 |
| Windows Update |
The company also delivered a long-discussed "backport" to Office 2003 and Office 2007 that brings one of the newer security features in Office 2010 to the older editions.
The 17 updates, which Microsoft dubs "bulletins," tied a record set late last year, but easily beat the October 2010 mark for the total number of flaws they fixed. Altogether, the updates patched 64 vulnerabilities, 15 more than in October and 24 more than in the former second-place collection of December 2010.
Nine of the 17 bulletins were pegged "critical," Microsoft's highest threat ranking, while the remainder were marked "important," the next-most-serious label.
Microsoft and virtually every security expert pegged several updates that users should download and install immediately.
"There are three we think are top priorities," said Jerry Bryant, group manager with the Microsoft Security Response Center (MSRC), in an interview earlier on April 12. Bryant tagged MS11-018, MS11-019 and MS11-020 as the ASAP updates.
"We encourage customers to put this at the top of the list," said Bryant, "because we're seeing limited and targeted attacks using the Pwn2Own vulnerability."
Microsoft acknowledged those attacks in a tweet from the MSRC.
It's likely that the IE bug exploited at Pwn2Own made its way into the wild because others uncovered the same bug Fewer used at the hacking contest: HP TippingPoint, Pwn2Own's sponsor, does not divulge information about the bugs it buys.
"We often see multiple people finding the same bug," said Andrew Storms, director of security operations at nCircle Security.
The other bulletin that made its way to the top of everyone's list was , which patched a critical vulnerability in Windows's handling of the SMB (Server Message Block) protocol.
"This is an old-school vulnerability, something that we haven't seen for a long time," said Amol Sarwate, the manager of Qualys' vulnerability research lab. "No user interaction is required to trigger this, and once inside, a worm using this could spread throughout the network."
Storms, who like Sarwate also ranked the SMB update alongside the IE bulletin, pointed out that the Conficker worm exploited a nearly identical bug.
Conficker, which in November 2008, infected millions of machines in the next few months, and caused a when the massive collection of compromised computers was to receive a new malware update, also exploited an SMB flaw.
Even though Microsoft had rushed out an emergency patch before Conficker appeared, the worm still spread widely and wildly.
"I don't know which is worse, MS11-018 or MS11-020," said Storms. "But the SMB bug is a worm kind of vulnerability. It has the makings of another Conficker."
Assuming an attacker can plant malware on a single PC -- not difficult when people carelessly click on links -- he could use the SMB bug patched in MS11-020 to spread a worm to other machines on the same network.
"We learned a lot from Conficker," said Storms. "It led us to not believe that the sky is falling when people said so, but it also tells us that you need to install this patch right away."
MS11-019, another update that focused on the SMB protocol, was Bryant's third priority pick.
The company also issued patches for Excel, PowerPoint, .Net and multiple bits and pieces of Windows.
In the last category, MS11-034 patched -- nearly half the total and a record for a single update -- in the Windows kernel device driver. All 30 were reported to Microsoft by Tarjei Mandt, a researcher who works for Norman ASA, a Norwegian antivirus firm, who has numerous other kernel bugs on his resume.
"In the end, though, these are just elevation of privilege vulnerabilities," said Josh Abraham, security researcher at Rapid7. "From a penetration tester's perspective, which is what I do, let's just say they wouldn't be my main focus."
Microsoft issued a pair of security advisories as well, each backed by a download users can retrieve and install.
The most notable of the two, said researchers, that debuted in Office 2010 to users running the older Office 2003 and Office 2007 application suites.
In December 2010, Microsoft announced it would to Office 2003 and Office 2007, saying then that it would do so early this year.
The April 12 security patches can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at or subscribe to . His e-mail address is .
