Microsoft has released 10 security patches for 22 holes, including seven "critical" patches that could give remote attackers control of your system through the company's software.
The software giant advised customers to download and install critical patches for a wide range of products as soon as possible. Windows, the Exchange e-mail server and Microsoft Office are all affected. The updates, MS04-029 to MS04-038, can be reviewed on its website.
The holes come in a number of critical components, including Windows components for handling SMTP, used for sending and receiving e-mail, and NNTP traffic, as well as a Windows feature for processing compressed ZIP files.
The slew of vulnerabilities will cause headaches for sysadmins rushing to distribute the patches before code to exploit the vulnerabilities is released on the Internet.
The most critical for business are MS04-035, which patches the SMTP hole, and MS04-036, which plugs the hole in Windows handling of NNTP, a protocol used to manage traffic to and from Internet news groups.
Both the vulnerabilities affect servers running at the enterprise gateway and will need to be patched as soon as possible, especially with the threat of remote exploit and code execution, said Brian Mann, manager of McAfee's Emergency Response Team. The disclosed vulnerability in Windows handling of ZIP folders is also dangerous, because it affects machines running Windows Server and Windows XP, he said.
For that vulnerability, a buffer overflow can be created on Windows by zip files specially crafted to trigger the vulnerability. Windows users would have to download and open the files from a website or double click on a malicious zip file in an e-mail to trigger the buffer overflow. However, zips are a common form of e-mail attachment, and virus writers are already fond of using the compressed files to deliver malicious payloads.
Administrators should also hurry to apply cumulative software patches for Windows (MS04-032) and the Internet Explorer browser (MS04-038), said Thor Larholm, senior security researcher at PivX Solutions.
Malicious code that exploits vulnerabilities covered by those patches, including flaws in a Windows component called Windows Shell and a vulnerability in the way Internet Explorer handles drag and drop events, is already circulating on the Internet, he said.
While there were no major surprises in the October batch of patches, the sheer number of vulnerabilities disclosed will keep administrators busy, especially with the short window of time between the publication of a software patch the development of exploit code that takes advantage of it.
PivX estimates that new exploit code for vulnerabilities typically appears within 10 days of a patch being released or publicised.