program manager, wrote on TechNet. Starting with next week’s Patch Tuesday release, the company will provide two index ratings for each bug, one for new platforms and another for older versions, Van Horenbeeck said.

Customers will be able to prioritise the security updates that match the systems they own. With two ratings, administrators managing newer machines can take into consideration new security features built-in to Windows 7 SP1 and Office 2010 when prioritising bulletins,

Windows 7 has several new security technologies such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) baked into the operating system to help prevent vulnerabilities from being exploited.

These measures are not available by default on Windows XP. A security flaw could exist in both version of the operating system, but having ASLR enabled may make it less critical on Windows 7 than on Windows XP, Van Horenbeeck said. Having two ratings would help system administrators assess risk more accurately.

Microsoft will also be calculating a “Denial of Service” risk score. A remote code execution vulnerability that is difficult to exploit can still crash a computer, Van Horenbeeck wrote. A denial of service may be “permanent,” in which case the program or operating system exits unexpectedly and requires a restart, or “temporary,” in which case the program or operating merely becomes unresponsive during the course of the attack.

“For administrators of internet-facing services, this can often be the difference between a highly important, and insignificant vulnerability,” Van Horenbeeck wrote.

Heavy Downloads

April was a tough month for system administrators trying to stay ahead of the patches.

Along with last month’s massive update, they also had to consider Adobe’s out-of-band updates to fix zero-day vulnerabilities in Flash, Acrobat and Reader. Systems administrators also had to be aware of Apple’s updates for Safari and iTunes, as well as Oracle’s quarterly Critical Patch Update release.

“Take advantage of this lighter Patch Tuesday to catch up with the massive patch day last month and all of the other 3rd party security releases since then,” Miller said.

The patches are expected to be released on Tuesday 10 May.