With More Urgency Than Usual, Apply This Month's Batch of Microsoft Patches

Exploits are already out in the wild for a number of the vulnerabilities patched just today.This month's round of patches fix a serious flaw in Excel, Internet Information Servers, SQL Server, as well as another flaw in Wordpad.

Symantec senior research manager Ben Greenbaum told associate Tom Claburn that the memory corruption vulnerability (CVE-2009-0554) described in Microsoft's MS09-014 bulletin, because it could lead to a successfully exploited system by simply luring a user to an especially crafted Web site.

But perhaps the most looming concern is that, according to Qualys, almost half of the vulnerabilities patched today already have either full-blown exploits widely available, or proof-of-concept code in the wild.

As the Qualys researchers told Computerworld:

"What really caught our eye is the large number of exploits that are already available," said Wolfgang Kandek, chief technology officer at security company Qualys Inc. "Out of the 23, there are 10 exploits or [flaws] that have proof-of-concept. This is a huge deal and shows just how much the patch window is shrinking."

His colleague, Amol Sarwate, the manager of Qualys' vulnerability research lab, was more specific. "This is the biggest number of zero-days we've seen from Microsoft in a long, long time. Out of the 10, six are patches for which the vulnerability is actively being exploited, three of them have proof-of-concept available, and for one, the knowledge needed to exploit this is available."

This situation certainly puts the pressure on to test and get these patches deployed.

Microsoft's bulletins are available here.