Quiet month for Microsoft updates

Stephen Withers
Friday, 08 January 2010 03:00

Business IT - Security

January is shaping up to be a relatively quiet month for Microsoft security updates. Just one bulletin is on the agenda, compared with six each for the November and December Patch Tuesdays.

System administrators that are still nursing post New Year hangovers or who have yet to return from their summer holiday will be pleased to hear that Microsoft is only planning to release on update on January's Patch Tuesday.

Furthermore, the underlying vulnerability is regarded as having a low impact on all versions of Windows except Windows 2000, where it is critical.

So there's the good news.

The bad news is that Microsoft is still working on a fix for the zero-day SMB vulnerability publicly disclosed in November 2009. Fortunately, the exploit results in a denial of service condition rather than access to the targeted system.

Only Windows 7 and Windows Server 2008 R2 (including Server Core installations) are affected.

Products from companies such as Check Point provide protection against this exploit by blocking the malformed SMB packets.