Windows 8, RT Get First Security Fixes

Microsoft Pop-Up Stores: Hands-On Look

Windows 8 and Windows RT, released just two weeks ago, are about to receive their first security makeover.

Microsoft on Thursday said that it plans to release its first security patches for Windows 8 and Windows RT as part of its monthly patch cycle next week.

Six security bulletins are scheduled for release, addressing a total of 19 vulnerabilities. Three of the bulletins apply to Windows 8, each of which has been designated critical. Two of the bulletins apply to Windows RT, one of which is critical.

Microsoft won't disclose specifics about the flaws until the patch is released to the public, but the Windows 8 vulnerabilities all allow remote code execution. One of them also affects Microsoft .NET Framework.

[ Get expert guidance on Microsoft Windows 8. InformationWeek's Windows 8 Super Guide rounds up the key news, analysis, and reviews that you need. ]

Other Microsoft software affected includes Windows XP, Windows Vista, Windows 7, Server 2003, Server 2008, and Server 2012. Also affected are Microsoft Internet Explorer 9; Microsoft Excel 2003, 2007, 2010; Microsoft Office for Mac 2008, 2011; Microsoft Excel Viewer; and Microsoft Office Compatibility Pack.

With regard to the two Windows RT vulnerabilities, both the critical one and the important one could allow remote code execution. Users who have chosen to enable automatic updating will receive the patches, as might be expected, automatically.

Versions of Internet Explorer prior to IE9 are not being patched. Neither is IE10, which ships with Windows 8 and Windows RT.

That doesn't mean IE10 is not without potential problems: On October 30, French security firm VUPEN claimed that it had identified a vulnerability affecting Windows 8 and Internet Explorer 10. Unfortunately for Microsoft customers, VUPEN sells information about the vulnerabilities it finds to its clients rather than disclosing the information to Microsoft or the public.

Upgrading isn't the easy decision that Win 7 was. We take a close look at Server 2012, changes to mobility and security, and more in the new Here Comes Windows 8 issue of InformationWeek. Also in this issue: Why you should have the difficult conversations about the value of OS and PC upgrades before discussing Windows 8. (Free registration required.)