Microsoft Issues Five New Security Warnings

smelroy writes "Microsoft on Wednesday issued security bulletins for five new software vulnerabilities, including a flaw in Visual Basic for Applications that the company rated as critical. The company has posted patches for each of the flaws on its Web site. Four of the problems affect Microsoft's Office desktop software. You can read the story here and the security bulletins here."

Comments

deja vu

[Anonymous Coward]

i'm having this funny feeling of deja vu...

Re:deja vu

[Anonymous Coward]

Could this be a glitch in the Matrix?

Re:deja vu

[Winterblink]

*draws dual 9mms* It's a glitch in the Matrix. It happens when they patch something.

Re:deja vu

[KDan]

If only they could actually wall all the Windows... maybe the worms wouldn't get in anymore.

Daniel

Re:deja vu

[Anonymous Coward]

Re:deja vu (Score:0)
by Anonymous Coward on Thursday September 04, @10:11AM (#6868436)
Could this be a glitch in the Matrix?

Re:deja vu (Score:2)
by Winterblink (575267) on Thursday September 04, @10:11AM (#6868444)
*draws dual 9mms* It's a glitch in the Matrix. It happens when they patch something.

Two identical posts at the exact same time. Now that *has* to be a glitch in the Matrix!

Re:deja vu

[mschoolbus]

Deja Vu? Why do you get feelings of a strip club with this M$ security story?

Re:deja vu

[EvilTwinSkippy]

Was it 2 patches, or the same patch twice?

Re:deja vu

[RLW]

documentary style music.
Voice over: It's the wheel of glitches.

Location: M$aFT glitch preserve.

M$aFT Tour Guide: The life cycle of the glitch is an often fast and furrious one, many only living for a few short days upto a few months typically. Although on some low exposure less used systems they may obtain a Methuselahn life span of a several years.
slight pause
Tour Guide Continues: Here at the M$aFT glitch preserve we try to breed and raise our glitches for survival in the wild.

Interupting Guide Tour member: Why do you breed and raise glitchtes anyway? Aren't there enough bugs in the wild already. I mean ...

Cutting off the Tour member Tour Guide: They are glitches, not bugs. As far as the number of glitches in the wild each glitch performs important ecological functions. There are some that encourage users to upgrade their Office packages, there are others that spark the need to upgrade development IDEs and there are others still that motivate upgrades to new versions of our glitch preserve, uh, I mean OS.

Re:deja vu

[MarkGriz]

Linus, I need an exit... fast!

Re:deja vu

[syle]

Because like a strip club, Microsoft shows you a good time, but eventually leaves you to go home depressed, penniless, and unsatisfied.

Re:deja vu

[Aliencow]

No, they are glitches in Windows, Office and IE!

Re:deja vu

[chocochip]

You forgot...

and very likely leaves you infected with a virus.

Had me confused for a second

[greechneb]

The most serious of the flaws could let an attacker execute code from an open Office application.

Confused me because I couldn't figure out why Microsoft was releasing bug reports for openoffice. (Aside from the obvious conspiracy theory that Microsoft would be trying to make the competition look bad)

Re:Had me confused for a second

[LrdHlmt]

Should have used running Office application. I went WTF the first time a read it.

what % of Windows is patches?

[feed_those_kitties]

And how long until the entire operating system, and all the Microsoft applications, are all just patches?

There comes to a point where you just can't patch things anymore, and it's time to start over new. And, hopefully get it right this time!

Re:what % of Windows is patches?

[tsetem]

Oh man, is this history repeating itself?

Will the next version of Windows be called
* MS Apache?
* Apache OS?
* WinApache?

(For those of you who don't know, Apache Webserver was called that because originally it was A-Patchy Server)

Re:what % of Windows is patches?

[n3rd]

And how long until the entire operating system, and all the Microsoft applications, are all just patches?

Interesting? Come on.

Linux was released. Then patched. Then patched again. And again until it became what it is today.

Apache web server anyone?

Re:what % of Windows is patches?

[Doesn't_Comment_Code]

And how long until the entire operating system, and all the Microsoft applications, are all just patches?

It should be a lot easier to pirate a copy of Windows when you can reconstruct the entire operating system by downloading patches directly from MS, and piecing them together like legos.

Re:what % of Windows is patches?

[Sun Tzu]

The difference between Linux and Windows that the original poster was obviously referring to is this:

Linux consists of 99%+ functionality patches

Windows consists of 182%+(*) security patches, many of which, unfortunately, have security issues

(*) Totals exceed 100% due to previous patches getting patched for new security issues.
--
Send us your Linux programming articles

Re:what % of Windows is patches?

[kryptobiotic]

Isn't it funny that apache.org has 2 separate theories on the origin of the name and both are considered correct. One would think that the group that came up with the name should be able to keep track of the truth about where it came from. Must be that the person that wrote the timeline never read the FAQ.

According to this, the server was named after the Apache indians and the " A patchy server" is just a cute coincidence.

Re:what % of Windows is patches?

[brkello]

Oh come on, at lease be fair. I can't believe you are modded insightful....I'd say funny. If you think linux patches are all functionality, then you don't work with Linux. The real difference between linux and windows is that you have a 99.9% better chance of getting modded up if you bash Microsoft patches than if you were to say something truly interesting.

Re:what % of Windows is patches?

[gmuslera]

Maybe MummyOS, by this time you don't see any skin, is all patches and bandages.

Re:what % of Windows is patches?

[toddestan]

Yeah, but where are you going to get old, unpatched and nonupdated, Windows 3.1 code that still lurks in the heart of Windows XP?

Same old

[L-s-L69]

Same old sh*t, different day. Other than alerting admins who really should know this is there a reason for having it on the front page?

critical VBA flaw

[b17bmbr]

wouldn't ANY vba flaw be critical. if i recall correctly, through vba, you can manipulate the entire file system. while it doesn't give you low level access, it has access to every COM object on your system. in fact, weren't the code red and i love you virii (and many others) written in VBA. VBA seems to be such a big reason that businesses can't move away from windows/office. to me, it seems like a reason TO move away from office.

Re:critical VBA flaw

[mforbes]

OpenOffice and StarOffice also having built-in scripting languages. Perhaps the risks of buffer overruns aren't as common under those (I don't know, since I lack much experience with those scripting languages), but in all fairness to MS, if OpenOffice were the leading suite & de facto standard, it would also see many attacks. The problem in this case isn't that the flaw exists-- patches are easy enough to apply. It's that with the near-monopoly MS has over hundreds of millions of users, you can always guarantee some large subset of users won't have the patches installed, and thus will be vulnerable to attack.

Re:critical VBA flaw

[Surak]

Speaking as someone who has written full-blown applications in VBA, OOo and StarOffice use StarBasic, which isn't quite the same thing as VBA. VBA is a lot more at the system level and gives you more control over the machine.

Re:critical VBA flaw

[ScrewMaster]

You might see more, but Microsoft still hasn't grasped the sandbox principle: any code that isn't explicitly trusted should not be allowed to access any data or functionality outside a strictly limited area. It can play all it wants inside that sandbox, but won't be allowed out to do harm. ActiveX and COM are two of the most dangerous Microsoft inventions from a security standpoint, since they don't place enough restrictions on what a remote programmer can do with your machine.

