Microsoft releases 10 patches for October

Microsoft has published 10 updates (MS06-56 to MS06-65) for its products during its monthly update cycle. Microsoft had initially said that there will be 11 updates in this cycle in an earlier bulletin released on 5 October 2006. Six updates have received the highest severity rating of Critical and primarily affect the Office suite (4 updates out of 6 are for Office). One update has received severity rating Important and it affects Windows OS. Two updates are rated as moderate and they affect the ASP.NET and Windows Object packager products. Finally one patch has been rated as low and it addresses a Vulnerability in TCP/IP that could allow Denial of Service.

The following table lists down the vulnerability details and I give my recommendation on the same

Legend:

RCE - Remote Code Execution

DoS - Denial of Service

ID - Information Disclosure

The updates are listed down according to their severity. What do my recommendations mean to you?

Apply immediately means you should schedule an emergency change and apply the update immediately.

Apply ASAP means you should schedule a change and downtime as soon as business allows and apply the update

Apply as scheduled means that you can apply this update during your regular update cycle if you have any.

If you notice the pattern of my recommendation, anything that affects Windows and involves RCE or DoS earns an Apply ASAP recommendation from me. Regardless of what Microsoft says, any person with malicious intent will not see the rating, but just look at the opportunity to cause damage and according to me any vulnerability that can cause RCE is an opportunity.

Also notice the language used in the summaries. Some of the update resolves "several" vulnerabilities as opposed to a single update resolving a single vulnerability. Additional information about the number of vulnerabilities fixed is not available at this time from Microsoft. But I will update as soon as I get any more information.