Microsoft Issues Five New Security Warnings

smelroy writes "Microsoft on Wednesday issued security bulletins for five new software vulnerabilities, including a flaw in Visual Basic for Applications that the company rated as critical. The company has posted patches for each of the flaws on its Web site. Four of the problems affect Microsoft's Office desktop software. You can read the story here and the security bulletins here."

Comments

critical VBA flaw

[b17bmbr]

wouldn't ANY vba flaw be critical. if i recall correctly, through vba, you can manipulate the entire file system. while it doesn't give you low level access, it has access to every COM object on your system. in fact, weren't the code red and i love you virii (and many others) written in VBA. VBA seems to be such a big reason that businesses can't move away from windows/office. to me, it seems like a reason TO move away from office.

Re:critical VBA flaw

[mforbes]

OpenOffice and StarOffice also having built-in scripting languages. Perhaps the risks of buffer overruns aren't as common under those (I don't know, since I lack much experience with those scripting languages), but in all fairness to MS, if OpenOffice were the leading suite & de facto standard, it would also see many attacks. The problem in this case isn't that the flaw exists-- patches are easy enough to apply. It's that with the near-monopoly MS has over hundreds of millions of users, you can always guarantee some large subset of users won't have the patches installed, and thus will be vulnerable to attack.

Doesn't make any sense..

[euxneks]

It doesn't make any sense for a company to keep building something that requires a patch every few days. Are they actually making money off of these patches?

It's just that I've never heard of anything so blatantly broken that is so successful.

Maybe I'm just angry because some scumware got into my computer system.

Finally! They're fixing the bugs

[192939495969798999]

When we get more like 50 of these a week, then we'll know that they've really gotten serious. Large systems have a lot of holes in them -- especially when no one was plugging the holes for oh, 10 years or so.

Re:Snapshot Viewer affected?

[nairnr]

Kinda makes you yearn for thin clients again... Make a few changes that affect all users. It seems to be something that would start making some sense again, with the number of times that systems are affected in a coporate environment, a more centralized server system does have its advantages. It would be interesting if this frequent patch cycle is affecting how people deploy large scale systems.

Ah, X-servers :-)

Re:what % of Windows is patches?

[n3rd]

And how long until the entire operating system, and all the Microsoft applications, are all just patches?

Interesting? Come on.

Linux was released. Then patched. Then patched again. And again until it became what it is today.

Apache web server anyone?

Latest Debian gnu/Linux seccurity warnings!

[Anonymous Coward]

[29 Aug 2003] DSA-375 node - buffer overflow, format string
[26 Aug 2003] DSA-374 libpam-smb - buffer overflow
[26 Aug 2003] DSA-344 unzip - directory traversal (new revision)
[18 Aug 2003] DSA-364 man-db - buffer overflows, arbitrary command execution (new revision)
[16 Aug 2003] DSA-373 autorespond - buffer overflow
[16 Aug 2003] DSA-372 netris - buffer overflow
[13 Aug 2003] DSA-358 linux-kernel-2.4.18 - several vulnerabilities (new revision)
[11 Aug 2003] DSA-371 perl - cross-site scripting
[09 Aug 2003] DSA-361 kdelibs, kdelibs-crypto - several vulnerabilities (new revision)
[08 Aug 2003] DSA-370 pam-pgsql - format string
[08 Aug 2003] DSA-369 zblast - buffer overflow
[08 Aug 2003] DSA-368 xpcd - buffer overflow
[08 Aug 2003] DSA-367 xtokkaetama - buffer overflow

Stop calling the kettle black! Fix your own problems. This stuff wouldn't happen if Debian didn't use out of date software, as most of the flaws mentioned were fixed in the new versions!

Re:Latest Debian gnu/Linux seccurity warnings!

[akiaki007]

The only one that *truely* affects Debian here is the kernel bugs. Everything else is software and shouldn't be considered that.

The MS bugs pertain to the MS release software that directly affect the OS and the Office suite. And I would only really consider the VBA and the OS security bulletins here as being that important as that is what affects Windows. So that's 2.

For debian we have 1. The rest are other software! If I wanted to talk about bugs with every piece of software being used in Windows, then let's do that. But clearly you're not.

Stop comparing apples to oranges.

Slashdot just loves MS security bulletins

[Anonymous Coward]

What's the big deal here? Microsoft finds a flaw, issues the patches, get coverage from slashdot.

Things that happen all the time with unix/linux OS and apps.

Don't be mistaken, i ain't pro-Microsoft. I just think that slashdot is often bashing MS products for no reason. Their ideology is bad. The world domination plan is bad. But i'm tired of "hardcore" unix/C fanatics that dismisses .NET without any knowledge of it.

