Mixed signals came from the Redmond giant as it posted the January patch. While the patch consisted of only one security bulletin, there were two somewhat opposing remarks regarding the security flaw, drawing analysts’ attention and criticisms.

The MS09-001 security patch release informs users that the vulnerability has been labeled by Windows as being “critical”, the more descriptive exploitability index shows that the security flaw presents little risks, as “functioning exploit code (is) unlikely.”

In the January patch, Microsoft describes the security flaw as being “critical” for systems running Microsoft Windows 2000, Windows XP and Windows Server 2003. On the other hand, it seems that Windows Vista and Windows Server 2008 present “medium” risk to the threat, according to the security bulletin.

Director of security operations at nCircle, Andrew Storms, stated that it may be more appropriate to classify the security flaw as a big system risk, as it comes from the network, it uses the Microsoft Server Message Block Protocol (SMB) and it acts without no authentication.

Eric Schultze from Shavlik Technologies stated that a virus that uses this flaw could do as much damage and spread as quickly as the worms Blaster and Sasser.

Although Microsoft provided mixed views over the threat level of the vulnerability, most analysts recommend that server administrators should update their machines right away, as there are great chances that a malicious code written for this specific flaw will appear soon.