Microsoft issued Tuesday eight security updates that patch 23 vulnerabilities in Windows, Internet Explorer (IE), Excel and other parts of its software portfolio, a collection of fixes one researcher called "insane."
More dangerous than the sheer number of patches, however, is the fact that nearly half fix flaws that are already being exploited or are publicly known in enough detail -- in some cases, sample attack code is available -- to craft working exploits.
[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
"What really caught our eye is the large number of exploits that are already available," said Wolfgang Kandek, CTO at security company Qualys Inc. "Out of the 23, there are 10 exploits or [flaws] that have proof-of-concept. This is a huge deal, and shows just how much the patch window is shrinking."
His colleague, Amol Sarwate, the manager of Qualys' vulnerability research lab, was more specific. "This is the biggest number of zero-days we've seen from Microsoft in a long, long time. Out of the 10, six are patches for which the vulnerability is actively being exploited, three of them have proof-of-concept available, and for one, the knowledge needed to exploit this is available."
Kandek and Sarwate recommended that users patch those 10 bugs first by applying the critical updates for Excel (MS09-009) and WordPad (MS09-010), and Windows' "token kidnapping" issues (MS09-012). Microsoft pegged the last as "important," the second-highest ranking in its four-step threat scoring system.
Other researchers didn't call out the number of already-exploited bugs Microsoft patched Tuesday, but echoed Kandek and Sarwate on the month's theme.
"You could call this a spring cleaning," said Eric Schultze, chief technology officer at Shavlik Technologies LLC. "Microsoft jumped on a couple of zero-days, including Excel from February and WordPad from last December. It's nice to see those taken care of."
Microsoft had previously issued security advisories for Excel and WordPad, and acknowledged that in the case of the former, it had already detected attacks in at least limited numbers. After calling this month's batch "insane," Andrew Storms, director of security operations at nCircle Network Security Inc., added a third outstanding issue to Schultze's list by seconding Kandek's and Sarwate's vote that MS09-012 is important. "Microsoft fixes three out of the four outstanding issues," Storms said, referring to the Excel and WordPad advisories, as well as the one issued a year ago by Microsoft about the token kidnapping problems in Windows.
"The token kidnapping vulnerability has certainly been known for quite a long time, and people may have written code around it already," Storms speculated. "I think it's safe that they'll take another look at their [exploit] code now that a patch is out."
Get the independent advice and expertise you need to support a virtual workforce.
The increase in Linux popularity has increased the frequency and sophistication of malware attacks. Read this 2 page white paper now to learn how you can protect your Linux environment with real-time protection that is certified by all major Linux vendors.
Download now »
Ensuring acceptable application delivery will become even more difficult over the next few years. As a result, IT organizations need to ensure that the approach that they take to resolving the current application delivery challenges can scale to support the emerging challenges. This handbook elaborates on the key tasks associated with planning, optimization, management and control and provides decision criteria to help IT organizations choose appropriate solutions.
Download now »
A common misconception is that mid-range storage requirements are dramatically different than that of a larger enterprise. Mid-range storage users may require less capacity, but they have similar functionality and management requirements. This ESG paper examines mid-range storage needs and reviews a new solution that adjusts size while retaining value, performance and functionality.
Download now »
Sign up to receive Security Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »
Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »
Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »
12 Recommendations
