Microsoft delivers five September patches

Windows users are advised to update their systems as soon as possible

Microsoft has released the September edition of its monthly security update, containing five security bulletins addressing eight vulnerabilities.

Each of the five bulletins has been rated 'critical' and, if exploited, could allow an attacker to remotely execute code on a target system. The bulletins all address components of Windows, and include vulnerabilities in the Jscript scripting tool, Windows Media Format tool, DHTML ActiveX control, WirelessLan AutoConfig and TCP/IP software.

Microsoft has not included a fix for the recently-disclosed flaws in IIS, however, claiming that it is still working on a patch.

While the update addresses critical flaws in all currently supported versions of Windows, Microsoft said that Windows 7 and Windows Server 2008 R2 will not need to be patched.

Dave Marcus, director of research and communications at McAfee Avert Labs, said that the September patch should be applied as soon as possible owing to the high risk posed by the Wireless Lan AutoConfig and TCP/IP vulnerabilities.

"These vulnerabilities are the most likely to be exploited by malicious code, and are two of the best worm candidates we've seen since Conficker," he explained.

"That said, all of today's security bulletins address vulnerabilities that could allow an attacker to take complete control of a vulnerable PC."