Although Sarwate of Qualys echoed Storms -- "it is a little confusing," he said, referring to the information about Jet Database in the Word bulletin -- he said fixing it on Windows' end was not only the most important part of the exploit chain to patch, but the only patch really necessary.

MS08-026 patches a pair of critical bugs in how Word and Outlook render RTF (rich text format) files and documents with Cascading Style Sheets (CSS). Microsoft pegged the flaws as critical in Word 2000 and Outlook 2007, and "important" -- the second-highest threat rating in the company's four-step system -- in Word 2002, 2003 and 2007, as well as in the versions of Word included with Office 2004 for Mac and Office 2008 for Mac.

Another bulletin, MS08-027, patches a vulnerability in several versions of Microsoft Publisher, the company's consumer- and small business-grade desktop publishing program. Although Microsoft designated the fix as critical, Sarwate downplayed the patch as nothing new. "This is just another of the kind we've seen in the past year where client-side applications are being targeted," he said.

The fourth security update, however, caught both Sarwate's and Storms' attention. MS08-029 quashes two bugs in Microsoft's anti-malware scanning engine, which is used by a whole host of Microsoft security apps, including Windows Live OneCare, Microsoft Antigen, Windows Defender and Microsoft's Forefont line.

Sarwate disagreed with Microsoft's "moderate" ranking of the two bugs. "That may work for the immediate consequences, but if you think of the impact of closing down your anti-virus, you're basically exposing yourself to viruses and all sorts of bad stuff," he said. "I think it should have been at least one level up, to 'important'," said Sarwate.

Storms also noted that it was possible that an attack aimed at Microsoft's vulnerable security products could make a system, a server, for example, unbootable.

"One of the two vulnerabilities talks about 'disk space exhaustion'," said Storms. "When an anti-virus scanner scans a file, it usually creates a temp file in a safe zone and scans it there. This bug could cause the scanner to open so many temp files that it would exhaust the available disk space. That makes this a little more interesting than Microsoft says, because if the system doesn't clean itself up as it crashes, [the attack] could render the machine unbootable."

Sarwate also reminded users that Microsoft didn't deliver on one expected patch. "Last month, on April 17, Microsoft issued an advisory that talked about a zero-day it called an elevation of privilege bug," said Sarwate.

Almost a month ago, Microsoft warned of a bug that could give attackers significantly greater access to Windows XP Professional SP2, and all versions of Windows Server 2003, Windows Vista and Windows Server 2008. The flaw could be exploited through custom Web applications running in Microsoft's Web server, Internet Information Services (IIS), or via SQL Server, added Microsoft.

May's security updates can be downloaded and installed via the Microsoft Update and Windows Update services, as well as through Windows Server Update Services.