Microsoft's Patch Day Targets Four Vulnerabilities May Patch Tuesday on the Way with Three Critical Security Fixes Andy Patrizio
Microsoft plans to issue four security vulnerabilities next Tuesday, May 13 — three rated critical and one of moderate threat level. This is the first patch since the release of Windows XP Service Pack 3 but there will not be any fixes related to the Service Pack, despite some hiccups reported by users.
The critical flaws affect Microsoft Office, Microsoft Word, and Microsoft Windows respectively. The most severe and widest impact appears to be in Windows, specifically, in the Jet 4.0 Database Engine.
The Security Advisory reports that Microsoft was "investigating new public reports of very limited, targeted attacks using a vulnerability in the Microsoft Jet Database Engine that can be exploited through Microsoft Word."
A number of applications use the Jet Database Engine, including Microsoft Access, Microsoft Visual Basic, and Internet Information Services (IIS) applications. Security firm Lumension is advising making the fix to Jet a priority.
Jet exploit could have widest impact
"The Jet bulletin is the critical patch that will have the widest impact because it affects Windows XP, Windows 2000 and Windows Server 2003," wrote Don Leatham, director of solutions and strategy, in a press statement. "When prioritizing this month's patches, this will probably get the most attention because of the number of organizations running these systems and programs."
The moderate vulnerability affects quite a few Microsoft products, most of them security products, like Windows Live OneCare, Antigen, Defender, and Forefront Security. The vulnerability could allow malicious code to use these applications to, in this case, launch a denial of service (DoS) (define) attack.
"Whenever security tools themselves are affected (even if they have been given 'moderate' status) we encourage customers to treat them with increased importance. Any company that relies on these programs as part of their overall security posture should pay close attention to this update," wrote Leatham.
Microsoft will issue its fixes on Tuesday. As is always the case with its pre-release alert, the number of fixes are subject to change, and there may be more or fewer fixes on May 13.
