You should expect April’s Microsoft Patch Day to match last month in quantity, but exceed it in severity.
According to their advanced notification post for April, Microsoft plans to release six security bulletins next Tuesday, fixing eleven flaws that span Windows, Internet Explorer (IE), Office, SQL Server, and many other Microsoft products. Microsoft rates four of these bulletins as Critical, making it a relatively important Patch Day.
I suspect the IE bulletin will likely pose the most risk to typical organizations. It will likely fix at least one remote code execution vulnerability, which an attacker could exploit by luring you to a malicious website. That said, “Bulletin 4” also looks quite interesting, since it affects so many different products. In any case, I recommend you prepare your staff for a busy day of testing and patching next Tuesday.
Return here on April 10 for more details on these upcoming bulletins.
[UPDATE] On Friday, Adobe released a pre-notification alert for their patch day, which falls on the same Tuesday as Microsoft Patch Day. You should also expect Adobe Reader and Acrobat updates next week. — Corey Nachreiner, CISSP (@SecAdept)
Leave a Reply