After attacks, Excel update due from Microsoft

09.04.2009
Corporate IT staffers will get a double whammy next week, as both Microsoft and Oracle are set to release critical security updates on the same day, including a likely fix for an Excel bug that has been used by cybercriminals.

This month, Oracle's quarterly software fixes and Microsoft's monthly patches happen to fall on the same day, next Tuesday. For Windows users, there will be a lot to patch. Microsoft plans to release eight updates in total: Five of them are for Windows, with a single update each for Internet Explorer, Excel and Microsoft's Internet Security and Acceleration (ISA) server.

Oracle that next week's patches will contain 43 security fixes, including 16 patches for the company's flagship database software. There will also be 12 vulnerabilities patched in the Oracle Application Server, as well as a handful of fixes for the company's E-Business Suite, PeopleSoft and JD Edwards Suite, and for the BEA application server suite.

The Excel update is noteworthy because Microsoft's spreadsheet software has recently been leveraged in a small number of targeted attacks. By tricking users into opening a specially crafted Excel file, criminals can install their malicious software on a victim's machine, The software vendor has not said for certain whether it will patch this particular Excel flaw next week, but it seems likely.

Microsoft has also warned of a in its PowerPoint software, which is also being used in attacks, but no PowerPoint updates are currently scheduled.

"We were hoping to see an update to handle the PowerPoint .pps exploit seeing as this is the hottest Office issue running wild, but from what we can tell at this point, the issue won't be addressed this month," security vendor Lumension said in a statement.