As long as it is patched before the exploits are out, the exploits no longer count. Or something like that.
Cue the double standards...
PS I wonder which one of these was labeled "Bulletin 3" in the pre-patch announcement? According to some (I won't mention their names or my post will get deleted), MS announcing things like a patch for a vulnerability called "Bulletin 3" 3 days before the patch is released triggers all "bad guys" to start looking for new holes now that they know the "Bulletin 3" hole will be patched in 3 days. I would give you a link to the discussion but those who shall remain nameless had the whole thread deleted.
Microsoft today dropped a mega patch bundle with fixes for several “critical” vulnerabilities affecting the Windows platform and warned that “consistent, reliable exploit code” was likely to be released within 30 days.
The Redmond, Wash. software maker released nine bulletins — five rated critical — to provide cover for a total of 19 documented security vulnerabilities. Of the nine updates, eight affect Windows and one affects Office Web Components (OWC).
The raw data:
- MS09-036 (Important): This update addresses one documented vulnerability in the Microsoft .NET Framework component of Microsoft Windows. This could allow denial-of-service attacks.
- MS09-037 (Critical): Five privately reported vulnerabilities in Microsoft Active Template Library (ATL). Hackers could exploit these flaws to launch remote code execution. Consistent, reliable exploit code likely within the month.
- MS09-038 (Critical): Covers two privately reported vulnerabilities in Windows Media file processing, which could allow remote code execution.
- MS09-039 (Critical): This bulletin addresses two privately reported vulnerabilities in the Windows Internet Name Service (WINS). These issues could lead toremote code execution attacks and exploit code is likely to be released soon.
- MS09-040 (Important): This patches a privately reported vulnerability in the Windows Message Queuing Service (MSMQ), which could allow elevation of privilege. Reliable Exploit code likely.
- MS09-041 (Important): Covers a privately reported vulnerability in the Windows Workstation Service, which could allow elevation of privilege. Reliable exploit code likely for this flaw.
- MS09-042 (Important): This update resolves a publicly disclosed vulnerability in the Microsoft Telnet service, which could allow an attacker to obtain credentials.
- MS09-043 (Critical): This covers four privately reported vulnerabilities in Microsoft Office Web Components, which could allow remote code execution.
- MS09-044 (Critical): This update resolves two privately reported vulnerabilities in Microsoft Remote Desktop Connection, which could allow remote code execution.
This chart from Microsoft (click image for full size) shows where consistent, reliable exploit code is likely:
For more information, see this entry on the MSRC blog. Over on Theatpost, Shavlik’s Eric Schultz digs deeper into the vulnerabilities and patches.
