Patch Tuesday Release Will Tie Microsoft's Record

Microsoft will tie its Patch Tuesday record with 13 bulletins, five of them rated critical. An analyst said bulletin six will require rebooting servers, desktops and laptops. The vulnerabilities affect Windows Server 2003, Windows Server 2008, and Windows 2008 R2, Windows XP and Windows Vista. Older versions of Office will also be patched.


After a light start to the year, Microsoft Relevant Products/Services is getting ready to dump a heavy load on the shoulders of IT Relevant Products/Services administrators. On Patch Tuesday next week, Microsoft will release 13 patches.

Five of the bulletins carry the maximum security rating of critical. Seven are rated important and one is rated moderate. The bulletins address 26 vulnerabilities.

With 13 bulletins, Microsoft has tied its record for the most security updates released in a single month. The last time Microsoft issued 13 bulletins was October 2009. This month's record release comes on top of a Jan. 21 out-of-band patch to fix a zero-day exploit in Internet Explorer used in cyberattacks against Google and other U.S. companies doing business in China.

The Most Disruptive Bulletins

"Bulletin six appears to be the most disruptive, as it is critical across all Microsoft platforms -- both server Relevant Products/Services and desktops and laptops," said Don Leatham, senior director of solutions and strategy at Lumension. "Microsoft indicates that a reboot is required, so this patch could impact the availability of key servers and impact the productivity of information workers."

Leatham warns that IT teams managing servers will need to be on high alert this month and have proactive patching plans in place before Tuesday. That's because administrators are facing critical patches for the three most common server platforms in Microsoft environments.

Specifically, the patches cover three critical vulnerabilities in Windows Relevant Products/Services Server 2003, two critical vulnerabilities in Windows Server 2008, and two critical vulnerabilities in Windows Server 2008 R2. What's more, Leatham added, IT teams managing work stations might have the heaviest load of all with four critical vulnerabilities for Windows XP and two critical vulnerabilities for Windows Vista.

"The bit of good news in the February patch update is that the Microsoft Office suite doesn't have any critical patches coming out, but overall, IT departments are facing the need to deploy a large number of patches to all Microsoft computers in the organization with many forced-reboot situations," Leatham said. "Therefore, it will be imperative to plan ahead this month on how these patches should be deployed throughout their enterprises to minimize the possibility of widespread disruption."

Microsoft Suggests Windows Upgrades

Jerry Bryant, a senior security communications Relevant Products/Services manager for Microsoft, recommends customers test and deploy all security updates as soon as possible, giving priority to the critical patches.

"The Office-related bulletins are both rated important and would require user action to be exploited -- usually in the form of convincing a user to open a specially crafted file," Bryant explained. "The vulnerabilities only affect older versions of Office, so customers on Office 2007 or Office 2008 for Mac will not have actions this month. We encourage customers to upgrade to the latest versions of both Windows and Office. As this bulletin release shows, the latest versions are less impacted overall due to the improved security protections built into these products."

Microsoft also announced that several Windows versions are reaching the end of their product life cycle. Bryant said customers using these versions should consider upgrading before support for the products ends, because Microsoft will no longer provide security updates.

Specifically, Windows XP Service Pack 2 will no longer be supported as of July 13. Bryant recommends upgrading to Service Pack 3 or to Windows 7 as soon as possible. Windows Vista RTM will no longer be supported as of April 13. Service Pack 1 will still be supported until July 12, 2011, but Bryant recommends customers update to Service Pack 2 or Windows 7 now. Finally, extended support for Windows 2000 will also be retired on July 13. At that time, Microsoft will no longer provide security or any other updates for Windows 2000.

Connect to my Mix blog

Connect to my 300MB HD movies blog

ADVERTISING »

Download Fast

« ADVERTISING