Re:critical VBA flaw

[Surak]

Well, *mostly* that's true. However, it can call other procceses which may or may not be priveleged. Remember that the COM/DCOM stuff runs with admin privs.

Re:critical VBA flaw

[pixelgeek]

-- if OpenOffice were the leading suite & de
-- facto standard, it would also see many attacks.

This has nothing to do with the popularity of Windows or Office.

If the apps were secure and the OS didn't have gaping flaws that allowed people to write things like Sobig and Code Red then there wouldn't be an issue.

A secure and popular OS would not generate this many issues...the problem is that MS is a popular and dramatically unsecure OS.

Re:critical VBA flaw

[brlancer]

The problem in this case isn't that the flaw exists-- patches are easy enough to apply. It's that with the near-monopoly MS has over hundreds of millions of users, you can always guarantee some large subset of users won't have the patches installed, and thus will be vulnerable to attack.

This argument is debunked constantly.
Apache has a very dominant role as a webserver, but IIS has far more vulnerabilities with far greater reach.

From my vantage point, Unix systems would be far more advantageous to compromise because they are more often used for mission-critical apps in large corporations. However, Windows servers are more often cracked, despite the larger volume of *nix servers out there.

Microsoft is a target because:
a) They write buggy code which is not thoroughly tested before release and patches often create additional problems.
b) Their OS is not as easy to update remotely or in batch as *nix boxes are.
c) They patch individual vulnerabilties, not the underlying causes.
d) They write code with these ideals (in order):
ease of coding, ease of use, ability to upsell, functionality, security
e) They have no interest in writing solid and safe software, only in selling software.

They have put their profits above the safety of their customers. Imagine if you bought a refrigerator that required an hour of maintenance a week; now imagine you are your grandmother and you own that refrigerator.

Sigh... it seems a day doesn't go by

[winkydink]

...without either e-mail from RedHat about a bug or news from MS about one. Lucky me, today I have both.

Microsoft Issues Five New Security Warnings

[Anonymous Coward]

1.SuSE

2.Red Hat

3.Mandrake

4.Debian

5.Gentoo

Snapshot Viewer affected?

[Karl Cocknozzle]

Crap! That means I have to touch every machine in the enterprise--again! Just two weeks after "touching 'em all" (not in the baseball sense) from the last round of worm patches.

How I long for the old days of Novell... Ah...take me away!

Re:Snapshot Viewer affected?

[nairnr]

Kinda makes you yearn for thin clients again... Make a few changes that affect all users. It seems to be something that would start making some sense again, with the number of times that systems are affected in a coporate environment, a more centralized server system does have its advantages. It would be interesting if this frequent patch cycle is affecting how people deploy large scale systems.

Ah, X-servers :-)

Re:Snapshot Viewer affected?

[nick this]

Sounds like what you are looking for is SUS. This will allow you to push security updates to your clients centrally.

Takes an afternoon to get set up and running, but after that, it runs with minimal intervention. Test your security updates, then authorize them to be distributed by the SUS server, and it takes care of the rest.

Of course, this assumes that you are running win2k or better on the client side. If not, you are stuck with logon scripting stuff for old machines. Not pretty. If you do have w2k or better, though, this is a huge timesaver. Works pretty good too. Those few that have already discovered it were able to stand on the sidelines, amused, as those who were trying to windows update machines one by one got eaten up by blaster.

Course, in fairness, there is another product that protects you from these kinds of worms, too... and it's sexy as hell.

Re:Snapshot Viewer affected?

[questionlp]

SUS focuses primarily on Windows Updates and not patches involving Office or other Microsoft server and client applications (since it pulls the updates from the same repository as windowsupdates.microsoft.com).

Instead, for Office applications, you would just need to update the administrative install points (which I'm doing now) and using a client management system (SMS, LANDesk, Group Policies, what have you) to run a batch file that points to the administrative install point for the version of Office installed on the client with the appropriate switches... it can be done completely quiet or showing progress.

Of course, the time it takes to update all of the different editions and versions of Office is still quite a bit... unless if you have a really, really fast machine with fast disk performance.

Re:Snapshot Viewer affected?

[nick this]

Yeah, mostly yup to all of that.

Definately standalone, hardware has to be reasonable, but my thought is that if the machine sits slammed all day while clients download updates from it, so much the better... network throttling. :)

Like all MS stuff, it's all balanced on a bigger and bigger pile of buggy stuff, so it's not surprising that some of it doesn't work. In any event, those machines that don't get updates are probably broken anyway. So I'll sacrifice a couple machines to the worms just so I don't have to one-by-one update.

Office, as you mentioned, is a non-issue. That's an inplace patch of the admin install.

So all in all, it's not bad. Not perfect. Not as good a solution as, say, not running windows, but not bad, either. If you are running more than a handful of Win2K or XP machines, you NEED TO HAVE SUS. Not having it is just dangerously suicidal.

Flaw IN Visual Basic?

[mahdi13]

I thought Visual Basic was a flaw!

office

[cybercuzco]

I remember in HS I could own any mac in school that had office installed on it. At that time office had a find file program built in with the added "feature" that it could move files around once you found them. The security program on the macs of course disabled apples find file and locked certain folders so you couldnt delete programs. Office bypassed all that. All you had to do was find and move the security programs preference file to the trash and restart the computer. The password would be reset to the default password, which I happened to know (admin:admin is pretty easy) Voila, Office as a hacking tool. And it was a feature of office!

Re:office

[astrashe]

I don't think it's fair to blame office for that -- the old macos didn't have real file system permissions, and that's why it was insecure. Locking the finder down was the best they could do, but it just wasn't a realistic solution.

Re:office

[div_2n]

A deadbolt on a door isn't a realistic solution to lock a house down but it does serve a good purpose.

Office circumventing that security method is exactly like installing a doorbell only to find that the front door pops open regardless of whether it is locked or not when you press the doorbell button.

How does a doorbell and front door relate to this? Neither is adequate security but both were easily circumvented by a third party device that SHOULDN'T interfere. Blame should not be waived just because the quality of the measure in place was good or bad.

Re:Why Does Slashdot Care???!!

[jpsst34]

"This looks like another story to laugh and mock MS. In reality, it is you zealots that look like mormons."

That doesn't make any sense. A Linux zealot can't even get a date, let alone several wives!

Doesn't make any sense..

[euxneks]

It doesn't make any sense for a company to keep building something that requires a patch every few days. Are they actually making money off of these patches?

It's just that I've never heard of anything so blatantly broken that is so successful.

Maybe I'm just angry because some scumware got into my computer system.

Re:Doesn't make any sense..

[EvilTwinSkippy]

It's just that I've never heard of anything so blatantly broken that is so successful.

You are obviously not remembering the "good old days" very well. Every computer system is crummy. Linux is crummy. It's just a matter of how much we are paying for suckness.

At least Linux us honest about its suckworthyness. You don't see Linus making grand speeches about "Trustworthy" computing, or "Security through fill in the methodology". He and his cadre are out there coding for fun. They will tell you as much. Many just happen to be paid to do it for a living.

I personally use Linux. And it has nothing to do with quality. I'm constantly tweaking, patching, or scripting. It's about utility.

Finally! They're fixing the bugs

[192939495969798999]

When we get more like 50 of these a week, then we'll know that they've really gotten serious. Large systems have a lot of holes in them -- especially when no one was plugging the holes for oh, 10 years or so.

