While Bill Gates and Steve Ballmer announce us (again…) that Vista might not appear in January 2007, Windows XP is getting its usual monthly fixes.

On Wednesday, the Redmond software giant announced new patches for at least seven flaws discovered in its flagship products, Windows XP and the Office suite. Among the patches, five are considered critical, and the rest are less severe. Two of the vulnerabilities are said to affect the server side.

Windows Server Service is vulnerable to hackers who might execute remotely a malicious code on infected systems. The other critical server flaw involves the Window Dynamic Host Configuration Protocol Client Service. It, too, could result in remote code execution, according to Microsoft.

“DHCP is a communication protocol that allows administrators to centrally manage and automate the assignment of Internet Protocol (IP) addresses in an organization’s network,” security vendor Symantec Corp. said in an advisory after the updates were announced.

“Therefore, one compromised system could affect other systems connected to it on the same physical network,” the advisory said, adding that users of Windows 2000, Windows XP and Windows Server 2003 may be affected by the flaw.

Other vulnerabilities fixed by the new updates address Microsoft Excel and the Office suite. The third critical client-side update details fixes for two holes in Microsoft Office Filter that could allow attackers to remote-compromise vulnerable systems. Products affected by the Office vulnerabilities actually include the entire range, plus some that affect just Project, Visio, Works and Visual Studio.

Easily the most serious of the flaws disclosed today is the one affecting the Server Service, said Mike Murray, director of vulnerability research at nCircle Network Security Inc., a security vendor based in San Francisco. The service basically allows computers to communicate with each other. The flaw allows attackers to potentially send malformed communications over Ports 455 or 139 and lets them take complete control of vulnerable systems, he said.

According to Murray, the DHCP flaw is also serious, but requires the attacker to be on the same network as the vulnerable system.
Meanwhile, today’s updates provide another indication of growing client-side security threats, said Amol Sarwate, manager of vulnerability management at Qualys Inc., a managed security service provider in Redwood Shores, Calif.

“This trend of client side vulnerabilities — where attackers are creating malformed image files or Excel files that are sent to users via e-mail or hosted on Web sites — has been increasing” since the beginning of this year he said.

The world’s biggest software maker defines a flaw as “critical” when the vulnerability could allow a damaging internet worm to replicate without the user doing anything to the machine.

Meanwhile, Bill Gates announces in South Africa that Windows Vista, the OS everyone hopes to find a whole lot more secure than XP, has 80% chances to hit the established release date in January 2007. If not, well, it will be delayed again… “We got to get this absolutely right,” Bill Gates said at the conference. “If the feedback from the beta tests shows it is not ready for prime time, I’d be glad to delay it.” Can you believe that Vista will hit the stores’ shelves next year, when Office 2007 has already been delayed at the beginning of this month? I think Ballmer and Gates are just preparing us for what we already know: Vista is “off track�? (I cited Steve Ballmer who said at a conference in Japan at the end of May that “Vista is on track�?, when the first rumors about another delay of Vista came out). Not to mention the fact that Vista and Office 2007 were scheduled for simultaneous launch…

I really don’t know if anyone at the Worldwide Partner Conference, held by Microsoft on Tuesday in Boston, believed Steve Ballmer when he said: “We’re going to put massive effort into launching these products … at the consumer level as well as at the business level,” referring of course to Windows Vista and Office 2007, but also to products launched under the Live! brand, like Windows Live Messenger.

Jupiter Research analyst Joe Wilcox said he sees the possibility of further delays, which could erode confidence in the company among its partners.

“How much confidence does it instill when the chairman of the company says 80 percent?” Wilcox said.