Code Library Bug Is Likely Patch Tuesday Target

Microsoft Corp. plans to deliver nine security updates this week for August, five of them "critical" and all but one affecting Windows.

While Microsoft offers only an outline of its patching plans in advance, it appears that eight of the updates involve various versions of Windows and the ninth deals with vulnerabilities in Office, Visual Studio, ISA Server, BizTalk Server and several other products.

"It won't be a go-take-a-nap month," said Andrew Storms, director of security operations at nCircle Network Security Inc. "The good thing is that we're not looking at a lot [of vulnerabilities] in the public domain, so that should give everyone a week or two, at least, to test the updates before they deploy them."

Storms predicted that Microsoft will tackle bugs introduced when one of its programmers added an errant ampersand character to a vital code library used in Windows and an unknown number of third-party applications. Microsoft late last month acknowledged flaws in the Active Template Library (ATL), which is included with Visual Studio.

On July 28, Microsoft rushed out a pair of emergency updates to fix vulnerabilities traced to ATL. Two days later, Adobe Systems Inc. acknowledged that its Flash and Shockwave players had been developed using the buggy library and patched the software.

One of Microsoft's Patch Tuesday updates appears likely to address a problem the company has acknowledged affects its Office Web Components. But it's the flawed ATL library on which Microsoft seems likely to concentrate, Storms said.

In fact, that library has been used so much that Microsoft may be putting out patches related to it for a while. "I wouldn't be surprised if this goes on for a number of months as they go back and check their software," Storms said.

He expects this week's security updates to affect "core parts" of the Windows operating system. "Sometimes that's a little more worrisome than when Microsoft patches a single application, like IE," Storms said, "because if there's a problem with the patch, the entire OS could go down into a Blue Screen of Death."

This version of the story originally appeared in Computerworld 's print edition.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.