Trustworthy Computing

[EvilTwinSkippy]

Trustworth computing at work. Interesting how they have a critical flaw in Office at about the same time they are espousing new lock in features and DRM.

My tinfoil cap has 2 pennies.

Final patch

[mcgroarty]

I'm thinking MS could save a whole lot of time if they'd just get rid of the network and user input drivers!

Flaws in Visual Basic

[turgid]

Flaws in Visual BASIC are documented right here

Latest Debian gnu/Linux seccurity warnings!

[Anonymous Coward]

[29 Aug 2003] DSA-375 node - buffer overflow, format string
[26 Aug 2003] DSA-374 libpam-smb - buffer overflow
[26 Aug 2003] DSA-344 unzip - directory traversal (new revision)
[18 Aug 2003] DSA-364 man-db - buffer overflows, arbitrary command execution (new revision)
[16 Aug 2003] DSA-373 autorespond - buffer overflow
[16 Aug 2003] DSA-372 netris - buffer overflow
[13 Aug 2003] DSA-358 linux-kernel-2.4.18 - several vulnerabilities (new revision)
[11 Aug 2003] DSA-371 perl - cross-site scripting
[09 Aug 2003] DSA-361 kdelibs, kdelibs-crypto - several vulnerabilities (new revision)
[08 Aug 2003] DSA-370 pam-pgsql - format string
[08 Aug 2003] DSA-369 zblast - buffer overflow
[08 Aug 2003] DSA-368 xpcd - buffer overflow
[08 Aug 2003] DSA-367 xtokkaetama - buffer overflow

Stop calling the kettle black! Fix your own problems. This stuff wouldn't happen if Debian didn't use out of date software, as most of the flaws mentioned were fixed in the new versions!

Re:Latest Debian gnu/Linux seccurity warnings!

[akiaki007]

The only one that *truely* affects Debian here is the kernel bugs. Everything else is software and shouldn't be considered that.

The MS bugs pertain to the MS release software that directly affect the OS and the Office suite. And I would only really consider the VBA and the OS security bulletins here as being that important as that is what affects Windows. So that's 2.

For debian we have 1. The rest are other software! If I wanted to talk about bugs with every piece of software being used in Windows, then let's do that. But clearly you're not.

Stop comparing apples to oranges.

Re:Latest Debian gnu/Linux seccurity warnings!

[blastedtokyo]

Ummm...Office is _application software_

Slashdot just loves MS security bulletins

[Anonymous Coward]

What's the big deal here? Microsoft finds a flaw, issues the patches, get coverage from slashdot.

Things that happen all the time with unix/linux OS and apps.

Don't be mistaken, i ain't pro-Microsoft. I just think that slashdot is often bashing MS products for no reason. Their ideology is bad. The world domination plan is bad. But i'm tired of "hardcore" unix/C fanatics that dismisses .NET without any knowledge of it.

Whining and moaning everytime they issue a security warning is just plain childish...oh wait this is slashdot

Re:Slashdot just loves MS security bulletins

[akiaki007]

I use .Net. And I won't dismiss it. But all the bugs are really annoying. Some seem small. For instance, you can't use customized MenuItems in a ContextMenu in a NotifyIcon. That's quite useful if you think about it. If you want a simple application that runs a lot of other programs and processes in your company, it would make sense to use a NotifyIcon application. But every menu (no images allowed here) looks exactly the same. It would be very helpful to have icons and colours. but you can't. This is just one bug. There are quite a few, even within the compilers.

I'm not dismissing it completely, but .Net released by MS is still very much a beta. Even at the 1.1 level.

Re:Slashdot just loves MS security bulletins

[Repugnant_Shit]

I've been using .NET. It's neat, and has a lot of cool features over VB6, ASP, and MFC, and yes, even Java. But as interesting as the technology is, why would anyone want to deal with a company that acts the way Microsoft does?

paraphrasing....

[naph]

"For example, an attacker could read files on your computer or run programs on it. By installing this update, you can help protect your computer." - MS03-037

read... "do whatever the fuck they want"

heh.

Every bit helps

[Doesn't_Comment_Code]

I hope this wins some more business and government contracts for non-Windows based systems.

Windows is ok for some applications. But this sort of thing (actually a whole month of bad security press) should jar a lot of decision makers to recognize that MS is not the ONLY REAL OS OUT THERE, as there marketing strategy has led all non-tech inclined business execs to beleive.

The Truth will set you free.

NetBios Problem: Affected Platforms

[burgburgburg]

Affected platforms include Windows XP, Windows 2000, Windows NT 4.0 Server, and Windows Server 2003.

Welcome to the family, WS2K3!

Re:NetBios Problem: Affected Platforms

[Accipiter]

Bah. WS2K3 was affected by that silly DirectX/MIDI vulnerability.

Because, you know, servers need DirectX. Just like they need themes.

It's funny to laugh at Microsoft...

[Osrin]

... but we should really be debating how we get this right on an OSS platform. If I put RedHat9 next to Windows Server 2003 I have significantly more updates to apply to my Linux box.

This is a community of smart people, the race is on to figure out how to best solve this issue for our end users. Microsoft appears to be beating us by requiring far less updates to be applied than a randomly chosed Linux distro.

We need to think about the process of distribution and application of these patches, if we can get that right then we get a larger percentage of the desktop.

Today any undereducated end user who is judging security by the number of patches that jumps to a Linux distro because they've "heard" it is more secure will quickly be jumping back to Windows.

Re:It's funny to laugh at Microsoft...

[pmz]

Microsoft appears to be beating us by requiring far less updates to be applied than a randomly chosed Linux distro.

This is a fallacy, as Windows is closed source. Microsoft will fix only those bugs that are either publicly disclosed, mandated by some court case, or, sometimes, actually found internally by their undersized QA staff. So, of course, Microsoft will appear to have fewer patches. Also, have you considered that the maintainers of your randomly-chosen Linux distribution are actually honest and believe offering a patch is better policy than offering none to save face?

Open Source (open, transparent, honest)
Microsoft (closed, opaque, lying assholes)

Gee, who do we choose? Well, I guess we choose Microsoft, because they have fewer patches!

Re:It's funny to laugh at Microsoft...

[bogie]

"This is a community of smart people, the race is on to figure out how to best solve this issue for our end users. Microsoft appears to be beating us by requiring far less updates to be applied than a randomly chosed Linux distro."

A) Linux and its associative apps are opensource so your going to find more security flaws due to the nature of opensource. This is a GOOD thing.
B) The ratio of packages per "average" linux distro vs. say 2k server or 2k3 server is what? 15 to 1? So judging by that fact its surprising that Microsoft continues to have as many problems as they do. When comparing correctly there is no comparison, MS loses hands down.

"... but we should really be debating how we get this right on an OSS platform. If I put RedHat9 next to Windows Server 2003 I have significantly more updates to apply to my Linux box."

Any admin who actually knows how to use update and secure both linux and windows would say different. With Microsoft patches there is decent chance that the patch will not only not work and require a second patch, but also might hose your system. All those admins who get nailed by worms aren't just lazy. Many of them have been burned by MS patches and choose just not to use them.

Let's also not forget about huge mega patch service packs that you have to use which are somehow ignored in your "count". Forgot about those huh? How many patches do these monsters hold? Hundreds? At a minimum. And of course nobody's system EVER gets hosed by service packs....

