Microsoft Rereleases Patch to Fix Problems

AbdullahHaydar writes "From CRN: 'One day after releasing a fix for an Office XP flaw, Microsoft upgraded the severity of the vulnerability to critical and re-issued a new patch to address a new attack scenario discovered in the last 24 hours.' The funny thing is that the second bug they missed with the first fix is 'critical' whereas the original bug the fix was for is 'important.'"

Comments

It ain't necessarily so

[Space cowboy]

The fact that 24 hours after releasing an 'important' bug patch, Microsoft re-released a 'critical' bugpatch should *not* be held against them! It certainly would not be the first time someone had realised that the consequences of X are far more than previously thought.

I'm no apologist for MS (see my posting history :-), but re-relasing a new patch at a higher security classification ought to be applauded, not ridiculed. Fair play, guys, and play the game according to *all* the rules, not just the "Redmond -4" ruleset...

Simon

Re:It ain't necessarily so

[Kethinov]

Yeah, my thoughts exactly.

I read the headline and the summary and it left me wondering "uh, and?"

This just in, grass is green! Whether you're OS is corporate or open source, security patches are going to happen and revisions of security patches are going to happen.

Re:It ain't necessarily so

[GuyMannDude]

I'm no apologist for MS (see my posting history :-), but re-relasing a new patch at a higher security classification ought to be applauded, not ridiculed.

Applauding Microsoft for having to re-release a patch is like applauding Idi Amin for only eating some dude's skin and muscles and not his intestines or eyeballs. Or applauding Paris Hilton for having the good sense to only videotape herself having regular and oral sex and not anal sex.

GMD

Re:It ain't necessarily so

[THE ROCK]

Or applauding Paris Hilton for having the good sense to only videotape herself having regular and oral sex and not anal sex.

I for one DO applaud Paris Hilton for doing just that. After all, videotaping yourself having ANAL sex and having it leaked all over the internet might get a little embarrasing for her. Good thing she didn't let things go THAT far!

Re:It ain't necessarily so

[dnoyeb]

whew. I was just about to check it out for myself. But since I know its raunchy thanks to you, I can spare myself :)

Re:It ain't necessarily so

[pantycrickets]

But perhaps Microsoft should be criticised for releasing a partial fix earlier? For not investigating the earlier problem with enough dilligence?

Perhaps nearly every network enabled software developer should be criticised for the same? I'm sorry, but that was an asinine statement.

Nearly every major piece of software on any OS, especially those that accept network connections have had multiple vulnerabilities over time. Even those developers who are extremely diligent (ie. OpenBSD) have had their share of problems.

Any action on a developers part, especially a proactive one, should be commended..

Re:It ain't necessarily so

[Phexro]

It's a hot thing to do in bed if you're a slutty shaved blonde worth $30m.

It is not a hot thing to do if you're a 300lb, hairy, sweaty slashdot nerd 'flying solo.' I beg you, slashdot readers, don't video tape yourselves in bed.

Re:It ain't necessarily so

[the_mad_poster]

So everyone could get on their ass for slow patching instead?

Look, they patched a hole in a relatively decent period of time. They then patched additional issues quickly as well.

I hate Microsoft too, but for crying out loud... how utterly fucking naive do you have to be to sit there trying to spin reasonable patch fixes against the company? Some people just need to get a life...

Re:It ain't necessarily so

[whoever57]

Perhaps nearly every network enabled software developer should be criticised for the same?

Clearly multiple vulnerabilities exist and are discovered. My issue is that if a new patch is released one day after the first patch was released, it appears that insufficient investigation went into the first problem. One might also want to question the level of quality control that went into the second patch.

Any action on a developers part, especially a proactive one, should be commended.

I agree that Microsoft should be commended for putting out the second patch and not ignoring the issue.

Re:It ain't necessarily so

[Cyno01]

Shes worth $300m, if that makes it any hotter... :p

Re:It ain't necessarily so

[ameoba]

It's a hype thing. Everyone wanted to see it 'cuz "everyone" was looking at it already. When coupled with the fact that she's in the richest 1% of the population, somewhat famous & better looking than most women it's all the more interesting.

But she's not that hot; I can go downtown to any bar in the city & get turned town by a dozen prettier girls.

Re:It ain't necessarily so

[the_mad_poster]

You've got to be kidding me, right? Look, I've got it in for Microsoft-the-monopoly, but not like this. They patched a damn problem and they did it fairly quickly. Even if they goofed on the first one, they took a mere 24 hours (a fairly typical OSS turnaround) to come back and offer reparations for it. Not only did they not drag their feet on the fix, they didn't drag their feet on repairs of a potential oversight from the first one.

Note the bold highlights since it's all speculation as to whether it was their goof or a mere coincidence that additional issues were discovered in the process. Some people are just trying to spin one of Microsoft's rare good moments against them as a knee-jerk reaction. I'm all for alternative OS's and choice, but on technical merit, not knee-jerk anti-MS reactions and unsubstantiated speculation.

