Microsoft today said it will release seven security updates next week -- including one rated critical for Windows 8 and Windows RT -- to patch 12 vulnerabilities in Windows, Office, SharePoint Server and the company's website design software.
At the same time, Microsoft warned customers that hackers are using digital certificates obtained from a Turkish certificate authority (CA). In response, Microsoft has removed the purloined certificates from Windows' list of trusted certificates, and urged users to verify that they have applied a June 2012 update that automates the de-certification process.
Missing from Thursday's advance notification was any news about the Internet Explorer (IE) zero-day vulnerability that hackers have been exploiting since at least Dec. 7.
Microsoft today declined to comment when asked about the timetable for the IE fix.
In an emailed statement, Dustin Childs, a group manager in Microsoft's security group, again said that the firm has found few attacks exploiting the IE bug. "We've seen only a limited number of affected customers," Childs claimed.
The IE bug affects the IE6, IE7 and IE8 browsers released between 2006 and 2009. The vulnerability does not exist in the newer IE9 and IE10, Microsoft said last weekend when it first warned customers of the flaw.
"I didn't expect that they would have a patch ready," Andrew Storms, director of security operations at nCircle Security, said in an interview today. "And I don't think that they'll release it out-of-band at this point, unless the attacks start to show a large upward trajectory."
"Out-of-band" refers to a security update that's issued on the fly, and outside the usual monthly patch schedule Microsoft maintains. With no plans to patch the IE vulnerability next week, Microsoft's next scheduled opportunity would be Feb. 12.
Security firms that have gone into their logs have found evidence that the IE exploits started Dec. 7, but at least two websites -- the foreign policy think-tank Council on Foreign Relations, and Capstone Turbine, a U.S. micro-turbine manufacturer -- have been compromised by hackers, who then planted malware on their servers. People running IE6, IE7 or IE8 who surfed to those websites were then attacked by the malware, had their computers hijacked and, in some cases, data stolen.
Tuesday's security updates will not fix the IE vulnerability, but will address a dozen different bugs. Two of the seven updates will be graded "critical," Microsoft's most-serious threat assessment, while the remainder will be tagged as "important," the next-most-dire.
Bulletin 2, as Microsoft identified it today, piqued Storms' curiosity.
"By far, it's the most interesting because it's not just through the OS stack, but also applies to Office and developer tools and SharePoint," said Storms. "It's likely something core to Microsoft, like GDI [graphics device interface] or XML, to affect so many different products."
According to Microsoft, Bulletin 2 -- one of the two pegged critical -- applies to all supported versions of Windows, from the 11-year-old XP to 2012's Windows 8 and Windows RT, from Server 2008 to Server 2012. It will also affect Office 2003 through Office 2007 on Windows; Expression Web, part of the Expression Studio web development suite; and SharePoint Server 2007, Groove Server 2007 and System Center Operations Manager 2007.
Other security professionals, including Wolfgang Kandek, CTO of Qualys, and Paul Henry of Lumension, also put the spotlight on Bulletin 2.
Storms characterized the rest of Tuesday's bulletins as "not all that interesting," but some disagreed.
"Bulletin 5 may end up being the most significant, as it targets Vista SP 2, Server 2008 and Windows 7," said Alex Horan, senior product manager with CORE Security, in an email. "This has the potential for the most long-term issue, as it represents an extremely large base of potential targets if it is not rectified properly."
Microsoft rated Bulletin 5 as important. As Horan noted, it will not apply to Windows XP, but will to Windows 8 and Windows RT, both released two months ago. According to Web metrics company Net Applications, Vista, Windows 7 and Windows 8 collectively power about 57% of all Windows PCs.
Also today, Microsoft told customers it was revoking two digital certificates fraudulently acquired by cyber criminals from a subsidiary of TurkTrust, a Turkish CA that has ties to that country's military.
Users of Vista and Windows 7 will automatically receive the certificate revocation update if they had applied an update Microsoft offered June 11, 2012, part of its retooling of its own certificate-generation process. That was done after the discovery of "Flame," cyber-espionage malware that spread through a network by exploiting Microsoft's Windows Update mechanism. Windows 8 and Windows RT users will also get the certificate revocation update, since those brand-new operating systems have the same functionality baked in.
Windows XP users must run Windows Update to download and install Microsoft's certificate revocations, which were released Thursday.
Microsoft will deliver next week's seven security updates on Jan. 8 at approximately 1 p.m. ET.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.
See more by Gregg Keizer on Computerworld.com.
Read more about malware and vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.