Microsoft's gentle start to 2011 patching

Stephen Withers
Wednesday, 12 January 2011 10:00

Business IT - Security

The first Patch Tuesday for 2011 has proved a quiet affair with just two bulletins from Microsoft, only one of which is rated critical.

As foreshadowed, Microsoft released two security bulletins this month. That's a big drop from the 17 that arrived in December 2010.

The first addresses a publicly disclosed vulnerability in Windows Backup Manager in Vista that is rated as important. Other currently supported operating systems are not affected.

The issue is a specific case of a more general problem raised last August concerning the way applications load external libraries. An insufficiently qualified file path can allow remote code execution.

The second concerns two privately reported vulnerabilities in Microsoft Data Access Components, which is part of all currently supported version of Windows. The issues allow remote code execution and can be exploited with maliciously crafted web pages.

They are considered critical on XP, Vista and Windows 7, and important on Server 2003 and Server 2008 (including Server Core installations).

Microsoft officials are unaware of any proof of concept code or active attacks using these vulnerabilities.

There might be only two security bulletins, but there are more updates and more security-related news from Microsoft - see page 2.