Security the focus as Microsoft, Oracle patch bugs

It's the mother of all patch days for enterprise IT shops, with both Microsoft and Oracle releasing critical software updates Tuesday.

Microsoft kicked things off Tuesday morning with 11 security updates, including fixes for critical security bugs in Windows Active Directory, Internet Explorer, Excel and the Microsoft Host Integration Server, which integrates Windows computers with IBM mainframes.

Security experts say that the Internet Explorer update, which fixes six bugs in the browser, is the one to watch. That's because it is rated critical for Internet Explorer 6 users running Windows XP -- a very common configuration in the enterprise.

But customers who are running Windows Active Directory on older Windows 2000 machines should move the MS08-060 Active Directory update to the top of their patch queue, said Don Leatham, a director of solutions and strategy at Lumension Security. Because an Active Directory server can be used to set permissions on other machines and manage users on the network, taking over this machine "would be the Holy Grail for someone trying to get into a company and totally disrupt it," he said.

Normally, Active Directory servers are blocked at the firewall, which means that an attacker would probably have to be on an internal network to mount an attack, said Eric Schultze, chief technology officer with Shavlik Technologies. But the bug "means any internal, disgruntled user can take complete control over Windows 2000 domains and domain controllers," he said via instant message.

Mitigating this concern, however, is the fact that Microsoft has not had any reports that this vulnerability has been exploited in an attack. While it's likely that an attacker could crash the Windows 2000 machine by exploiting this bug, "creating functioning exploit code to leverage remote code execution is difficult," Microsoft said in a note on its Web site.

In total, 20 security bugs were fixed in Microsoft's 11 updates. There were also six less-critical updates, rated "important," by Microsoft, for various Windows components, and a "moderate" patch that fixes a bug that could let an attacker snoop information from an Office user.

Oracle's security updates, expected at 1 p.m. Pacific time, will include fixes for 36 bugs in a range of Oracle products, including the company's flagship Database, its Application Server, E-Business Suite, and WebLogic server and development tools. Bug-fixes are also planned for the company's JD Edwards and PeopleSoft products.

It's unusual for both Microsoft and Oracle to be pushing out patches on the same day. Microsoft's security updates come out on the second Tuesday of every month, known as Patch Tuesday in the industry. But Oracle's patches are a quarterly affair, delivered on the Tuesday nearest the middle of the month. Typically, that puts the Oracle patches on the third Tuesday of the month, but this month, the Microsoft and Oracle release dates converged.

Tuesday's Microsoft updates came with a little more information for the company's customers too. They included a new section called the "Exploitability Index," designed to make it easier for Windows users to figure out which bugs are most likely to be exploited by hackers.

Microsoft has now rated all of its security updates with the following descriptions: "Consistent Exploit Code Likely," "Inconsistent Exploit Code Likely" or "Functioning Exploit Code Unlikely."

The company said that exploit code was likely for bugs in the critical Internet Explorer, Microsoft Host Integration Server and Excel updates. One of the Internet Explorer bugs, which could let an attacker gain elevated privileges on a Windows machine, has already been publicly disclosed, but is not thought to have been used in real-world attacks, Microsoft said.

Another first: Microsoft gave certain security partners early access to its updates this month so that they could roll attack detection into their software as the patches were released Tuesday.