A day after the release of patches for 21 Microsoft vulnerabilities, attack code has appeared on the internet, according to warnings from security firms.
Most of the exploits target flaws that were previously known but were patched only as part of Microsoft's June monthly security update, released this week. But at least two publicly available exploits are directed at newly disclosed flaws in the company's products.
"Exploit code had already existed for three of the vulnerabilities prior to Tuesday, as they were already public issues," said Michael Sutton, director of VeriSign's iDefense Labs. "Beyond that, we're seeing public exploit code emerge for some of the new vulnerabilities and are hearing rumors of private code existing for others."
The availability of such exploits heightens the risk for companies that have not yet been able to patch their systems and are important factors to consider when deciding which systems to patch first, he said.
"We believe that it is far more beneficial to withhold proof-of-concept code for an amount of time so that customers can get the vulnerabilities patched," said Stephen Toulouse, security program manager at Microsoft's security response centre. "The public broadcasting of code so quickly after a bulletin release, we believe, tends to help attackers."
Microsoft is telling its customers to pay special attention to three key updates - MS06-021, MS06-022 and MS06-023 - because the vulnerabilities they patch could be particularly easy to exploit using Internet Explorer. "There are methods by which if you just browse to a website, there could be code execution," Toulouse said.
According to iDefense, some form of exploit code is publicly available against the cross-domain information disclosure vulnerability described in bulletins MS06-021, the address bar spoofing flaw in MS06-021 and the Word malformed object pointer vulnerability described in MS06-027.
All three were previously known flaws and were given a severity rating of "critical" by Microsoft.