No patch for Excel zero-day flaw next week

Microsoft Corp. Thursday said it will deliver three security updates on Tuesday, one of them marked “critical,” but will not fix an Excel flaw that attackers are now exploiting.

All three updates spelled out in today’s notice will tackle vulnerabilities in Windows, but as is its practice, Microsoft did not drill any deeper than to specify which versions will be affected.

How to cut down MS bugs

Slash Microsoft bugs by 92 %

“It’s pretty nebulous,” said Andrew Storms, director of security operations at nCircle Network Security Inc. “They could be any number of a billion of things.”

The critical update will affect all still-supported editions of the operating system, starting with Windows 2000 and running through XP, Server 2003, Vista and Server 2008. By Microsoft’s definition, “critical” means that unpatched PCs can be hijacked without any action by the user.

Both remaining updates were labeled “important,” Microsoft’s second-highest ranking in its four-step system, and were also described as “spoofing” bugs, a term that typically indicates they could be used trick users into divulging confidential information.

One of the spoofing patches will update all supported versions of Windows, while the second targets only Server 2000, Server 2003 and Server 2008 systems.

“It doesn’t look like we’re going to see patches for any open Microsoft security advisories,” said Storms, pointing to three that have not yet been closed. Those include two advisories issued last year — one from April 2008, another from December — and the alert published just last week about a vulnerability in Excel that attackers are already exploiting .

Last week, Microsoft downplayed that threat, saying that the company’s security experts had seen only a small number of attacks. According to researchers at Symantec Corp., the vulnerability is a file format bug in all supported versions, including the latest, Excel 2007 on Windows and Excel 2008 for the Mac.

“I’m not really surprised that the Excel vulnerability won’t be patched, what with the timeline,” said Storms, “but the others have been open for a long time.”

Today’s notice also warned users that all three updates will require rebooting. “Let’s just call it Reboot Tuesday,” Storms quipped.

Microsoft will release March’s three updates at approximately 1 p.m. ET Tuesda

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now