Microsoft recommends IT admins apply all of the security updates as soon as possible. Redmond prioritized MS12-071, which addresses vulnerabilities in Internet Explorer, and MS12-075, which fixes issues in Windows Kernal-Mode Driver.

"We are committed to improving the security of all our products," said Dave Forstrom, director of Trustworthy Computing at Microsoft. "When security updates are released, customers who have Automatic Updates enabled will be protected automatically and do not need to take an action."

First Things First

We turned to Andrew Storms, director of security operations at nCircle, to get his take on November's Patch Tuesday. He agreed that the priority is the drive-by exploit affecting Internet Explorer 9.

"It's fairly obvious that Microsoft patched this bug in IE10 before its release. Otherwise, we would have a bulletin affecting both IE9 and IE10," Storms told us.

The second bug on his list is MS12-075. One of the bugs in this bulletin affects TrueType fonts and creates a theoretical exploit vector with third-party browsers. Storms recommended patching this one immediately after the IE9 bug.

"The .NET bug that looked problematic in last week's advanced notification is not as serious as it could have been. The remote exploit of this bug is complex; it's going to be difficult for most attackers to use," Storms said. "This is the kind of bug that is a popular tool for pen testers with local network access to show off possible attack vectors, so you should definitely patch it sooner rather than later."

IT Lockdown

Despite the release of Windows 8 in late October, Storms noted that three of Tuesday's bulletins already affect it. Much of the core operating system is reused from version to version, even in new releases, and all software has bugs, he explained. These factors, combined with security researchers that love to find and report bugs in the latest software version, he said, are reasons for the number of bulletins for Windows 8. This should surprise no one.

"Many financial and retail organizations go into IT 'lock-down' for the last few months of the year. They don't want to introduce any changes that may impact their ability to process transactions during the holiday shopping season," Storms said. "It's likely that none of today's patches will be applied to the server infrastructure of these organizations, so Microsoft's comprehensive mitigation advice is critical. It allows these organizations to mitigate the security risk without compromising downtime."

Tyler Reguly, technical manager of security research and development at nCircle, said there's really nothing to talk about with regard to Windows 8 and Server 2012. As he sees it, if you're looking for an operating system without vulnerabilities, you might as well check the end of the rainbow for a pot of gold or try to catch a unicorn.

"Microsoft's recent actions with Flash in IE10 surprised me. I've always felt Security Advisories were the geekier communication mechanism and Security Bulletins were meant for a wider audience," Reguly said. "Yet, they've made the decision to go with Security Advisories only for Flash updates, a divergence from the approach they took when XP shipped with Flash built-in."