Whining and moaning everytime they issue a security warning is just plain childish...oh wait this is slashdot

Re:Slashdot just loves MS security bulletins

[akiaki007]

I use .Net. And I won't dismiss it. But all the bugs are really annoying. Some seem small. For instance, you can't use customized MenuItems in a ContextMenu in a NotifyIcon. That's quite useful if you think about it. If you want a simple application that runs a lot of other programs and processes in your company, it would make sense to use a NotifyIcon application. But every menu (no images allowed here) looks exactly the same. It would be very helpful to have icons and colours. but you can't. This is just one bug. There are quite a few, even within the compilers.

I'm not dismissing it completely, but .Net released by MS is still very much a beta. Even at the 1.1 level.

Every bit helps

[Doesn't_Comment_Code]

I hope this wins some more business and government contracts for non-Windows based systems.

Windows is ok for some applications. But this sort of thing (actually a whole month of bad security press) should jar a lot of decision makers to recognize that MS is not the ONLY REAL OS OUT THERE, as there marketing strategy has led all non-tech inclined business execs to beleive.

The Truth will set you free.

It's funny to laugh at Microsoft...

[Osrin]

... but we should really be debating how we get this right on an OSS platform. If I put RedHat9 next to Windows Server 2003 I have significantly more updates to apply to my Linux box.

This is a community of smart people, the race is on to figure out how to best solve this issue for our end users. Microsoft appears to be beating us by requiring far less updates to be applied than a randomly chosed Linux distro.

We need to think about the process of distribution and application of these patches, if we can get that right then we get a larger percentage of the desktop.

Today any undereducated end user who is judging security by the number of patches that jumps to a Linux distro because they've "heard" it is more secure will quickly be jumping back to Windows.

Re:It's funny to laugh at Microsoft...

[pmz]

Microsoft appears to be beating us by requiring far less updates to be applied than a randomly chosed Linux distro.

This is a fallacy, as Windows is closed source. Microsoft will fix only those bugs that are either publicly disclosed, mandated by some court case, or, sometimes, actually found internally by their undersized QA staff. So, of course, Microsoft will appear to have fewer patches. Also, have you considered that the maintainers of your randomly-chosen Linux distribution are actually honest and believe offering a patch is better policy than offering none to save face?

Open Source (open, transparent, honest)
Microsoft (closed, opaque, lying assholes)

Gee, who do we choose? Well, I guess we choose Microsoft, because they have fewer patches!

Re:It's funny to laugh at Microsoft...

[bogie]

"This is a community of smart people, the race is on to figure out how to best solve this issue for our end users. Microsoft appears to be beating us by requiring far less updates to be applied than a randomly chosed Linux distro."

A) Linux and its associative apps are opensource so your going to find more security flaws due to the nature of opensource. This is a GOOD thing.
B) The ratio of packages per "average" linux distro vs. say 2k server or 2k3 server is what? 15 to 1? So judging by that fact its surprising that Microsoft continues to have as many problems as they do. When comparing correctly there is no comparison, MS loses hands down.

"... but we should really be debating how we get this right on an OSS platform. If I put RedHat9 next to Windows Server 2003 I have significantly more updates to apply to my Linux box."

Any admin who actually knows how to use update and secure both linux and windows would say different. With Microsoft patches there is decent chance that the patch will not only not work and require a second patch, but also might hose your system. All those admins who get nailed by worms aren't just lazy. Many of them have been burned by MS patches and choose just not to use them.

Let's also not forget about huge mega patch service packs that you have to use which are somehow ignored in your "count". Forgot about those huh? How many patches do these monsters hold? Hundreds? At a minimum. And of course nobody's system EVER gets hosed by service packs....

How about those great new restrictive licensing terms which get forced down your throat just because you want to secure your box?

Lastly even though 2k3 is better about it, I'll also enjoy not having to reboot my system for a simple patch. Don't you think average downtime should be added into the equation?

I'll take Red Hat's or any other linux vendors patching system any day of the week thanks.

education and administration still the weak spot

[*weasel]

your box is only as secure as the person administering it.

and apparently, windows users, left to their own devices don't know, or don't care about keeping up to date on security patches.

although, when enough of them are willing to just go ahead and doubleclick on any attachment from an unknown sender (msblast), these kinda exploits aren't really even necessary.

all the tools for a secure windows box are already there.
(though a security-patch-only windowsupdate flavor would be very helpful).

