The second Tuesday in each month is when Microsoft schedules its patches, fixes, and security updates. Recently, Microsoft has begun to offer Advance Notification for its Security Bulletins, which makes it a lot easier to tell what”s coming down the pike. For December, 8 updates have been pushed to the Windows Update servers

Of today”s 8 items, 6 are rated Critical and 2 Important. Here”s a brief summary of what to expect:

• MS08-71:  Vulnerabilities in GDI Could Allow Remote Code Execution
  Permits a specially crafted WMF image file to inject remote code execution at the system level.
• MS08-75: Vulnerabilities in Windows Search Could allow Remote Code Execution
  Blocks vulnerabilities that could occur if a user opens and saves a specially-crafted save-search file in IE or clicks a similar search URL.
• MS08-073: Cumluative Security Update for IE
  Resolves 4 privately reported vulnerabilities including remote code execution.
• MS08-070: Vulnerabilities in Visual Basic 6 Runtime Extended Files (ActiveX Controls) could allow remote code execution
  Resolves 5 private and 1 public vulnerability in ActiveX controls for VB 6.0 Runtime Extended files.
• MS08-072: Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution
  Resolves 8 privately reported MS Office and Outlook vulnerabilities related to Word or RTF file contents that devlier access at the system level.
• MS08-074: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution
  Resolves 3 privately reported vulnerabilities possible from specially-crafted Excel files that provide system-level access.
• MS08-077: Vulnerability in Microsoft Office SharePoint Server Could Cause Elevation of Privilege
  Resolves a privately reported item that allows elevation ofprivilege when authentication is bypassed by browsing to an admin URL on a SharePoint site (might result in DoS or unauthorized access).
• MS08-076: Vulnerabilities in Windows Media Components Could Allow Remote Code Execution
  Resolves 2 privately reported vulnerabilities in Windows Media Player, Windows Media Format Runtime, and Windows Media Services that could allow remote code execution at system level privilege.

The first six are rated Critical, the last two Important. Vista admins will probably want to start working with all of these that apply to their environments (including SharePoint and Windows Media, where applicable) because all come with potentially dire consequences if they remain unpatched. Hopefully, none of them will cause too many compatibility problems. Nonetheless I advise you to please get testing underway ASAP. Updates just hit the Windows Update server as I wrote this blog and should now be readily available.

[Added 12/10/2008] I just saw an interesting story from Ryan Naraine on ZDNet that puts the Vista Updates into the overall context of Windows Update. He calls this patch Tuesday a “whopper” and mentions that 28 vulnerabilities in Windows, IE, and Office are addressed, of which 23 are rated “Critical.” He counts each of the reported items addressed in the preceding list of security bulletins to come up with these numbers, which certainly adds to the drama. I guess it”s all in how you play out and drum up those numbers!