Microsoft plans patch for critical flaw in Word next Tuesday

Following an unusually light Patch Tuesday in September, MicrosoftMicrosoft was forced to deal with the specter of a zero-day exploit being used in the wild to attack Internet Explorer. Microsoft responded with an out-of-band patch reflecting the urgent nature of the threat. Alles zu Microsoft auf CIO.de

IT admins will be a little busier in October. According to the Microsoft SecuritySecurity Bulletin Advance Notification for October 2012, Microsoft has a total of seven new security bulletins slated for release next week. Six of the seven are rates merely as Important, while the seventh--a patch for a flaw affecting all supported versions of Microsoft Word--is rated as Critical for Word 2010. Alles zu Security auf CIO.de

Andrew Storms, director of security operations for nCircle, stresses the urgency of the patch for Microsoft Word. "The bulletin that looks most serious is a rare Microsoft Word update tagged as critical for the brand new Word 2010, but downgraded to important in Word 2003. I can't remember the last time we saw a critical bug that affected all versions of Word. It makes me remember the bad old days when Word was a nearly constant source of security problems for businesses."

Marcus Carey, a security researcher with Rapid7, points out that the vulnerability can be triggered by opening--or even previewing--a malicious file. "This vulnerability could result in the complete compromise of a system if exploited. Since this is an Office vulnerability this may affect both Windows and Macintosh users."

Some bulletins, like Bulletin 7, indicate a potentially alarming fact. The bulletin impacts versions of SQL Server going back to 2000, and indicates a flaw in code that has been reused for more than a decade. According to Alex Horan, a senior product manager with CORE Security, "When you look at the number of versions that are affected you quickly come to the determination that these vulnerabilities have existed for quite a long period of time and have potentially been abused without user knowledge throughout several generations of the software