News

No Microsoft Security Patches Expected This Month

• By Stephen Swoyer
• March 9, 2007

Zero. Nada. Zilch. This is in spite of the fact that Microsoft has already confirmed the existence of at least one extant Word zero-day exploit, which surfaced shortly after last month’s Patch Tuesday festivities. In a posting last month on Microsoft’s Security Research Center Blog, researcher Alexandra Huft confirmed that Redmond was investigating the vulnerability.

The probable non-appearance of a patch at this time is hardly without precedent, of course: The first of four Word zero-day exploits came to light in early December of 2006, followed by the appearance of three others through January and February; it wasn’t until Feb. 13 (Patch Tuesday), however, that Microsoft issued patches for them.

Thursday's advance notification isn't always the last word in Patch Tuesday deliverables, either In January, for example, Microsoft yanked several promised Windows patches from its Patch Tuesday payload. The company has also been known to add patches at the last minute.

"Microsoft occasionally has months when it has not released security updates," commented a Microsoft spokesperson via e-mail. "The last time Microsoft did not offer security updates as part of its monthly update cycle was September 2005."

"There are many factors that impact the length of time between the discovery of a vulnerability and the release of a security update, and every vulnerability presents its own unique challenges," read another part of the e-mailed statement.

Redmond does plan to release two non-security high-priority updates on Windows Update (WU) and Software Update Services (SUS); and four non-security high-priority updates on Microsoft Update (MU) and Windows Server Update Services (WSUS). Microsoft is also prepping still another update for its Windows Malicious Software Removal Tool on Tuesday. That update will be available via WU, MU, SUS and WSUS.