Microsoft readies five fixes for September security update

Microsoft plans to distribute five patches -- all labeled "critical" -- in next Tuesday's monthly security update.

All the bulletins will address flaws in Windows, according to an advance notification released this week. Four of the patches impact all supported versions of the operating system, while one does not involve Server 2008 or Vista. Few other details emerged in the notification.
 
There remains one known, unpatched Microsoft vulnerability: an FTP server bug, present in older versions of Internet Information Systems, that was disclosed this week on the exploit repository Milw0rm. Microsoft has acknowledged the flaw.

However, a patch for the vulnerability is not expected to arrive Tuesday, Jerry Bryant, a Microsoft security program manager, said on a company blog. He said engineers are "working hard" on a fix and, in the meantime, recommended that users review an earlier advisory, which contains workaround options.

Andrew Storms, director of security operations at vulnerability management firm nCircle, told SCMagazineUS.com that he instead expects the update Tuesday to patch "something deeply rooted in the operating system", such as an issue with the Graphics Device Interface (GDI) or Active Template Library (ATL).

Even though it is likely none of the patches will remediate previously known problems, administrators still should take them seriously.

"The likelihood of exploits coming out post-Tuesday are generally pretty fast anyway," Storms said. "That time from release to exploit has increasingly gotten shorter over the years."

See original article on scmagazineus.com