Microsoft to squash 23 bugs next month

Microsoft expects to release eight patches to address 23 security vulnerabilities in Windows and other products next month.

The bulletins, of which two are rated “critical” and six  “important,” are due 11 October.

The critical patches will address flaws in Microsoft Windows, Internet Explorer, Silverlight, and the company's .NET framework that could allow for the propagation of an internet worm without user action, according to an advance notification advisory.

The important fixes will correct issues that could result in users' data being compromised or cause a denial of service.

One of the important bulletins is particularly interesting because it affects ­Forefront Unified Access Gateway, security software used by employees for remote access, Rapid7 security researcher Marcus Carey said.

“No one wants to hear that software that is designed for security is vulnerable to remote code execution,” Carey said.

“This bulletin and the related vulnerabilities will definitely pique a lot of attackers' interest. Organisations should keep an eye out for suspicious activity on servers running this software.”

Nearly all of the patches, meanwhile, will require a restart, which will cause widespread disruptions across both internet-connected servers and user community desktops, according to Paul Henry, security and forensic analyst at vulnerability management firm Lumension.

Microsoft last month released five security bulletins correcting six vulnerabilities in SharePoint, Excel, Office, Windows and the Windows Internet Name Service.

This article originally appeared at scmagazineus.com