How about those great new restrictive licensing terms which get forced down your throat just because you want to secure your box?

Lastly even though 2k3 is better about it, I'll also enjoy not having to reboot my system for a simple patch. Don't you think average downtime should be added into the equation?

I'll take Red Hat's or any other linux vendors patching system any day of the week thanks.

On Principle

[redtail1]

Maybe Microsoft has started offering their developers $20 for each security fix...

Re:On Principle

[Xenius]

Heh, not even they have enough money to offer that. ;)

education and administration still the weak spot

[*weasel]

your box is only as secure as the person administering it.

and apparently, windows users, left to their own devices don't know, or don't care about keeping up to date on security patches.

although, when enough of them are willing to just go ahead and doubleclick on any attachment from an unknown sender (msblast), these kinda exploits aren't really even necessary.

all the tools for a secure windows box are already there.
(though a security-patch-only windowsupdate flavor would be very helpful).

it's a good thing that microsoft

[way2trivial]

didn't make "our products will not kill customers and burn down buildings" one of it's "top priorities"

think- where we would be then?

Office Updates EXTREMELY Frustrating

[syntap]

I'm in a mixed environment where we have some Dells that came with Small Business Edition (either SR1 or original), and other users who needed Access that we purchased Office 2000 Pro for. Because Microsoft requires the original CD, it really adds to the burden of updating because you have to figure out which friggin' disc to use on each individual station. If they would just let us run the damn patch without the CD verification it would be easier.

Plus, their order of updates is fux0r3d. They have the spell checker update listed as more recent than SP2, but when I run it I get an error message that the update only runs on SP1 .

It's bad enough to need so many patches, but there are many basic things like the above that Microsoft could easily improve.

Re:Office Updates EXTREMELY Frustrating

[superflippy]

you have to figure out which friggin' disc to use on each individual station

It's not just a difference between SBE and Pro. It turns out that all Pros are not created equal. The newer machines here were set up in two batches several months apart. All have Office XP Pro, but we discovered when trying to install the patch that the newer Office CDs are not the same as the older ones. Patches on the newer Office XP Pro require a file called PRORET.MSI on the CD, while the less new Office XP Pro needs a file named PRO.MSI on the CD.

We figured this out after a frustrating attempt to patch my computer. A CD was in there, but the Office Updater didn't like it. It worked fine when we dug out the exact same CD that was originally used to install Office XP Pro on this computer.

Re:Office Updates EXTREMELY Frustrating

[MachineShedFred]

Have you tried using the office administration kit? It will allow you to make a scripted install that won't ask for CDs or any of that other annoying crap.

All of Microsoft's installers and patches these days are MSI packages, which you can use several available tools to make "transform" files that skip all the screens, EULAs, next presses, and CD check crap.

I believe the office administration kit is available for download from Microsoft's office website somewhere. I'll let a karma whore dig up the link...

Re:Finally! They're fixing the bugs

[Chainsaw Messiah]

I just got a new pc with XP on it after a mb failed on old one last week. Decided to run windows update this morning. 30 "critical" updates, 11 xp updates and 3 driver updates. And this is a pc packaged in July.

Honestly...

[flamingnight]

...is anyone surprised?
I'm not even sure this belongs on /. anymore. We know MS writes buggy and vulnerable software.
Of course, MS isn't the only company to write such buggy software. But before anyone says a word about MS being bashed too much, let's remember that 95% statistic. When a company's software runs on approximately 95% of the world's computers, they have the moral responsibility to ensure its stability before they release it.
We could always blame sysadmins for being too stupid to check for and install updates, but instead, why don't we just educate people on why they should run Windows Update every week (or sooner).
I'd think billions of dollars in damages to the economy would be enough to get executives cracking the whip at their IT staff. Then again, I also thought Bush lost the election.

Re:Honestly...

[sharkey]

I also thought Bush lost the election.

Really? I though America lost the election.

Re:I wonder how long before the new worm..

[b17bmbr]

The bluster worm

was that written by ballmer perchance.

Who should I bill for this?

[yiantsbro]

Alright, the OS patches are one thing--I can automatically have our machines update if I wish. The office updates, however, require access to the installation media. As we have a volume license agreement and our individual users to not have copies of the media, I will have to have a tech personally visit each of our 500 or so machines to put in the CD and load the patches--or ignore this "critical" fix and hope for the best. I wish I had the option of forcing an different office application solution but in an academic environment it is difficult at best. Something like this really lays the foundations for class-action.

Re:And yet, look at my sig for Linux vulnerabiliti

[hype7]

Here comes the part where people's excuse is that it's a joint effort, unable to be pinpointed as a "Linux hole." What does that mean? Nobody gets blame because a lot of people contribute? A lot of people contribute to Microsoft as well. They're just behind the moniker of a company label.

Rather than excuse Linux, I think the people hate these MS warnings most of all because MS-users, unlike most Linux users, don't patch their systems. What normally ensues within a couple of weeks of the vulnerabilities is some exploit wreaks absolute havoc with the internet.

If MS gets the patch out the door, and everyone installs it before some script-kiddie can exploit it, then who really cares? It's a pain downloading all the patches, but that would be the extent of the problem.

Instead, the horde of zombies kills the internet. We've only just recovered from the last attack.

-- james

How Does This Affect Home Users Without the CD?

[Mad Man]

From personal experience, patches for MS Office require the user to have the CD available.

In the corporate environment, this usually isn't a problem (except for the different flavors of Office we have floating around: MS Office Professional, MS Office Premium, MS Office Academic version, OEM non-retail version, etc. make it a pain).

However, home users may have MS Word and MS Excel pre-installed on their systems from the store. But they don't have the Office CD itself.

How can they apply the necessary MS Office patches and service packs?

Re:And yet, look at my sig for Linux vulnerabiliti

[BurritoWarrior]

Good troll, but try coming back with an analysis of the actual severity of the holes.

I better hurry to run off and patch a hole in some obscure OSS app I don't have installed as opposed to the constant REMOTE ROOT EXPLOITS in the core Microsoft OS.

2 bugs not 5

[inteller]

you fanboys blow this all out of proportion. It is 2 bugs with one that happens to effect 4 products. The reason they list sperate announcements for each product is because some people don't have them all installed but still need it for the one app you use.

Re:And yet, look at my sig for Linux vulnerabiliti

[Anonymous Coward]

Quick quiz, hot shot Troll: Here are the first 5 vulnerabilities from that list:

atari800, gallery, eroaster, mindi, phpwebsite,

Now, how many of those are "linux" (i.e. the linux kernel, shell and important utilities.) None.

How many are remotely exploitable? None.

Given the user base of those 5 obscure programs, how many would *you* rate as critical?

Oh?

[Overly Critical Guy]

Guess you've never subscribed to Red Hat's errata updates, have you? I don't even want to bother reinstalling 9 because I know I'll get a HUGE list...

Debian has more than 10 updates listed just for August alone, almost all buffer-overflows.

Anyone want me to go on? Because I could. Remember the filesystem-corrupting kernel "turkey" release? Heck, 2.4.x was riddled with problems its entire run. But that doesn't matter when we've got hatred to burn on Microsoft, right? Sigh.

NEWS FLASH--Companies issue patches for their software. The more used the software is, the more possible holes will be found to be patched. The more updated it will be. Why is it so surprising that something with 95+ marketshare is going to be given patches? Wouldn't be...I don't know...a good thing in people's eyes?

