Risk: Medium
Microsoft's monthly patch announcements tipped the scales this month in possibly the largest issue yet, with no fewer than 10 security software security advisories, warning Windows users and corporate administrators of 22 new flaws that affect the company's products.
The advisories, and patches published with the bulletins, range from an "important" flaw affecting only Microsoft Windows NT Server to a collection of eight security holes, including three rated "critical," that leave Internet Explorer open to attack. Microsoft's highest severity rating for software flaws is its "critical" ranking, while "important" is considered slightly less severe. One flaw, in Microsoft Excel, even affects Apple Computers' Mac OS X.
The abundance of flaws could leave corporate PCs vulnerable to attack if administrators are not able to patch quickly. A similar situation occurred in April 2004, when Microsoft published seven advisories detailing 20 flaws. While one security hole stood out among those 20 - and led to the widespread Sasser worm - there are no standouts in the current gaggle of goofs.
"Our challenge is trying to guess what the criminals are going to attack," said Stephen Toulouse, security program manager for Microsoft's security response team. "The guidance we are giving in general is to treat the critical ones first." A single computer would not be vulnerable to all the flaws, Toulouse added.
Symantec has issued an advisory based on the Microsoft release, stating that three of the 22 new vulnerabilities could lead to a Sasser-like worm, but that the danger is lessened by the fact that the vulnerable services are not started by default on most modern versions of Windows. The flaws are related to three network protocols that are not generally activated on Windows computers: Simple Mail Transfer Protocol (SMTP), Network News Transfer Protocol (NNTP), and Network Dynamic Data Exchange (NetDDE).
Blaster and Sasser targeted core system vulnerabilities, where if you didn't have the patch you were vulnerable. The key thing here is that these are not (generally) enabled by default. The question is how large is the deployment of vulnerable systems.
Microsoft rates the SMTP flaw critical only for Microsoft Exchange Server 2003. The NNTP flaw is rated critical for Microsoft Exchange 2000.
The other major class of flaws are those that affect applications on desktop computers, such as Internet Explorer and Excel. Threats to so-called client-side applications are on the increase.
Of the current crop of vulnerabilities, 12 fall into that category. Of these, Microsoft rated five critical: three of the eight vulnerabilities in Internet Explorer, as well as two flaws in Excel.
Several of the flaws could be used to create web content that would run a program from the Internet, if a victim could be lured to the malicious web site.
Some anti-virus/security specialist companies have raised their overall Internet Threat Condition from Level 2 to Level 1 status due to the release of information about the vulnerabilities.
Microsoft has also re-released a patch from last month's graphics vulnerability, fixing a conflict with Windows XP Service Pack 2.