Microsoft and Adobe to release critical patches today

Microsoft is to release six patches for 11 vulnerabilities as portion of its April security update, scheduled for today.

Four of the six fixes on its monthly Patch Tuesday would be rated as ‘critical' and address flaws in Windows, Internet Explorer (including version 9), Office, SQL Server and server software and developer tools.

Three of critical patches plug holes for Windows 7. The rest two patches, deemed ‘important', fix holes within the Forefront United Access Gateway product and Office.

Andrew Storms, director of security operations at nCircle, said: “So far this year, Microsoft was issuing a reasonably stable variety of Patch Tuesday bulletins each month. We saw seven bulletins in January, nine in February and 6 in both March and April. Here's rather a lot different than their historical pattern of dramatic swings in bulletin volume from month to month.

"Next week we'll be getting our standard Internet Explorer patch. It's questionable whether we'll get a patch for the Pwn2Own bug we heard rather a lot about in early March on this update. Historically, Microsoft's development cycle is ready 30 days for a typical IE patch, so it kind of feels unlikely we'll get a patch for this bug next week.

“Bulletin number four has the capability to cause IT security teams some serious headaches since it covers Office, SQL Server, Biztalk, Commerce Server, Visual FoxPro and visible Basic. Any time a bulletin covers this sort of wide selection of goods, IT security teams need to pause and think hard about deployment. It also requires some rigorous patch-testing.”

Wolfgang Kandek, CTO at Qualys, said bulletin no 1 stands out as the highest priority because it is for a critical vulnerability affecting all versions of Internet Explorer (6,7,8 and 9) on their respective platforms, XP, 2003, Win7 and 2008, both 32- and 64-bit.

“Bulletin two is the second one most important and updates the Windows operating system, again encompassing all versions, both 64- and 32-bit. Bulletin three is a critical update to the .NET framework. Bulletin four shall be challenging because it addresses a wide range of applications including server-side software. It's critical and applies to all versions of Microsoft Office, but in addition to SQL Server and other Microsoft server products,” he said.

Last week, Adobe announced plans to mend security flaws in its Reader and Acrobat software. Its scheduled quarterly update is likewise as a result of arrive today.