All four critical patches have remote code execution (RCE) exploit considerations. The six important items are split between RCE and elevation-of-privilege bug implications. The moderate item is focused on preventing information disclosure hacks.
Overall, the fixes touch on a wide range of Windows OS releases, as well as Windows components such as Active Directory and applications such as Internet Explorer and Office, plus a rare fix involving Microsoft's Host Integration Server program.
Critical Items
The first critical item planned for the slate will be an Active Directory fix, affecting only Windows 2000 Service Pack 4. This security update is designed to stop an RCE attack.
Next up will be IE fixes affecting specific Internet Explorer versions -- IE 5.01, IE 6 and IE 7 -- sitting on Windows 2000 SP4, XP, Vista and Windows Server 2003 and 2008.
The third item expected in the critical category is one that's perhaps seldom seen by IT pros. It involves Microsoft Host Integration Server (HIS), which is a gateway program fostering interoperability between Microsoft Windows networks and legacy operating systems, as well as IBM mainframe and AS/400. The patch covers HIS 2000 and HIS 2004 on both the client and server side and HIS 2006 for 32-bit and 64-bit systems.
The fourth and last critical fix that Microsoft expects to deliver will focus on Excel in Office 2000 SP3, XP SP3 and Office 2003 SP2 and SP3; it also touches on Microsoft Office 2007. Additional apps affected by this fix include Office 2004 for Mac, XML file converter for Mac, Excel Viewer, Office 2007 Compatibility Pack and SharePoint Server.
Important and Moderate Items
All six important items will be Windows OS patches, according to Microsoft's announcement.
The first important fix will touch on XP and Windows Server 2003. The second fix will address Windows 2000 SP4 along with XP, Vista and the Windows Server series 2003 and 2008. Important items Nos. 3 and 4 follow suit.
Meanwhile, the fifth important fix is expected to cover XP, Vista and Windows Server 2003 and 2008 series. Fix No. 6 will be concentrated solely on Windows 2000 SP4.
As for the moderate item, it is a single fix involving XP SP3.
All but two of the projected 11 patches will require restarts.
IT pros and Windows Enterprise professionals interested in perusing items pertaining to general updates and other nonsecurity content can look at this knowledgebase article. It describes such updates as delivered through Microsoft Update, Windows Update and Windows Server Update Services.
The final slate for the October patch cycle will not arrive until this Tuesday, and Microsoft may have some last-minute changes. Still, with the fixes projected here, it seems there will be a lot of patching for IT administrators to consider this month.
Patch Tuesday To Address Four Critical Issues
