A Patch Tuesday hole to watch for

Microsoft’s January 2011 security update doesn’t come out for several hours, but some security vendors are already making noise about what they expect to go unfixed.

Specifically, you can expect to hear about Redmond’s lack of action on a vulnerability discovered by researcher Michal Zalewski.

Security researchers have already warned of exploits against this particular flaw, and some — including Imperva senior security strategist Noa Bar Yossef — are suggesting measures to blunt the impact.

Here’s Yossef’s tips, e-mailed to me by Imperva/Page One PR man Clinton Karr:

1. Assessing the exploits as mentioned in the patch. This includes understanding the details of the exploit and whether it is even applicable to the specific user. It is important also to understand how an attack would affect the system.

2. Assessing the process of patching. Sometimes a patch may be contradictory to an already existing code, or even a work-around.

3. Patching the system itself. The patching process should be continuously reviewed. For instance, it already happened that MS released a patch which broke another fix.

Watch this space later for more on the January security update from Microsoft.

–Bill Brenner