Microsoft’s batch of security patches for March is one of the largest ever and includes fixes for several vulnerabilities that are publicly known and actively exploited.
The company published 17 security bulletins covering 135 vulnerabilities in its own products and one separate bulletin for Flash Player, which has its security patches distributed through Windows Update. Nine bulletins are rated critical and nine are rated as important.
The affected products include Windows, Internet Explorer, Microsoft Edge, Microsoft Office, Exchange, Skype for Business, Microsoft Lync, and Silverlight.
The highest priority should be given to the MS17-013 security bulletin, which addresses remote code execution, privilege escalation, and information disclosure flaws in the Windows Graphics Component, Graphics Device Interface (GDI), and Color Management. These vulnerabilities affect Windows, Office, Skype, Lync, and Silverlight.
The remote code execution flaws can be exploited by tricking users into opening a specially crafted website or document. What’s worse is that one of the vulnerabilities is publicly known and another is already actively exploited.
Another important bulletin is MS17-012, which fixes a vulnerability in the Windows SMB network file-sharing protocol that has been publicly disclosed over a month ago.
The MS17-006 and MS17-007 bulletins for Microsoft Edge and Internet Explorer also contain vulnerabilities that have been publicly disclosed, including a critical remote code execution one.
On the server side, the Microsoft Exchange and IIS bulletins, MS17-015 and MS17-016, should be prioritized because these systems are typically exposed to the internet. Server administrators should also direct their attention to the bulletins for Hyper-V virtualization (MS17-008) and Active Directory Federation Server (MS17-019).
“Overall, it’s going to be very busy for IT departments of all sizes due to the large number of desktop and server patches,” Amol Sarwate, director of Vulnerability Labs at security vendor Qualys, said in a blog post.
The high number of patches in this release are because Microsoft decided to postpone by a month the security updates it had originally scheduled for February. This unprecedented decision was taken due to an unspecified last-minute issue and was criticized by some researchers, especially since there were a number of publicly known flaws.
Also, it seems that Microsoft has backtracked on its plan to stop organizing patch information into security bulletins, at least for this month. The company had planned to stop using bulletins in favor of a new portal called the Security Updates Guide.