Microsoft on Tuesday released a slew of patches for Windows and Office, but a glitch prevented the company from pushing the updates out automatically.
The patches, which include critical fixes for both Office and Windows, can be manually downloaded from Microsoft's Web site, and the company said it hopes its more automated tools will have the patch available later on Tuesday. Microsoft said that its technical teams "have been working around the clock" to solve the updating problems.
"Due to technical difficulties experienced on the Microsoft Update platform, security updates released today are not currently available via Microsoft Update, Automatic Updates, Windows Server Update Services or Windows Update v6," the software maker said.
Microsoft had said last week to expect 11 patches. However, a representative for the software maker said on Tuesday that a planned critical Windows patch "did not meet the quality bar" and so was not issued.
Tuesday's 10 security bulletins, which include six critical fixes for both Office and Windows, are designed to fix more than two dozen flaws in Microsoft's software — the largest bunch so far this year, said one security company.
"Although there are only 10 patches, they address 26 vulnerabilities, and it's the largest release for Microsoft this year," said Jonathan Bitle, manager of technical accounts at Qualys. "This could be overwhelming for IT managers because they'll have to navigate what to patch and which to patch first."
The second-largest release was in August, when Microsoft's 12 patches put right 23 flaws.
Antivirus company Symantec said the updates include patches for Office flaws for which exploit code already exists, including an Excel vulnerability that surfaced in July and a Word exploit that emerged last month.
"The quantity of Microsoft Office vulnerabilities this month illustrates this emerging attacker focus, and users should consider the installation of these patches to be a critical component of a smart security strategy," Symantec Security Response director Oliver Friedrichs said in a statement.
IT administrators may want to work particularly quickly in deploying three of the patches — MS06-057, MS06-058 and MS06-060, Qualys' Bitle said.
Microsoft also noted that it expects to release Windows Internet Explorer 7 later this month, with the browser update scheduled to be delivered shortly thereafter via Windows Update and Automatic Update. The company said it is providing a blocker tool that will allow businesses to prevent their computers from receiving the new browser. Businesses that don't want IE7 should have the blocking tool in place by 1 November, Microsoft said.
Talkback
Well, a few hours sooner or later doesn't matter much on a total of a few months overdue, I gather.
More worrying however is that it seems that some single event can cause the entire Microsoft Update system to become unavailable (this time a few hours). Didn't they learn anything from their previous issues (in other areas) that boiled down to not being redundant enough? Certainly budget shouldn't be a problem for them. And I would think that PR and Marketing would demand only the best of the best and so forth.
As such perhaps a more distributed approach might be in order. Even including third-parties perhaps. After all, there are reasons why there's more then one DNS Root Server and why those aren't in the same location or even under single control.