Microsoft plans two patches, no SharePoint fix

Microsoft is prepping two patches for next week's monthly security update, according to an advance notification, but there are no plans to release a fix for a dangerous SharePoint flaw that was disclosed last week.

The patches fix one vulnerability each. One of the flaws resides in Windows, the other in Office. Users running Windows 7 and 2008 R2 are not impacted by either of the bugs, Jerry Bryant, group manager of response communications at Microsoft, said in a blog post.

Not scheduled for a fix is the vulnerability in Microsoft's business collaborative platform, SharePoint, which could allow hackers to elevate privileges and steal sensitive data. The flaw was disclosed to Microsoft in early April by Swiss security firm High-Tech Bridge. On April 29, High-Tech Bridge, whose policy is to go public with bug details two weeks after notifying the vendor, issued an advisory, which included a link to a proof-of-concept code that exploits the vulnerability.

Microsoft has said it is not aware of any in-the-wild attacks targeting the vulnerability. It has released its own advisory, offering suggested workarounds, such as restricting access to the SharePoint help.aspx XML files.

"Our teams are still working on an update for that issue," Bryant said. "In the meantime, we recommend customers review the advisory and apply the workarounds."

See original article on scmagazineus.com