Here comes the ranting Linux fanboy to tell me I'm wrong, and that everything Microsoft does is wrong. Sigh.

Re:Oh?

[Mentorix]

This is getting really old really fast...

For one thing I don't care how many patches my OS needs. Patches won't just go away, rather they seem to be an integral part of *any* OS there is. And the thing is, most Linux (or *bsd) user and admins are all perfectly aware of that fact.

I just want to be sure the patch is on time, that it works, doesn't fuck something else up and doesn't introduce new vulnerabilities. Frankly I dont think MS can really guarantee any of the above.

Debian has more than 10 updates listed just for August alone, almost all buffer-overflows.
And how many of these were in the kernel? Please understand that debian releases much more code and software than microsoft does with their OS and personally I'm not to worried about a buffer overflow in something obscure that I have never even thought about installing. And even then there's always the simple solution of running apt-get which fixes all your patch problems like magic...

Anyone want me to go on? Because I could. Remember the filesystem-corrupting kernel "turkey" release? Heck, 2.4.x was riddled with problems its entire run. But that doesn't matter when we've got hatred to burn on Microsoft, right? Sigh.
Ok, so 2.4.x wasn't the best, but to say it was all bad would be complete nonsense. Why do you seem to be trying very hard to over-generalize? Of course there are people posting anti-ms things but it's not like the whole story thread is littered with those posts... this is slashdot what do you expect?

I got problems with MS, sure, but I fixed that problem by simply not using it and it has been working out pretty good for the last 5 years or so. You don't see me trolling slashdot about it...
(wait, I just did?)



--
cat /dev/urandom | ..oh wait, nevermind.

Re:Oh?

[Ice_Balrog]

Almost every Windows vuln article I see this argument. And very time it gets refuted. Yes the Windows troll just will not go away.

Debian distrobutes how many thousands of different packages? I don't remember, but it was over 2,000.
Now then, how mnay different packages does MS make? 200-250. 5 out of 250 MS pacakges. 10 out of more than 2,000 Debian packages. Now Debian doesn't sound so bad, does it?


On top of that, most of the Debian security vulnerabilities are theoretical or requite access to the machine to use the exploit. Hardly as big of a threat as MS vulnerabilities.

Thank you MS

[harvey_peterson]

Thank you Microsoft, for keeping all of us Techical Support people employed. Without you, the other half of slashdot would be unemployed.

Wow, not ONE of them was for Linux

[finkployd]

Perhaps comparing all the security vulnerabilities for all software that could possibly run on Windows to this list would be SLIGHTLY more fair.

As it stands now you are comparing all open source applications to the Windows Oerating System.

So good job on attempting to call the Slashdot community on hyprocracy, unfortunatly you seem to be very confused about what Linux is and unable to make a valid comparison.

Finkployd

Oh come on

[Cat_Byte]

Why must we have a discussion on every single MS update? This is like posting a major news announcement at every virus that comes around. Set up critical updates to download & install when you are ready, set up anti-virus to auto-update, and move on with the important things that we as a community of intelligent computer users can benefit from. It's not news if MS already discovered it, researched it, wrote a patch, tested it, and released the patch.

In other news: Elvis Presley is still dead and the teddy bear icon virus still runs rampant.

If we must post security advisories do it for a *nix platform where critical updates aren't automatically applied and mission critical apps are in danger of being compromised.

Hmm. Does this affect OEMs?

[gosand]

I just thought of something - what do companies like Dell do? They just sell the stock OS on their systems, right? Everyone always complains that people don't patch their systems, but what if you buy a new machine from Dell? I am sure people don't think "oh man, I have a new system, I need to go out and figure out which patches to install". They fire it up and go. Should OEMs be required to sell systems that are up to date on the OS patches?

This is the origin of the apache servers name...

[evil_one666]

http://www.apache.org/history/timeline.html

Brian Behlendorf started collecting patches to be applied to the last version of NCSA. The initial versions of Apache are available primarily as a series of patches. Hence, initially, the name Apache, as it was "a patchy server". At least, so the legend goes.

Re:And yet, look at my sig for Linux vulnerabiliti

[Alien Being]

"...which definitely outnumbers five."

If you use 5 different distros, and some fairly unusual apps, then gee, I guess you're right.

You should change to your handle to Overly Simplistic Guy.

Requiring a CD = bad idea

[Repugnant_Shit]

I develop lots of VBA stuff for our office. But all of our installation disks are 75 miles away at the main office. I have an Office XP Upgrade disk that was used on older here, but my full-blown Dell-installed Office XP won't accept it. So how am I supposed to patch this *critical* bug *immediately*?

I hope their insertion operator for Add/Remove...

[CatOne]

Software is O(1).

Because I have like 357 hotfixes in that list now.

Damn, it's going to take me about 5 minutes to scroll down to uninstall any software that starts with a "Y" or "Z" :-P

Re:Yes, there is a reason

[gowen]

yet ignore that Linux application vulnerabilities are announced almost every day. But, they say, this is MICROSOFT! It's somehow DIFFERENT!

Yes, it is different. All those Microsoft flaws are in products written and tested by Microsoft themselves.

MS does not patch flaws in "Photoshop for Windows", or "CorelDraw for Windows" or Quicken, or Win32 Mozilla, or any number of the millions of Windows shareware apps. Unless you start counting those vulnerabilities as "MS vulnerabilities" you're not comparing like with like.

All those Linux application flaws are in products (usually obscure ones) written by companies other than Linux distribution vendors. They package them with they're distros because they can, and they promulgate the patchs (also written elsewhere) because its good practice.

Yes, I know. IHBT. IHL.

And Office Update process is broken.

[Angostura]

a couple of points on this.

While I've just about managed to educate friends and familly about the need to run Windows Update, WU does not in itself warn of critical security issues - you have to remember to visit Office Update manually... and who is going to do that? No one, in my experience.

but it gets better - The Office Security updates require you to insert the original CD. This seems a mighty strange move, and not terribly useful for me since the CD is several thousand miles away locked up in a cupboard on the other side of the Atlantic.

Can anyone explain the warped logic here? I could understand it if the new patches enabled new functionality? but these are security patches.

Obligatory Dilbert quote...

[quacking duck]

"Woo-hoo! I'm gonna write me a new minivan this afternoon!"

Re:And yet, look at my sig for Linux vulnerabiliti

[gmuslera]

Remember the last webdav vulnerability for Microsoft/IIS?

• Black hats knew about the vulnerability before Microsoft
• Widespread attacks come some days after Microsoft finally get know of it, but don't releases any advise of the danger because they had no patch ready, so it took final users by surprise.

With linux at least you could have the warning even before the patch (like one of the latest apache vulnerabilities) so you can take measures before the patch is ready/tested/approved/signed/whatever.

Re:education and administration still the weak spo

[the_mad_poster]

all the tools for a secure windows box are already there

Oh, really? So, if I want to remove Internet Explorer because it's such a buggy, hole-ridden program tied right to the OS, Microsoft has a tool for me to do that? So, if I don't want to install the RPC service on my W2k box at home, I can do that during the installation? So, if I want to forgoe Explorer because I don't need pretty point and click interfaces, I can do that?

