Home » Data Protection » Application Security

News

Microsoft, Oracle Patch Security Bugs

Microsoft and Oracle released critical software patches Tuesday

By Robert McMillan, IDG News Service (San Francisco Bureau)

October 15, 2008 — CSO —

It's the mother of all patch days for enterprise IT shops, with both Microsoft and Oracle releasing critical software updates Tuesday.

Microsoft kicked things off Tuesday morning with 11 security updates, including fixes for critical security bugs in Windows Active Directory, Internet Explorer, Excel and the Microsoft Host Integration Server, which integrates Windows computers with IBM mainframes.

Security experts say that the Internet Explorer update, which fixes six bugs in the browser, is the one to watch. That's because it is rated critical for Internet Explorer 6 users running Windows XP - a very common configuration in the enterprise.

But customers who are running Windows Active Directory on older Windows 2000 machines should move the MS08-060 Active Directory update to the top of their patch queue, said Don Leatham, a director of solutions and strategy at Lumension Security. Because an Active Directory server can be used to set permissions on other machines and manage users on the network, taking over this machine "would be the Holy Grail for someone trying to get into a company and totally disrupt it," he said.

Normally, Active Directory servers are blocked at the firewall, which means that an attacker would probably have to be on an internal network to mount an attack, said Eric Schultze, chief technology officer with Shavlik Technologies. But the bug "means any internal, disgruntled user can take complete control over Windows 2000 domains and domain controllers," he said via instant message.

Mitigating this concern, however, is the fact that Microsoft has not had any reports that this vulnerability has been exploited in an attack. While it's likely that an attacker could crash the Windows 2000 machine by exploiting this bug, "creating functioning exploit code to leverage remote code execution is difficult," Microsoft said in a note on its Web site.

In total, 20 security bugs were fixed in Microsoft's 11 updates. There were also six less-critical updates, rated "important," by Microsoft, for various Windows components, and a "moderate" patch that fixes a bug that could let an attacker snoop information from an Office user.

Oracle's security updates, expected at 1 p.m. Pacific time, will include fixes for 36 bugs in a range of Oracle products, including the company's flagship Database, its Application Server, E-Business Suite, and WebLogic server and development tools. Bug-fixes are also planned for the company's JD Edwards and PeopleSoft products.

It's unusual for both Microsoft and Oracle to be pushing out patches on the same day. Microsoft's security updates come out on the second Tuesday of every month, known as Patch Tuesday in the industry. But Oracle's patches are a quarterly affair, delivered on the Tuesday nearest the middle of the month. Typically, that puts the Oracle patches on the third Tuesday of the month, but this month, the Microsoft and Oracle release dates converged.