Network World — A day after Microsoft released 13 patches to address a Pandora’s Box of 34 vulnerabilities the big question now is where IT should start.

Experts in the security field said the focus should be on the end-user and IT should first patch holes in Internet Explorer (IE) and in Windows Graphics Device Interface (GDI).

Those two technologies are addressed in MS09-054 (IE) and MS09-062 (GDI), which were two of the patches released Tuesday. The patches ran in number from MS09-050 to MS09-062.

And if that was not enough for IT, Microsoft also re-issued a critical patch – MS08-069 – to protect Windows 7 and Windows Server 2008 from a vulnerability in XML Core Services.

“The reason I am looking at IE and GDI is that they affect the user experience,” said Jason Miller, security and data team manager at Shavlik Technologies. “If I am an admin on a network I need to protect all my assets, but I need to pay attention to which ones are the most likely to be exploited in the wild first. IE is pretty obvious. The majority of the user base has IE and all you need to do is navigate to a malicious web site in order to get remote code execution. In other words drop down some Trojans and viruses on your machine and create a huge mess.”

The IE vulnerability was first disclosed at the Black Hat conference in July. In addition to IE, Firefox also can be vulnerable to the exploit when it is running the Windows Presentation Foundation plug-in, which gets installed via .Net Framework Service Pack 1.

The GDI vulnerability also has the potential to create havoc given that it is found in image formats that are on nearly every web site and embedded in on line advertising. Users only need to visit those Web sites to become infected. The vulnerability affects software such as Windows, Office, SQL Server and Forefront.

“GDI is good to address quickly because it touches so many products, including Silverlight,” says Wolfgang Kandek, CTO at Qualys.

Both the IE and GDI vulnerabilities received a “1” on Microsoft’s Exploitability Index, meaning that consistent exploit code is likely.

Josh Abraham, security researcher at Rapid7, advised users that have deployed Vista or Windows Server 2008 R2 to get MS09-050 deployed immediately.

“This is the highly anticipated patch for the SMB v.2 issue, affecting Vista and Server 2008. While previous vulnerability databases have listed it as a denial of service, today’s update confirms what the folks at Metasploit have been saying: it’s remote code execution,” said Abraham.

Both Kandek and Miller played down the two zero-day exploits that were addressed in the Patch Tuesday release.

“We still have not seen a lot of reports on those that being abused by attackers,” said Kandek. “Probably because the attacked OS (Vista) is not widely deployed. But if you have Vista you should definitely patch it.”

Miller said this record Patch Tuesday adds up to one big fright for IT. “With 13 bulletins and hundreds of patches for each one, this is a wee bit of a nightmare.”