News

January Patch 'Critical' for Windows 2000

• By Jabulani Leffall
• January 12, 2010

Microsoft plans to release its January security patch today, which is expected to include just one fix for Windows systems.

The light release follows heavy patch rollouts seen in the last quarter of 2009. However, in recent years, Microsoft has tended to deliver fewer patches January, with heavier delivery starting in February, according to Jason Miller, data and security team leader at Shavlik Technologies.

The vulnerability to be patched has remote code execution security implications for systems. Microsoft's patch affects every Windows supported operating system -- even Windows 7. However, it's particularly important for Windows 2000 users, when the patch gets a "critical" rating. For other Windows OSes, the patch has a "low" rating, Miller explained in an e-mail.

According to an e-mailed statement from Microsoft spokesperson Jerry Bryant, "Customers with Windows 2000 systems will want to review and deploy this update as soon as possible."

Bryant pointed to Security Advisory 977544 describing a patch for the bug-heavy Windows Server Message Block, which is subject to denial-of-service exploit risks.

"We are still working on an update for the issue at this time," Bryant said in a statement. "We are not aware of any active attacks using the exploit code that was made public for this vulnerability and continue to encourage customers to follow the guidance in the advisory."

Meanwhile, the single patch may require a restart, according to Redmond's advance bulletin.

Microsoft also offers a preview of nonsecurity releases through Windows Update, Microsoft Update Services and Windows Server Update Services. The list is available through this knowledgebase article.

IT pros may also want to consider applying Adobe's security patch for Acrobat and Reader, which is scheduled for release today. It's a fix for a zero-day exploit, according to Miller.

"Unlike most months, what the bulletin administrators should look at first is the Adobe patch when it is released later today," Miller stated. "This bulletin will patch vulnerabilities that are currently in the wild affecting users. With any zero-day exploit, it is important to address the issue as soon as possible."