October Patch Tuesday brings four critical updates

Stephen Withers
Wednesday, 10 October 2007 04:39

Business IT - Technology

Microsoft's regular patch cycle has delivered six security updates for October, four of them rated critical. But a seventh failed to make the cut.

The critical issues all allow the execution of arbitrary code within maliciously crafted files or in one case a malformed network protocol response.

The Kodak Image Viewer (from Windows 2000, Outlook Express, Windows Mail, Internet Explorer and Word are affected, though the Word issue is deemed critical only for the Office 2000 version. It is only considered important for Office XP and Office 2004 for Mac, while Office 2003 and 2007 are not affected.

Other important issues addressed by this month's updates are a denial of service vulnerability in Windows' remote procedure call (RPC) facility, and a privilege escalation vulnerability in SharePoint Services 3.0 and SharePoint Server 2007 that could allow information disclosure.

One of the Internet Explorer issues and the SharePoint issue had been disclosed publicly prior to Microsoft's announcement.

An additional patch for Windows was expected this month, but "We decided to remove one of the updates from the release schedule due to a quality control issue, so we can resolve that issue prior to releasing the update to customers," said Tami Gallupe, Microsoft Security Response Center release manager.

Microsoft also released a new version of the Malicious Software Removal Tool and an updated junk mail filter for Outlook 2003.

The company re-released an 2005 update for .NET with extended detection for Windows Server 2003 SP2 and Vista, although a separate update released in July already protects those systems against the original vulnerability.

Between September and October's Patch Tuesdays, Microsoft released Service Pack 3 for Office 2003, which combines previously released security patches with a number of stability improvements.