Exploits are already out in the wild for a number of the vulnerabilities patched just today.
April 14, 2009
Exploits are already out in the wild for a number of the vulnerabilities patched just today.This month's round of patches fix a serious flaw in Excel, Internet Information Servers, SQL Server, as well as another flaw in Wordpad.
Symantec senior research manager Ben Greenbaum told associate Tom Claburn that the memory corruption vulnerability (CVE-2009-0554) described in Microsoft's MS09-014 bulletin, because it could lead to a successfully exploited system by simply luring a user to an especially crafted Web site.
But perhaps the most looming concern is that, according to Qualys, almost half of the vulnerabilities patched today already have either full-blown exploits widely available, or proof-of-concept code in the wild.
As the Qualys researchers told Computerworld:
"What really caught our eye is the large number of exploits that are already available," said Wolfgang Kandek, chief technology officer at security company Qualys Inc. "Out of the 23, there are 10 exploits or [flaws] that have proof-of-concept. This is a huge deal and shows just how much the patch window is shrinking."
His colleague, Amol Sarwate, the manager of Qualys' vulnerability research lab, was more specific. "This is the biggest number of zero-days we've seen from Microsoft in a long, long time. Out of the 10, six are patches for which the vulnerability is actively being exploited, three of them have proof-of-concept available, and for one, the knowledge needed to exploit this is available."
This situation certainly puts the pressure on to test and get these patches deployed.
Microsoft's bulletins are available here.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024