You've got it backwards. Unlike well-designed systems, Microsoft DOESN'T provide you with the tools to make the box secure. That's one of the biggest problems - you have to rely on their "one-a-day" pills to make the box secure, and even then, it's not secure, it's just you filling one of many holes in the dam.

Criticality of this is horribly underrated

[benploni]

Criticality of this is horribly underrated by Microsoft.

This is critically important for all Windows MS Office users - "the user must open the attachment" is no protection because most users open attachments to see what they are.

If the infected Word Perfect document is given a .DOC extension, Word will be invoked directly when the user double-clicks the attachment. Word will automatically recognize and convert the document, and run the hostile code with no further opportunity for the user to stop the virus.

The vulnerability could also be exploited through a web page, and the user would get no chance to say "No" if ActiveX is enabled.

Re:And yet, look at my sig for Linux vulnerabiliti

[pirhana]

People criticize mircosoft not because that more vulnerabilities are reported on that platform but because of their approach to the entire issue. Even though microsoft releases patches/fixes for the vulnerablities, sysadmin cant install them with confidence as they are notorius for breaking existing applications and softwares. Then comes the rebooting issue. For almost every pathes, you need to reboot the machine, which is not the case with linux ( except kernel pathces). All these make it extremely difficult to patch the MS systems REGULARLY AND FAST . People cant afford to have extensive test, install, reboot ...blah blah on server systems. This is the reason why even networks like that of BMW get infected by MS worms and exploits. On the other hand in linux , even though there are almost equal number of vulnerabilities , the fast and easy managment of patch system makes it possible for everyone to keep updated and secured.

This isn't news... Office is a root kit...

[Mongoose]

1. Open word
2. ALT+F11
3. Key in Shell "cmd.exe", VB_Normal_Focus
3. F5

This simple example runs a shell, but you can guess what happens when you can load a kernel debugger or alternative win32 shell and have system access.

This isn't shocking and I've seen everyone try to remove the DOS subsystem, rename net.exe and disable and even remove cmd.exe/command.com by using filesystem tricks and depending on windows lame application's handling of these tricks.

Basicly you can't secure a Windows machine in public use -- btw if you have acess to the usb port and a jump drive you can get in without a keyboard and send viri/spam/etc from someone else's machine.

Window's Office VBA system and IE are the ultimate root kit imho.

Re:This isn't news... Office is a root kit...

[Kevinb]

1. Open word
2. ALT+F11
3. Key in Shell "cmd.exe", VB_Normal_Focus
3. F5

This simple example runs a shell, but you can guess what happens when you can load a kernel debugger or alternative win32 shell and have system access.

So what? I can use the ! command in Emacs and other programs to accomplish the same thing on any Unix-based system.

Office runs at whatever privilege level you currently have on the machine. If you already have permissions to debug the kernel or do other administrative tasks, you can just as easily do so by going to Start -> Run. If you don't have these permissions, Office isn't going to magically give them to you.

Re:And yet, look at my sig for Linux vulnerabiliti

[Bull999999]

I didn't know that Linus decided to integrate sendmail, php, LinuxNode, an Amateur Packet Radio Node program, perl, up2date (Red Hat), pam_smb, vmware, horde MTA, gdm, Mindi, eroaster, Gallery, and atari800 into the offical Linux kernal. Is this the new Mega Supersized Linux Macrokernal?

red alert on Road Runner for MS..

[pair-a-noyd]

While they show the date to be yesterdays date, the status is still red and active. Road runner is choked up right now because of MS problems.
Email is just about non-flowing.

I talked to my son at college last night and the entire dorm is dead stopped because there are 150 pc's (excluding his Linux box) that are virused 6 ways to sunday and have brought the school system to a halt. He can't use the internet because of the MS machines bringing it down.

Now THAT's sad. With 150 machines in his dorm it's turned into a virus P2P network. The viruses propogate so rapidly because they are protect by the univeristy firewall from the outside world but there is no internal protection against *anything*....

The people that run networks, like schools and businesses need to manage their systems better. This stuff is not funny anymore and it's already gone was past the prank stage.

It's time for some extremely severe prison terms. No more wrist slapping.

Status Red
9/2/2003 7:24 AM
9/3/2003 6:02 PM
ALL Areas.
Road Runner subscribers in all areas could experience slow browsing and/or packet loss when accessing Microsoft sites and services. This could include microsoft.com, windowsupdate.com, msn.com, msnbc.com, hotmail.com, vicinity.com, the Messenger service and any Microsoft websites and services at this time. Our Engineers are working to get these issues resolved as quickly as possible. Thank you for your patience.

Have to contact MS for Office 97 patches?

[birk_man]

A quick look at MS03-036 and MS03-035 shows that patches are readily downloadable for Office 2000 and newer. They say there is a fix for Office97 but it looks like you need to contact MS support to get it.
Does MS realize how many of us are still using Office 97?
Anyone know of a place to download the Office 97 patches for these?

Re:And yet, look at my sig for Linux vulnerabiliti

[frekio]

If you look a bit more closely at those "linux" security holes, then you notice that they are programs such as "eroaster" and "Atari800" that have the vulnerabilities. These are simply programs that can be installed on the systems that may be in the Gentoo portage for example, or FreeBSD ports system or a RedHat package.

The only "Linux" software you can really blame, is the kernel, besides that if a distribution has a hole in a default install that is a big issue. Otherwise, if the user installs software that has a hole you can't really blame linux for it. Microsoft wrote and distributes all the softwares which had the holes listed in this story, so they can be held accountable (unlike Linux in your story).

On that page at 9AM PDT there are ZERO bugs which fall into the category of serious issues that are Linux / *nix or Linux Distribution's fault. They are all stand alone software that have vulns.

If they listed every software on the windows platform which had vulnerabilities the MS list would be massively enhanced also. They aren't audited as much as unix programs because a lot less of them are open source... so the bugs are just sitting there, unfixed.

Another FUD bites the dust....

need to use BOTH update sites

[rakerman]

Just a note that in order to be fully covered for MS patches, you have to use BOTH Windows Update and Office Update.

The Windows Update service (automatic or manual) will not detect or install Office patches.

Re:Face it, Linux is popular enough.

[gmack]

That's funny.. last time there were security vulns I read about them on 3 different news sites and I didn't have to do a thing because my system updated itself.

It is the distro's job to make sure you are protected when a new exploit is discovered just as it's Microsoft's job when the problem is in windows. Also, if you think anyone accepts accountability for the problem in windows land you may want to read through the EULA again because it sure isn't MS.

Linux distros get bashed just as much over this and some of us actually avoid the distros with overly bad security records.

You also need to keep in mind that there is less downtime involved when upgrading Linux systems. My Linux servers are all fully upgraded but have not been shutdown in months. Window? 4 patches 3 reboots.. yuck

Comparing Red Hat updates to MS..

