Microsoft patches 'insane' number of bugs
Nearly half of the 23 vulnerabilities have already been exploited or are public
Follow @infoworldMicrosoft issued Tuesday eight security updates that patch 23 vulnerabilities in Windows, Internet Explorer (IE), Excel and other parts of its software portfolio, a collection of fixes one researcher called "insane."
More dangerous than the sheer number of patches, however, is the fact that nearly half fix flaws that are already being exploited or are publicly known in enough detail -- in some cases, sample attack code is available -- to craft working exploits.
[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
"What really caught our eye is the large number of exploits that are already available," said Wolfgang Kandek, CTO at security company Qualys Inc. "Out of the 23, there are 10 exploits or [flaws] that have proof-of-concept. This is a huge deal, and shows just how much the patch window is shrinking."
His colleague, Amol Sarwate, the manager of Qualys' vulnerability research lab, was more specific. "This is the biggest number of zero-days we've seen from Microsoft in a long, long time. Out of the 10, six are patches for which the vulnerability is actively being exploited, three of them have proof-of-concept available, and for one, the knowledge needed to exploit this is available."
Kandek and Sarwate recommended that users patch those 10 bugs first by applying the critical updates for Excel (MS09-009) and WordPad (MS09-010), and Windows' "token kidnapping" issues (MS09-012). Microsoft pegged the last as "important," the second-highest ranking in its four-step threat scoring system.
Other researchers didn't call out the number of already-exploited bugs Microsoft patched Tuesday, but echoed Kandek and Sarwate on the month's theme.
"You could call this a spring cleaning," said Eric Schultze, chief technology officer at Shavlik Technologies LLC. "Microsoft jumped on a couple of zero-days, including Excel from February and WordPad from last December. It's nice to see those taken care of."
Microsoft had previously issued security advisories for Excel and WordPad, and acknowledged that in the case of the former, it had already detected attacks in at least limited numbers. After calling this month's batch "insane," Andrew Storms, director of security operations at nCircle Network Security Inc., added a third outstanding issue to Schultze's list by seconding Kandek's and Sarwate's vote that MS09-012 is important. "Microsoft fixes three out of the four outstanding issues," Storms said, referring to the Excel and WordPad advisories, as well as the one issued a year ago by Microsoft about the token kidnapping problems in Windows.
"The token kidnapping vulnerability has certainly been known for quite a long time, and people may have written code around it already," Storms speculated. "I think it's safe that they'll take another look at their [exploit] code now that a patch is out."