Office Updates EXTREMELY Frustrating

[syntap]

I'm in a mixed environment where we have some Dells that came with Small Business Edition (either SR1 or original), and other users who needed Access that we purchased Office 2000 Pro for. Because Microsoft requires the original CD, it really adds to the burden of updating because you have to figure out which friggin' disc to use on each individual station. If they would just let us run the damn patch without the CD verification it would be easier.

Plus, their order of updates is fux0r3d. They have the spell checker update listed as more recent than SP2, but when I run it I get an error message that the update only runs on SP1 .

It's bad enough to need so many patches, but there are many basic things like the above that Microsoft could easily improve.

Re:And yet, look at my sig for Linux vulnerabiliti

[BurritoWarrior]

Good troll, but try coming back with an analysis of the actual severity of the holes.

I better hurry to run off and patch a hole in some obscure OSS app I don't have installed as opposed to the constant REMOTE ROOT EXPLOITS in the core Microsoft OS.

Wow, not ONE of them was for Linux

[finkployd]

Perhaps comparing all the security vulnerabilities for all software that could possibly run on Windows to this list would be SLIGHTLY more fair.

As it stands now you are comparing all open source applications to the Windows Oerating System.

So good job on attempting to call the Slashdot community on hyprocracy, unfortunatly you seem to be very confused about what Linux is and unable to make a valid comparison.

Finkployd

Hmm. Does this affect OEMs?

[gosand]

I just thought of something - what do companies like Dell do? They just sell the stock OS on their systems, right? Everyone always complains that people don't patch their systems, but what if you buy a new machine from Dell? I am sure people don't think "oh man, I have a new system, I need to go out and figure out which patches to install". They fire it up and go. Should OEMs be required to sell systems that are up to date on the OS patches?

And Office Update process is broken.

[Angostura]

a couple of points on this.

While I've just about managed to educate friends and familly about the need to run Windows Update, WU does not in itself warn of critical security issues - you have to remember to visit Office Update manually... and who is going to do that? No one, in my experience.

but it gets better - The Office Security updates require you to insert the original CD. This seems a mighty strange move, and not terribly useful for me since the CD is several thousand miles away locked up in a cupboard on the other side of the Atlantic.

Can anyone explain the warped logic here? I could understand it if the new patches enabled new functionality? but these are security patches.

Many hours will be lost patching Word.

[Futurepower(R)]

To patch the security vulnerabilities in Microsoft Word, you have to 1) download the patch, 2) find the original Word CD and put it in the CD drive, 3) run the patch, 4) wait while a lot of processing is done with the CD, and 5) put the CD away again. It seems to me that, since this was a patch for a severe security vulnerability, Microsoft could have skipped the time-consuming 2, 4, and 5 steps. Think how many total hours will be lost throughout the world by users or computer professionals whose time is extremely valuable. The TCO just went up.

Troll. Read the alerts/ Debian backports to stable

[The Revolutionary]

First, realize that these security alerts arise from a set of over 8710 packages. This is an incredibly large base of software, the great majority of which you will not have installed, and certainly not have installed in a production environment.

Second, did you even bother to read those security alerts or investigate what the packages are? Briefly:

node: "Amateur Packet Radio Node program"

libpam-smb: arbitrary code, but no privilege escalation

unzip: no privilege escalation, no arbitrary code, and who uses it?

man-db: only if you go against install-time advice and make it setuid

autorespond: "This vulnerability is currently not believed to be exploitable due to incidental limits on the length of the problematic input, but there may be situations in which these limits do not apply."

netris: "A free, networked version of T*tris"

linux-kernel-2.4.18: most are local only, "STP protocol", or an nfs3 DOS with no arbitrary code or remote root

perl: yes, "execute arbitrary web script within the context of the generated page"

kdelibs: konqueror only, client only

pam-pgsql: arbitrary code, but no privilege escalation

zblast: "shoot 'em up space game"

xpcd: local only

xtokkaetama: local only

"This stuff wouldn't happen if Debian didn't use out of date software, as most of the flaws mentioned were fixed in the new versions!"

And this is why I call troll.

From Debian security FAQ:
"The most important guideline when making a new package that fixes a security problem is to make as few changes as possible. Our users and developers are relying on the exact behaviour of a release once it is made, so any change we make can possibly break someone's system. This is especially true in case of libraries: make sure you never change the Application Program Interface (API) or Application Binary Interface (ABI), no matter how small the change is.

This means that moving to a new upstream version is not a good solution, instead the relevant changes should be backported. Generally upstream maintainers are willing to help if needed, if not the Debian security team might be able to help.

In some cases it is not possible to backport a security fix, for example when large amounts of source code need to be modified or rewritten. If that happens it might be necessary to move to a new upstream version, but this has to be coordinated with the security team beforehand."