[saintjab]

I'm sure this will get modded down, or ignored by the moderators all together, as off topic; but I feel it's a good camparison. I have two, relatively similar, workstations. One running Red Hat 9 and the other WinXP. I use RH Up2Date on the Linux bawx and Windows Update on the XP machine religiously. The observation that I have made are pretty amazing. Microsoft releases roughly 4 patches for every 1 that RH releases. The RH packages, other than kernel updates, do not require any reboots; where most of the MS ones do. I've not had a single occurrance of an adverse effect on my Linux machine from any patches, where I have had a miriad of issues with the XP/Office updates (insert CD, permissions issues, BSODs, etc). I'm not at all trying to scream the virtues of Linux and downplay MS, but there are real issues. Not to even mention never having adware, spyware, etc. installed on my RH machine without my knowledge. I'm extremely carefull with all of my machines and I stilled managed to get some IE search bar added to my browser. I removed it quickly with Spybot search and destroy, but it still happened. I think MS needs to take a step back from the cash register and seriously evealuate their tactics and practice where desktops are conncered. That is, if they ever want their update service to be even close to as effective as RH. But thats just my two cents and I'm sure there are a line of people out there to tell me I'm wrong and/or full of crap; but these are real world observations from someone who is completely OS neutral. ..jab

Re:Comparing Red Hat updates to MS..

[sheldon]

Microsoft releases roughly 4 patches for every 1 that RH releases.

I believe you mistyped because the facts say Redhat issues about 4 patches for every one that Microsoft releases.

I first noticed this myself last year after having installed Redhat 8.0 and subscribed to the redhat network and witnessed the slew of emails I began receiving warning me to run up2date.

But thats just my two cents and I'm sure there are a line of people out there to tell me I'm wrong and/or full of crap; but these are real world observations from someone who is completely OS neutral.

I'm not interested in getting into any sort of philosophical debate or say you are wrong or anything. You have your perception, but the facts clearly don't support your anecdotal evidence.

http://www.redhat.com/apps/support/errata/

In fact if you look out at Redhat 9 you'll see there was a Apache vulnerability patched just today.

blame microsoft!

[Anonymous Coward]

Okay I see a lot of Microsoft apologists saying that "all software has bugs", "Linux has problems too", "dumb admins need to keep their machines up to date".. etc...

Let's see:

Linux written by volunteers and small companies.

Windows written by a company with tens of billions in the bank.

Linux used mostly on servers and installed by educated admins.

Windows used by everyone from grandma to the CEO.

Linux on a small percentage of servers.

Windows on 96% of machines (or whatever the figure is). Windows used in ATMs, in medical equipment, by the government, etc., etc. The Microsoft antitrust ruling was typed out on a Windows machine.

And given their resources, their cash, the number of frickin' PhD's on the payroll, and the fact that the entire world economy depends on Windows crap OS (yes even us folks who use Mac/BSD/Linux are still affected indirectly) .. you gotta ask yourself .. is "similar to Linux" in terms of security problems the BEST they can do?

They have a huge responsibility, and they have chosen not to meet it. Why? Is it so that the government will pass software quality laws that will place a huge burden on Free software, thus weakining it or killing it off?

Or is it because people have their heads in the sand and refuse to acknowledge that Microsoft is not worth the time and money any more. That's probably it. People are sitting there constantly patching their Windows boxes and not realizing that, hey, maybe there are alternatives. Microsoft has you all by the nuts.

Why are you guys making excuses for Microsoft? Microsoft's products should be the most secure on the planet given their resources and abilities.

I used to think, hey, all computers have problems, but after using software like qmail and OpenBSD, I realized, Microsoft is doing about 1% of what they could do. Even just closing ports and making email attachments not be executable would solve a lot of problems. They need to make their software more secure.

Instead they come up with Palladium or whatever it's called now, a gigantic complex scheme to solve this problem (and a lot of other imaginary "problems" too). Can't they try some simple stuff first?

So don't apologize for Microsoft, don't say "well, if Linux was everywhere we'd have the same problems" .. the problem today, right now, is Microsoft. The constant flood of pings to my machine are coming from microsoft machines. The viruses are coming from microsoft machines. When is it going to stop??

Re:blame microsoft!

[pair-a-noyd]

Hey!
Patching Windows is *GOOD* (as in doubleplus) for the economy!

Just think of all the computer techs "steppin & fetchin" right now patching up all the M$ boxes around the world. Right now they are busier than Santa's elves on Christmas eve.

All that overtime is boosting the enconomy man!
And as they drive around, they spread the wealth, from spending those big, fat paychecks on upgrading to Windows XP! And as they drive around patching systems, the stop and spend a dollar or two at McD's, a bag of Cheetos, a soda, you name it.

Yep, patching Windows definatly is a BIG BOOST to the economy and it's a good Homeland Defense exercise.

Re:And yet, look at my sig for Linux vulnerabiliti

[apdt]

The point is that all the vulnerabilities in the list on the page you linked to (with the exception of sendmail) are fairly obscure "3rd party" apps.

If a vulnerability was found in some obscure windows ftp server that you got off tucows for example, you wouldn't list that as a windows vulnerability would you?

Sweet quote from Seattle News

[w42w42]

A nice quote from KOMO, a station in Seattle (next door to Redmond for those that are unfamiliar with the area).

SEATTLE - Those of you using Mac OS or Linux can relax this time, but those using MS Office on Windows, take note: Microsoft has issued some more security alerts.

Many hours will be lost patching Word.

[Futurepower(R)]

To patch the security vulnerabilities in Microsoft Word, you have to 1) download the patch, 2) find the original Word CD and put it in the CD drive, 3) run the patch, 4) wait while a lot of processing is done with the CD, and 5) put the CD away again. It seems to me that, since this was a patch for a severe security vulnerability, Microsoft could have skipped the time-consuming 2, 4, and 5 steps. Think how many total hours will be lost throughout the world by users or computer professionals whose time is extremely valuable. The TCO just went up.

Re:Many hours will be lost patching Word.

[pe1chl]

The MSI installer used for Word is indeed terribly slow.
I took this opportunity to install Office 2K SP3 plus these two fixes, and it easily eats 10 minutes per PC, to install about 12MB of patches. That could be done in 10 seconds.

Re:Minneapolis references on /.

[revividus]

Oops, my bad.

Is there some sort of ANSI standard-Strip-club-naming-convention that I'm not aware of?

Autoupdate does not cover Office!

[gad_zuki!]

>I didn't have to do a thing because my system updated itself.

Well, now you're out of luck. Joe Sixpack not only needs autoupdate on 24/7 he also needs to visit officeupdate to get the office patches: http://office.microsoft.com/ProductUpdates/default .aspx

Can MS make this more confusing for the average user? KB824993 and KB826292 do not show on a fresh Windowsupdate.com scan or with the MSBL tool.

Windows (Simplified) World

[knghtrider]

For one reason or another, things are different in the Windows world.

Yes, things are different in the Windows (Simplified) World. In the Windows World; you buy PC XYZ from company ABC complete with Windows. You unbox it, turn in on, and let the 'magic' do its' thing. There's no muss, no fuss and I've got a working PC. Oh, never mind that the OS isn't patched with the latest patches--the average home user doesn't know (or understand) that it needs to be--regardless of the media coverage of worm/virus Qbert. The average home user is NOT technically inclined. Therein lies the source of the problem--lack of sufficient instruction, which is the delegated responsibility of the OEM System Builder.Consequently, every little bug gets passed along, and we end up with MSBlaster type problems.

In the Linux world; the average user is technical, or has had the system set up by someone technical. They take care of the system, understand how to patch the system and ensure that it has been patched. For this reason, problems are short lived.

We live in a simplified world. From fast food; disposable diapers, razors, etc.; to all-in-one super stores; everything is simplified for us. I don't have to know how to make Veal Scallopini; I can buy it pre-made at the grocery. We want everything easy, because we don't want to take the time top do otherwise.

