No Zero-Day Office Flaw Fix on Patch Tuesday

Microsoft plans to deliver eight security bulletins on Patch Tuesday next week. Three of them are rated critical; five are important. The three critical updates address vulnerabilities in Internet Explorer and Microsoft Windows. The important updates address issues in Windows and Office.

What this release wonEUt include is an update for the zero-day vulnerability that impacts Office, Windows and Lync announced earlier this week. Dustin Childs, group manager for the Microsoft Security Response Center, said the company is working to develop a security update and will release it when itEUs ready. That opens the door to the possibility of an out-of-band patch for the flaw, which exists in the way affected components handle TIFF images.

EUIn the meantime, the advisory includes a Fix it that prevents the attacks from succeeding and we recommend customers apply it to help protect their systems,EU Childs said. EUWe also want to provide clarification on the products that the advisory notes are affected. WeEUve seen some confusion due to the shared nature of the GDI+ component, which is where the issue resides. There are three ways you can have the GDI+ component installed on your system: Office, Windows, and Lync.EU

Relief and Frustration

With regard to the TIFF flaw, Childs said Office 2003 and Office 2007 are affected regardless of the installed operating system. Microsoft is currently only aware of targeted attacks against Office 2007 users. Office 2010 is affected only if installed on Windows XP or Windows Server 2003. Office 2010 is not affected when installed on Windows Vista or newer systems. Office 2013 is not affected, regardless of the OS platform.

On the Windows side, supported versions of Vista and Windows Server 2008 ship with the affected component but are not known to be under active attack. Other versions of Windows are not directly impacted. Customers who...

Comments are closed.