Microsoft patch numbers hit record high

 

Gallery

By Maggie Holland,

Posted on 9 Aug 2006 at 11:12

The number of critical flaws in Microsoft software has hit a record high, offering a prime opportunity for hackers to exploit the backlog of unprotected vulnerabilities, according to security experts.

So far this year, the software giant has already addressed more critical vulnerabilities than in 2004 and 2005 combined, according to security specialist McAfee.

This news follows Microsoft's latest monthly security patch update, issued yesterday, which highlighted nine 'critical' and three 'important' browser, Windows and Office-related flaws that allow remote code execution.

'With over 120 new vulnerabilities across all platforms and applications reported last just last week, a rate of 6,000 new vulnerabilities per year!), clearly the rate of vulnerability discovery is still outpacing the number of patches being released,' said Alan Bentley, managing director, EMEA, of patch management specialist Patchlink.

'Between the backlog of unpatched issues, and the chances of new vulnerabilities being discovered in adjacent areas, PatchLink sees a clear trend towards exploits coming out before patches are available - and 'Exploit Wednesday' is likely to become a reality sooner rather than later.'

Microsoft hinted at the potential number of patches heading IT professionals' way last week in its Security Bulletin Advanced Notifications service. But it remained tight lipped about just how many would be deemed critical.

In light of the increased volume of patches, McAfee advised organisations to review deployment initiatives. Similarly, PatchLink said IT administrators should ensure their systems are up to date and ready to be patched as soon as patches are made available.

'Because security vulnerabilities are usually errors unintentionally put in code by programmers, the chances of finding a new vulnerability in an adjacent area of code or functionality is much more likely than your chances of identifying a brand new and unique vulnerability,' said Bentley.

'This issue can be seen clearly in the number of patches that "supersede" one another - where the same buggy code has been fixed again and again. Software bugs are a lot like roaches, if you find one, there are likely many more lurking somewhere close by.'