Granted, this is an oversimplified view. I didn't factor in regression testing of patches at the corporate level in order to ensure that the new patch doesn't break something else in use, due to the tight integration of code with the Microsoft OS (unlike Unix/Linux Applications). This takes time (stakeholders and their ilk tend to be a testy when their application breaks) and may result in infection before testing is complete. The point is people have been brainwashed into believing that computers are simple, when in fact they require a lot of attention, like a toddler or a puppy.

How did we do things without computers before? I know..paper and pencil. At least there we didn't have to worry about viruses--unless it's a cold. LOL... Maybe regression is a good thing this time?

Troll. Read the alerts/ Debian backports to stable

[The Revolutionary]

First, realize that these security alerts arise from a set of over 8710 packages. This is an incredibly large base of software, the great majority of which you will not have installed, and certainly not have installed in a production environment.

Second, did you even bother to read those security alerts or investigate what the packages are? Briefly:

node: "Amateur Packet Radio Node program"

libpam-smb: arbitrary code, but no privilege escalation

unzip: no privilege escalation, no arbitrary code, and who uses it?

man-db: only if you go against install-time advice and make it setuid

autorespond: "This vulnerability is currently not believed to be exploitable due to incidental limits on the length of the problematic input, but there may be situations in which these limits do not apply."

netris: "A free, networked version of T*tris"

linux-kernel-2.4.18: most are local only, "STP protocol", or an nfs3 DOS with no arbitrary code or remote root

perl: yes, "execute arbitrary web script within the context of the generated page"

kdelibs: konqueror only, client only

pam-pgsql: arbitrary code, but no privilege escalation

zblast: "shoot 'em up space game"

xpcd: local only

xtokkaetama: local only

"This stuff wouldn't happen if Debian didn't use out of date software, as most of the flaws mentioned were fixed in the new versions!"

And this is why I call troll.

From Debian security FAQ:
"The most important guideline when making a new package that fixes a security problem is to make as few changes as possible. Our users and developers are relying on the exact behaviour of a release once it is made, so any change we make can possibly break someone's system. This is especially true in case of libraries: make sure you never change the Application Program Interface (API) or Application Binary Interface (ABI), no matter how small the change is.

This means that moving to a new upstream version is not a good solution, instead the relevant changes should be backported. Generally upstream maintainers are willing to help if needed, if not the Debian security team might be able to help.

In some cases it is not possible to backport a security fix, for example when large amounts of source code need to be modified or rewritten. If that happens it might be necessary to move to a new upstream version, but this has to be coordinated with the security team beforehand."

Mitigating Factors

[cmacb]

The security threat posed by a particular bug in Windows is "Critical", but this is mitigated by the fact that: "The user must open a document sent to them by an attacker in order for this vulnerability to be exploited.", or "The Microsoft Access Snapshot Viewer is not installed with Microsoft Office by default. ", or "Any information disclosure would be completely random. "

Well that last one is certainly good to know. If my information is going to be disclosed I'd certainly prefer that it be my random information rather than my much more valuable, um, organized information.

I'm wondering if there are not a team of "Mitigation Specialists" at Microsoft charged with coming up with these things. I think this is something I could handle pretty well. I think I'll send them a resume.

Here is a sample of my work:

Mitigating Factors:

* User must have not only installed Windows and Office, but actually be using these products for any harm to, or exposer of user data to occur.

~*~ Small pets, farm animals, or other domesticated wildlife will not be harmed by the use of these products, even if human user fails to exercise due caution.

*# Extra-Terrestrial life-forms are completely safe even when in the same room as an operating Windows environment.

::=. Use of un-patched Outlook Express has been shown to have no effect on local precipitation nor earthquake activity. We will advise customers of an future change in this situation.

I really think I could come up with a lot of these. How about you? Do you have a future as a Microsoft Mitigation Specialist?

Re:And yet, look at my sig for Linux vulnerabiliti

[Dot.Com.CEO]

pam_smb and sendmail "obscure"? And that's only in the past, what, five days...

Corporate Deployment

[gregarican]

These patches will absolutely suck to deploy on a larger-scale corporate network. Case in point...the VBA patch.

Right now I'm looking at silently packaging things together for a mix of Windoze 98 SE clients running Orifice 2K/XP and Windoze 2K clients running Orifice XP. Every month I deliver at least a half dozen of their damn security patches and typically can comprehend the proper command line switches (usu. Microsoft's setup.exe or hotfix.exe format) to make these deployments *NOT* require a mandatory reboot and *NOT* require a lot of user input.

What drives me crazy about the VBA patches is that they require:

Upgrading to Windoze Installer 2.0.

Applying all subsequent Service Packs (SP1a and SP3 for Orifice 2K; SP1 and SP2 for Orifice XP).

Finally applying the VBA patches to either Orifice 2K or Orifice XP.

So all in all it will take at least a week to code, test, and deploy in the least intrusive manner possible. But the Windoze Installer keeps on requiring installation media (CD or file share). Not exactly automated. So I guess I'll dig through the MSI docs to determine how to disable this known flaw (Q268800).

For a one-man show I'm really looking forward to all of the lost productivity. Almost as bad as figuring out a way to silently install the DirectX 9.0b upgrade since Microsoft left out the command-line switches. That one took me two days to workaround.

When will people get fed up with all of this crap? I have worked with computers since 1981 and am practically ready to abandon them and go back to damn typewriters and daytimers!

M$ Security logic

[AbbyNormal]

I loved the article over at NewScientist (here)

A Microsoft spokeswoman told New Scientist the risk was lessened by the fact that exploiting any of the vulnerabilities would require a victim to open a document or carry out some other active task. She added: "We don't know of any worms being created."

Uh...Open a document? You mean like an email with the attached virus/worm that says: "Here is the document you requested"?

Sigh...Damage control must be getting lazy or something.

Re:And yet, look at my sig for Linux vulnerabiliti

[Wakko Warner]

I'd say the first is awfully obscure, seeing as how I've used Linux now for nine years and have yet to find a system which actually uses it.

And sendmail? Hardly a linux-specific application, wouldn't you say? Besides, most Linux distros no longer use it.

- A.P.

Word97 is out in the cold.

[SLot]

Lovely. They say that Word97 is affected,
but that OfficeUpdate doesn't support Office97.

Head on over to the manual download section for
Office97. NOTHING TO BE FOUND RELATED TO
THIS in the office section. Under Word alone, the latest
update is from 2001.

Gee, go figure. Yet another reason to spend money
I don't have for a product I don't want.

Oh, and for all you astroturfers & M$ Fanboys -
at least when Linux does have a flaw, it doesn't
require me to spend 400 bucks on an upgrade to a
later, flawed version.

Re:And yet, look at my sig for Linux vulnerabiliti

[__past__]

He did so because he saw how successfull Microsoft was after integrating VBA and the Office programs in the XP kernel.

PGP version

[The Snailman]

You just have to laugh at this...
If you got all the Microsoft Security Bulletin's check out how the PGP version used to sign each one changed.
Especially this one:
Microsoft Security Bulletin MS03-036: Buffer Overrun in WordPerfect Converter Could Allow Code Execution(827103)

If you didn't get it or can't be bothered reading it:
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2 - not licensed for commercial use: www.pgp.com