News

January Patch 'Critical' for Windows 2000

Microsoft plans to release its January security patch today, which is expected to include just one fix for Windows systems.

The light release follows heavy patch rollouts seen in the last quarter of 2009. However, in recent years, Microsoft has tended to deliver fewer patches January, with heavier delivery starting in February, according to Jason Miller, data and security team leader at Shavlik Technologies.

The vulnerability to be patched has remote code execution security implications for systems. Microsoft's patch affects every Windows supported operating system -- even Windows 7. However, it's particularly important for Windows 2000 users, when the patch gets a "critical" rating. For other Windows OSes, the patch has a "low" rating, Miller explained in an e-mail.

According to an e-mailed statement from Microsoft spokesperson Jerry Bryant, "Customers with Windows 2000 systems will want to review and deploy this update as soon as possible."

Bryant pointed to Security Advisory 977544 describing a patch for the bug-heavy Windows Server Message Block, which is subject to denial-of-service exploit risks.

"We are still working on an update for the issue at this time," Bryant said in a statement. "We are not aware of any active attacks using the exploit code that was made public for this vulnerability and continue to encourage customers to follow the guidance in the advisory."

Meanwhile, the single patch may require a restart, according to Redmond's advance bulletin.

Microsoft also offers a preview of nonsecurity releases through Windows Update, Microsoft Update Services and Windows Server Update Services. The list is available through this knowledgebase article.

IT pros may also want to consider applying Adobe's security patch for Acrobat and Reader, which is scheduled for release today. It's a fix for a zero-day exploit, according to Miller.

"Unlike most months, what the bulletin administrators should look at first is the Adobe patch when it is released later today," Miller stated. "This bulletin will patch vulnerabilities that are currently in the wild affecting users. With any zero-day exploit, it is important to address the issue as soon as possible."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Touting Azure for Operators, Microsoft Joins SDN Standards Group

    As part of its Azure for Operators program, Microsoft this week joined a nonprofit standards association that focuses on SDN technologies used by enterprises and service providers.

  • 2020 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss. (Now updated with COVID-19-related event changes.)

  • Pilot Begins of Microsoft Teams-Salesforce CRM Integration

    A new capability that lets Microsoft Teams users access information from the Salesforce.com customer relationship management (CRM) platform debuted this week.

  • The 2020 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generations of .NET and PowerShell, here's what's on tap from Microsoft this year.