Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Microsoft will next Tuesday release nine security patches to squash 10 vulnerabilities of which all but one allow for remote code execution.
Five of the fixes are graded critical, the software giant's highest severity rating, and address bugs in Windows, Internet Explorer, Exchange, SQL Server, Server Software, and Developer Tools, according to a pre-release notification.
The remaining four are deemed important and rectify weaknesses in Windows and Office.
One of the critical holes being plugged is an Exchange vulnerability that Microsoft disclosed 24 July.
That flaw involved third-party code in Oracle Outside In, a set of libraries that software developers use to decode hundreds of file formats. Specifically, the vulnerability involves the way in which Oracle Outside In processes Exchange files.
"In the most severe case of Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010, it is possible under certain conditions for the vulnerabilities to allow an attacker to take control of the server process that is parsing a specially crafted file," the advisory, which advised on a workaround, said.
"An attacker could then install programs; view, change, or delete data; or take any other action that the server process has access to do."
Core Security senior product manager Alex Horan said the patches were a "hacker's playground".
He said the bulletins addressing Windows and Internet Explorer could be the most appealing for attackers.
Also on Tuesday, Adobe will release new versions of Acrobat and Reader to correct a number of critical vulnerabilities.
This article originally appeared at scmagazineus.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.