Earlier today, Microsoft did something unusual. The company made an exception to its normal security processes and issued an “out-of-band” urgent update. The update applied is classified as critical for Windows XP and older versions and is considered important for Windows Vista.
After speaking with Microsoft earlier today, I strongly suggest that users understand the importance of this update and begin emergency patching procedures immediately. While exploits around this Windows vulnerability have been limited thus far, Microsoft concedes that it could be exploited by old-school Internet-based worms a la 2004 and do massive amounts of damage. In addition to patching Windows systems, I also encourage users to install the latest security signatures from endpoint and network security vendors.
Microsoft’s “out-of-band” reaction speaks to the seriousness of this threat, but I can’t help but be impressed with the behind-the-scenes effort that led to this action. It is noteworthy to point out a few things:
I did a post a few days ago about Microsoft’s security patch, do check it out and evaluate if it’s something that affects your infrastructure. Remember that applying the security patches/hot fixes is the first thing your service provider/vendor will ask when logging a call, and that applying the security patches is the cost of doing business, keeping in line with vendor support.