Microsoft to release single patch for January update

Microsoft is prepping a single fix for its monthly security update on Tuesday.

The lone patch is graded "critical" for Windows 2000 platforms and as "low" for all other operating system versions, said Jerry Bryant, a security program manager at Microsoft, in a blog post. He added that the vulnerability's exploitability risk, to be announced in Tuesday's bulletin, also is expected to be minimal.

The singular fix coming means that for the second consecutive month, Microsoft is not releasing a patch for a zero-day bug in the Server Message Block (SMB) protocol. The company has said that successful exploitation of the flaw, which affects Windows 7 and Server 2008 Release 2, can lead to a denial-of-service that results in a system crash — but not the injection of malicious code. Exploit code has been published, but Microsoft says it is not aware of any in-the-wild attacks.

In November, it published an advisory for the issue, which suggested workarounds.

"We are not aware of any active attacks using the exploit code that was made public for this vulnerability and continue to encourage customers to follow the guidance in the advisory which outlines best practices to help protect systems against attacks that originate outside of the enterprise perimeter," Bryant said in the blog post.

See original article on scmagazineus.com