News

Microsoft Releases Patches for a Raft of Critical Vulnerabilities

• By Scott Bekker
• April 13, 2004

Microsoft on Tuesday had its biggest patch release day since instituting its monthly patching cycle in October, addressing 20 security vulnerabilities in several versions of Windows. Eight of the flaws represented critical security problems.

It was one of the largest bug fixing events by Microsoft in recent memory outside of a service pack or security rollup patch.

In all Microsoft released four security bulletins. Three were rated "critical" bulletins, and the other bulletin is rated "important," which is the level below critical. Affected operating systems included Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Windows 98, Windows 98 SE and Windows ME.

The blockbuster of the bunch was MS04-011, which included fixes for 14 individual security flaws. Six of those flaws were individually rated critical for one version of Windows or another. Windows Server 2003, which is locked down by default and was reviewed line-by-line for security before shipping, came through slightly less scathed. Only three of the vulnerabilities in MS04-011 were critical for Windows Server 2003, compared to five each for Windows XP and Windows 2000. For Windows NT 4.0 too, only three of the vulnerabilities were critical.

The bulletin can be found here:
www.microsoft.com/technet/security/bulletin/MS04-011.mspx.

The other critical bulletins are MS04-012, which contains patches for four flaws, one critical, and MS04-013, which contains a patch for one flaw, which is critical. Another patch, MS04-014, has a patch for one non-critical flaw.

Microsoft has a single page with information on all four bulletins here:
www.microsoft.com/security/security_bulletins/200404_windows.asp.