IT Jobs
Microsoft set to release Excel patch
Oracle joins in the fun
By Robert McMillan, IDG News Service
Published: 09:11 GMT, 10 April 09
IT departments are set for a hefty patching session next week as both Microsoft and Oracle are due to release security updates on the same day. Among Microsoft's patches will be a fix for an Excel bug that has been exploited by cybercriminals.
Windows users should expect a lot of patches: Microsoft plans to release eight updates in total: Five of them are for Windows, with a single update each for Internet Explorer, Excel and Microsoft's Internet Security and Acceleration (ISA) server.
Oracle said that next week's patches will contain 43 security fixes, including 16 patches for the company's flagship database software. There will also be 12 vulnerabilities patched in the Oracle Application Server, as well as a handful of fixes for the company's E-Business Suite, PeopleSoft and JD Edwards Suite, and for the BEA application server suite.
The Excel update is noteworthy because Microsoft's spreadsheet software has recently been leveraged in a small number of targeted attacks. By tricking users into opening a specially crafted Excel file, criminals can install their malicious software on a victim's machine, Microsoft said. The software vendor has not said for certain whether it will patch this particular Excel flaw next week, but it seems likely.
Microsoft has also warned of a similar flaw in its PowerPoint software, which is also being used in attacks, but no PowerPoint updates are currently scheduled.
"We were hoping to see an update to handle the PowerPoint .pps exploit seeing as this is the hottest Office issue running wild, but from what we can tell at this point, the issue won't be addressed this month," security vendor Lumension said in a statement.
Microsoft rates the IE and Excel fixes as critical, along with three of the Windows updates, meaning a hacker could take advantage of the flaws they patch to run unauthorised software on a PC. The ISA patch is rated important; an attacker could use this bug to crash a system. And the other two Windows flaws could be used to elevate privileges to gain access to unauthorized resources on the PC, Microsoft said.
One of the critical Windows updates is for the DirectX multimedia software, Microsoft said. Another Windows update, rated important, is for the Microsoft Distributed Transaction Coordinator (MSDTC), software that is used by programs such as databases to connect with other parts of the operating system.
The ISA bug is also important, because it could be used by attackers to disable software that is supposed to be protecting corporate networks from online attacks.
Add your commentComments