Microsoft patching five flaws, two critical

Microsoft announced in its monthly Patch Tuesday preview that it plans next week to release security updates for five individual product vulnerabilities, including two critical issues.

After failing to release any security patches in March 2007 and issuing a rare, out-of-band fix for a highly critical Windows flaw on April 3, the software maker reported that it will drop four additional updates for its flagship operating system, along with a bulletin meant to address a problem in its Content Management Server.

One of the Windows updates, along with the Content Management Server fix, has been affixed with the critical rating by Microsoft, the company’s most severe security vulnerability designation.

The past several months have seen an interesting wax and wane for the delivery of Patch Tuesday updates. In February, Microsoft shipped a dozen individual bulletins, tying its all-time high for the releases, before calling off Patch Tuesday in March.

The company was forced to push out a fix for a bug that affects the way the way Windows processes .ANI Animated Cursor files on March 3 after malware code writers began using it to assail end-users with a wide variety of attacks, including root kits and botnet programs.

The update represented only the third time Microsoft has broken with its Patch Tuesday schedule to address such a problem.

Some experts have criticized Microsoft for failing to address the .ANI flaw until after hackers began taking advantage of the issue, as the firm had admitted publicly that it was notified of the problem in late Dec. 2006.

According to Symantec’s latest Internet Security Threat Report, which covers the second half of 2006, Microsoft took an average of 21 days between the public disclosure vulnerabilities and the release of related patches.

Some industry watchers are already questioning why Microsoft’s April 2007 Patch Tuesday distribution fails to address at least three known vulnerabilities in its popular Office software, including a code execution in Word that has been exploited and reported publicly since at least mid-February.

In addition to its security bulletins, Microsoft said it would release a revamped version of its Windows Malicious Software Removal Tool, along with several other non-security updates.