Microsoft preps quiet patch Tuesday

Microsoft is readying only four "important" patches for next Tuesday round of security patches for July, which is one level below its most serious "critical" vulnerability rating.

Despite the fact the software only gave the four patches its second highest security rating, it hinted in its pre-patch notice posted to its website late yesterday that one of them would address a flaw that could allow hackers to remotely execute malicious code on a vulnerable PC.

Of the two Windows operating system (OS) patches it will issue, Microsoft indicated one will affect Windows 2000 and Windows XP, including the recently released XP Service Pack 3 (SP3), but not Windows Vista. The second will focus exclusively on Vista and its first service pack (SP1).

The other two patches affect Microsoft SQL Server and Exchange Server and are described as plugging "elevation of privilege" flaws, which could allow a hacker to obtain authorisation to access sensitive data on a victim's PC.

These last two patches apply to Windows Server 2003, Server 2008, Windows 2000 and all still-supported versions of SQL Server, as well as Exchange Server 2003 and the newer Exchange Server 2007, the company said.

At the same time, IT administrators are being warned of a fake Microsoft security patch doing the rounds. The malicious patch is in circulation as a spam email that says their Windows system is vulnerable to a critical security issue, according to security provider Websense.

The patch spam prompts the PC user to click on a link that pop-up box that instructs them to initiate the download of what is actually malicious software. "It is important to add that Microsoft never sends security update notifications through emails," said the security advisory.

The Microsoft security updates will replace the pre-patch notice next Tuesday 8 June at 1pm Eastern time (6pm BST).

Miya Knights

A 25-year veteran enterprise technology expert, Miya Knights applies her deep understanding of technology gained through her journalism career to both her role as a consultant and as director at Retail Technology Magazine, which she helped shape over the past 17 years. Miya was educated at Oxford University, earning a master’s degree in English.

Her role as a journalist has seen her write for many of the leading technology publishers in the UK such as ITPro, TechWeekEurope, CIO UK, Computer Weekly, and also a number of national newspapers including The Times, Independent, and Financial Times.