Microsoft patches 'insane' number of bugs

10 of the 23 vulnerabilities have already been exploited, or are public

Microsoft Corp. Tuesday issued eight security updates that patch 23 vulnerabilities in Windows, Internet Explorer (IE), Excel and other parts of its software portfolio, a collection of fixes one researcher called "insane."

More dangerous than the sheer number of patches, however, is the fact that nearly half fix flaws that are already being exploited or are publicly known in enough detail - in some cases, sample attack code is available -- to craft working exploits.

"What really caught our eye is the large number of exploits that are already available," said Wolfgang Kandek, chief technology officer at security company Qualys Inc. "Out of the 23, there are 10 exploits or [flaws] that have proof-of-concept. This is a huge deal, and shows just how much the patch window is shrinking."

His colleague, Amol Sarwate, the manager of Qualys' vulnerability research lab, was more specific. "This is the biggest number of zero-days we've seen from Microsoft in a long, long time. Out of the 10, six are patches for which the vulnerability is actively being exploited, three of them have proof-of-concept available, and for one, the knowledge needed to exploit this is available."

Kandek and Sarwate recommended that users patch those 10 bugs first by applying the critical updates for Excel (MS09-009) and WordPad (MS09-010), and Windows' "token kidnapping" issues (MS09-012).

Microsoft pegged the last as "important," the second-highest ranking in its four-step threat scoring system.

Other researchers didn't call out the number of already-exploited bugs Microsoft patched Tuesday, but echoed Kandek and Sarwate on the month's theme.

"You could call this a spring cleaning," said Eric Schultze, chief technology officer at Shavlik Technologies LLC. "Microsoft jumped on a couple of zero-days, including Excel from February and WordPad from last December. It's nice to see those taken care of."

Microsoft had previously issued security advisories for Excel and WordPad, and acknowledged that in the case of the former, it had already detected attacks in at least limited numbers.

After calling this month's batch "insane," Andrew Storms, director of security operations at nCircle Network Security Inc., added a third outstanding issue to Schultze's list by seconding Kandek's and Sarwate's vote that MS09-012 is important. "Microsoft fixes three out of the four outstanding issues," Storms said, referring to the Excel and WordPad advisories, as well as the one issued a year ago by Microsoft about the token kidnapping problems in Windows.

"The token kidnapping vulnerability has certainly been known for quite a long time, and people may have written code around it already," Storms speculated. "I think it's safe that they'll take another look at their [exploit] code now that a patch is out."

That's exactly why this month's patches are so important, Storms said, not because the quantity is a "giant leap" from the past three months, but because of the in-the-wild exploits and the proof-of-concept code samples publicly available. "Once Microsoft releases the patch, what's in there is what they've fixed, and [attackers] can more easily see where their exploit code is working and not working. It lets them create code that's more exploitable more often."

Other updates that the security experts said were important to apply quickly include the six-bug fix for IE ( MS09-014) and the three-bug patch for Windows HTTP Services (MS09-013). Both updates were tagged critical.

"Microsoft added the same protection methods to HTTP that it did to pure SMB in MS08-068," said Schultze, talking about an update issued in November 2008. "It's really cool that Microsoft decided to go back into the code to provide more protection for credential reflection.

"Microsoft's now at the third level of security," Schultze continued. "First, is reactive, second is best practices in developing secure software, and the third is going back and finding things that they wouldn't ordinarily have looked for."

Also included in today's security roll-out were updates for DirectX (MS09-011), ISA Server (MS09-016) and the Windows SearchPath function (MS09-015).

Microsoft labeled the first as critical, the second as important and the third as moderate.

April's eight security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.

Tags exploits and vulnerabilitiesMicrosoftbugsmicrosoft patches

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?