Major Microsoft Patch Releases Block Infected E-Mail

Network administrators were busy today as Microsoft released its largest collection of security patches in more than a year.

The monthly security update includes 21 vulnerabilities on 12 updates, the most since February 2005, said Jonathan Bitle, product manager with Qualys.

The update is so large because hackers are exploiting "client-side" weaknesses instead of automated services that run in an operating system. That type of attack relies on PC users' tendency to open e-mail attachments and other files from unknown senders.

"It's a who's who of what applications are installed on an end-user PC, from Internet Explorer to PowerPoint to Word to Media Player," Bitle said.

Hacker Blocks

The risk is much greater than a virus sending e-mail to all the names in a user's address book. Instead, 19 of the patches correct problems that allow "remote code executions," the programmers' term for a hacker's program that can gain full control over a user's PC.

With such control, a hacker could steal or corrupt data, or even use the host computer to launch additional attacks on other networks.

The sole consolation is that hackers cannot exploit most of those weaknesses unless a user opens an infected file, such as a PowerPoint slideshow, Word document or Media Player picture, said Amol Sarwate, manager of the vulnerability research lab at Qualys.

Still, system administrators must install all 21 patches, he warned. "You can't rely on end users not going to a malicious Web site or not opening an e-mail attachment."

Dealing with Lesser Threats

These client-side vulnerabilities also contain a host of lesser threats, said Oliver Friedrichs, director of Symantec Security Response.

A malicious Web site can easily install crimeware, spyware or adware on a visitor's PC.

So, the Microsoft security update focuses on four main areas: the Internet Explorer web browser, Outlook Express, PowerPoint, and Windows Media Player.

Many of these vulnerabilities can execute without a user even opening the infected file, so Symantec recommended that IT administrators should implement their top security practices, back up sensitive data, and remind users to avoid opening unexpected e-mail attachments or following Web links from unknown sources.

Likewise, consumers should run Windows Update and install all the latest security updates, and use security software, Symantec said.