Microsoft fixes record number of flaws, some publicly known

The company's March security updates include the fixes skipped in February

Microsoft's batch of security patches for March is one of the largest ever and includes fixes for several vulnerabilities that are publicly known and actively exploited.

The company published 17 security bulletins covering 135 vulnerabilities in its own products and one separate bulletin for Flash Player, which has its security patches distributed through Windows Update. Nine bulletins are rated critical and nine are rated as important.

The affected products include Windows, Internet Explorer, Microsoft Edge, Microsoft Office, Exchange, Skype for Business, Microsoft Lync, and Silverlight.

The highest priority should be given to the MS17-013 security bulletin, which addresses remote code execution, privilege escalation, and information disclosure flaws in the Windows Graphics Component, Graphics Device Interface (GDI), and Color Management. These vulnerabilities affect Windows, Office, Skype, Lync, and Silverlight.

The remote code execution flaws can be exploited by tricking users into opening a specially crafted website or document. What's worse is that one of the vulnerabilities is publicly known and another is already actively exploited.

Another important bulletin is MS17-012, which fixes a vulnerability in the Windows SMB network file-sharing protocol that has been publicly disclosed over a month ago.

The MS17-006 and MS17-007 bulletins for Microsoft Edge and Internet Explorer also contain vulnerabilities that have been publicly disclosed, including a critical remote code execution one.

On the server side, the Microsoft Exchange and IIS bulletins, MS17-015 and MS17-016, should be prioritized because these systems are typically exposed to the internet. Server administrators should also direct their attention to the bulletins for Hyper-V virtualization (MS17-008) and Active Directory Federation Server (MS17-019).

"Overall, it's going to be very busy for IT departments of all sizes due to the large number of desktop and server patches," Amol Sarwate, director of Vulnerability Labs at security vendor Qualys, said in a blog post.

The high number of patches in this release are because Microsoft decided to postpone by a month the security updates it had originally scheduled for February. This unprecedented decision was taken due to an unspecified last-minute issue and was criticized by some researchers, especially since there were a number of publicly known flaws.

Also, it seems that Microsoft has backtracked on its plan to stop organizing patch information into security bulletins, at least for this month. The company had planned to stop using bulletins in favor of a new portal called the Security Updates Guide.

Join the PC World newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?