Microsoft issues patch to crush 20 bugs

Microsoft on Tuesday patched 20 vulnerabilities, more than half of them rated critical, in 11 separate security updates for Windows, Office, Internet Explorer (IE), Active Directory and the Host Integration Server.

Also for the first time, the company predicted the likelihood that hackers would come up with exploits for each bug.

"The count's big," said Andrew Storms , director of security operations at nCircle Network Security Inc. Eleven of the 20 flaws were rated "critical," the top ranking in Microsoft's four-level threat scoring system, while eight were pegged as "important," the next step down, and one was listed as only "moderate." Tuesday's update was the largest since August, when Microsoft issued 26 patches in 12 bulletins.

Storms identified two general themes in the latest round of patches. "First, there's still a pervasiveness of client application updates that doesn't seem to be diminishing at all, and second, Microsoft's newer software is still less vulnerable than its older."

On the first point, Storms ticked off updates that addressed three critical vulnerabilities in Excel and six critical bugs in IE , while for the second he listed several security bulletins that tagged Windows 2000 or older editions of Office as vulnerable, but gave newer versions of its operating system or applications either a pass or lowered the threat for users.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine