Microsoft is readying only four "important" patches for next Tuesday round of security patches for July, which is one level below its most serious "critical" vulnerability rating.
Despite the fact the software only gave the four patches its second highest security rating, it hinted in its pre-patch notice posted to its website late yesterday that one of them would address a flaw that could allow hackers to remotely execute malicious code on a vulnerable PC.
Of the two Windows operating system (OS) patches it will issue, Microsoft indicated one will affect Windows 2000 and Windows XP, including the recently released XP Service Pack 3 (SP3), but not Windows Vista. The second will focus exclusively on Vista and its first service pack (SP1).
The other two patches affect Microsoft SQL Server and Exchange Server and are described as plugging "elevation of privilege" flaws, which could allow a hacker to obtain authorisation to access sensitive data on a victim's PC.
These last two patches apply to Windows Server 2003, Server 2008, Windows 2000 and all still-supported versions of SQL Server, as well as Exchange Server 2003 and the newer Exchange Server 2007, the company said.
At the same time, IT administrators are being warned of a fake Microsoft security patch doing the rounds. The malicious patch is in circulation as a spam email that says their Windows system is vulnerable to a critical security issue, according to security provider Websense.
The patch spam prompts the PC user to click on a link that pop-up box that instructs them to initiate the download of what is actually malicious software. "It is important to add that Microsoft never sends security update notifications through emails," said the security advisory.
The Microsoft security updates will replace the pre-patch notice next Tuesday 8 June at 1pm Eastern time (6pm BST).
