SECURITY
Microsoft patches 23 security flaws
09-08-2006
by Ciara O'Brien
Microsoft, on Tuesday, issued yet another bumper crop of security updates to fix over 20 flaws in its software, its biggest update since it began the regular bulletins.
The 12 updates fix a staggering 23 flaws in Windows software, with 15 of them rated as critical, Microsoft's most severe rating. One of the 15 critical vulnerabilities has been tagged as a possible worm candidate; anonymous users can exploit the Service Server vulnerability remotely, regardless of the operating system.
Three of the flaws were discovered in Office products, including Powerpoint, while 20 were present in the Windows system. Mac users also need to beware, as the Powerpoint vulnerability can affect their systems.
Industry experts said that although 11 of the flaws were already known, the remaining 12 were discovered by Microsoft.
"This month 11 patched vulnerabilities were already public or were already exploited in-the-wild prior to [Tuesday's] announcements. Among them is the vulnerability in Powerpoint that was exploited in targeted attacks in mid-July," said security firm McAfee in a post on its Avert Labs blog.
This is the third month in a row that Microsoft has issued a large number of security patches for its software. In fact, according to McAfee, Microsoft has already dealt with more vulnerabilities this year than in 2004 and 2005 combined.
But rather than an indictment of the security of Microsoft's software, Conor Flynn, technical director of Rits, told ENN that this may actually be a positive sign, with Microsoft reacting to the flaws more rapidly.
"The fact is that they are responding more quickly and getting more of the patches out in distribution," he said.
However, Flynn also said that he believed more frequent updates would be necessary going forward. At present, Microsoft issues a monthly update, but this leaves a time lag between some flaws being discovered and the fixes being issued, leaving users' PCs open to attack.
"Microsoft is not the worst," he pointed out. "Oracle only issues patches quarterly."
However, the release of Vista could mark a turning point for Microsoft; it is believed to eliminate a lot of the security problems that were experienced in XP. However, its release has been delayed until 2007.
Using the subject line to get noticed: Denise Cox argues that to get results you have to make every word work in a subject line.
