The software giant released a cumulative patch for Internet Explorer that fixes several vulnerabilities previously disclosed by the company, and it re-released an advisory for Microsoft's SQL Server software, warning that a flaw in that program actually affects most Windows users.
Users who don't patch their systems could leave the computers open to attack through a fake Web page or an HTML e-mail that contains the specific exploit code, said Stephen Toulouse, security program manager for Microsoft's security response centre.
"The Internet Explorer bulletin is rated as 'critical' across all platforms except Windows 2003," Toulouse said. A critical rating is the highest grade that Microsoft assigns to its alerts. The flaws were rated 'moderate'--the second-lowest grade--for Windows 2003, the latest version of the operating system.
On Wednesday, security-software maker Symantec said that MSBlast, a worm that takes advantage of a month-old vulnerability in Microsoft's OS, had infected almost 700,000 computers. A variant of the worm, MSBlast.D or Nachi, had infected more than 525,000 computers since it began to spread on Monday.
Although critical, the latest vulnerabilities are far less likely to become fodder for a worm writer because a victim would have to go to an attacker-owned Web page to be attacked.
The Internet Explorer vulnerabilities involve the fact that the software doesn't check the type of an object returned from a Web server and because a flaw exists in the browser's cross-domain security model, Microsoft stated in its advisory.
The other critical vulnerability affects all supported versions of Windows and was originally thought to be a vulnerability in Microsoft's SQL Server but is, in fact, a flaw in the omnipresent Microsoft data access component (MDAC). Windows 2003 doesn't have the vulnerable software installed by default, but a user could have downloaded the programs and so could be vulnerable.
Microsoft's Toulouse pointed out the silver lining in the latest vulnerabilities: The flaws affected Windows 2003 to a lesser degree.
"I think it is an observable bit of progress for Trustworthy Computing," Toulouse said. "The default settings of the operating system are more secure."
These warnings arrive overnight via an SMS message.
People interested in signing up for MS business-critical Level 1 Security Alerts should sign up here:
http://members.microsoft.com/australia/technet/lounge/alerts/