Re:It ain't necessarily so

[the_mad_poster]

Exactly - I'm far from a Microsoft fan. I used to sit around saying "well, let's give them the benefit of the doubt", but the more I use MS products, the less I like them and the company that made them. However, in this instance, Microsoft did a good job. STILL there are psychotic zealots trying to spin this against them.

What amazes me is that if you confront these people (likely like whatever moron modded me flamebait while I responded to your sister post) they'll claim they're doing it "for Linux" or something similar, but they don't realize that all they're doing is making those of us who actually LIKE the system for what it is look like frothing dolts who have nothing better to do than invent bizarre, make-believe bullshit against some percieved nemesis.

Re:It ain't necessarily so

[gad_zuki!]

>but re-relasing a new patch at a higher security classification ought to be applauded, not ridiculed.

You're new here aren't you?

This is just our Microsoft Two Minutes of Hate. When you see these posts you're supposed to seeth in rage and imagine Bill Gates.

Perhaps if we weren't such hypocrites we would be taken more seriously and more people would be running Linux for its merits and not for the hype or manufactured political reasons.

The problem.. hmm...

[thrillbert]

I love that headline.. a patch to fix problems.. great.. I'll apply it to my marriage, my job, my car, my bank account (too little money could be a problem).. and I'll apply it twice to my teenage daughter for better results..

I knew eventually microsoft would do something right...

---
Universe, n.:

• The problem.

Re:The problem.. hmm...

[frenetic3]

I'll apply it twice to my teenage daughter for better results..

No sweat dude, I already took care of it.

...okay, okay, I'm going to hell... :)

-fren

Re:The problem.. hmm...

[shadowbearer]

Yeah, but can this patch help me drop my nicotine habit?

*grumbles*

SB

So now there's four 'R's?

[NecroPuppy]

Retry, Reboot, Reapply, and Reinstall...

Re:So now there's four 'R's?

[WorkEmail]

MS releasing patches reminds me of a cartoon character trying to stop a dam from leaking where they are stretching and using poles and brooms and all of their fingers and toes to stop all of the little water leaks.

Re:So now there's four 'R's?

[dasmegabyte]

Really?

It reminds me of a company trying to fix problems with a popular software product so that their customers' computers aren't fucked up by hackers.

But, you know, your cartoon analogy is good, too.

This is consistent

[El]

Remember, to Microsoft it is not an important problem unless they already have a fix for it!

Re:This is consistent

[pointbeing]

Remember, to Microsoft it is not an important problem unless they already have a fix for it!

I know you were kidding around, but -

This is true almost everywhere. If you release information about a vulnerability before you have a fix for it you invite folks to test your shiny new vulnerability ;-)

I've been impressed with MS' stance on security since about last June - but now we see people using MS security bulletins to write worms.

Look at Blaster - MS released a security bulletin and a fix, and Blaster showed up days or weeks later (I think it was about three weeks) to target unprotected machines. IM frequently less than HO if there'd been no security bulletin there'd have been no virus.

This takes us in a new and particularly frightening direction - and puts MS in a no-win situation. Release the security bulletin and patch and wait for users to howl because they didn't think the update was worth their time and their machine got infected?

I think over the next couple years you're gonna see a much more proactive stance from MS on consumer security - and even if they were a little slow on the uptake it's still good to see them taking security seriously now.

More information on the vulnerability

[windows]

More information on the vulnerability can be found here.

Re:More information on the vulnerability

[HFKIRSpyderMonkey]

Subsequent to the release of this bulletin, it was determined that this vulnerability could also affect users who do not have the "Outlook Today" folder home page as their default home page in Outlook 2002. As a result, Microsoft has re-released this bulletin with a new severity rating of "critical" to reflect the expanded attack vector.

Much like other users have suggested, there's no reason in harrassing them. They discovered the patch was exploitable on a wider scale than previously thought, and quickly released a patch to address it. No biggie.

Two bugs in one place

[Anonymous Coward]

As I recall it took more than 24 hours for the second bug in the mremap function to be found in Linux. While bashing MS is always fun & exciting (and I do think their security sucks). I think Slashdot should try to post more stories about how Linux could be improved (security & functionality). Not to imply that Linux is bad, but there is this reactionary attitude where we must adapt to everything MS does as opposed to doing things first. No Longhorn till 2006 should not mean we sit around waiting for MS to come out with something to whine about. It should be seen as an opportunity to evolve Linux in new directions that MS can't emulate. Don't be afraid to embrace changes that could propel us way ahead of them.

Re:Two bugs in one place

[KingOfBLASH]

One of the nremap bugs posted on slashdot was really a dupe. It was the same thing and already fixed. At least, that's what I was told. See this thread on LinuxQuestions.org

Re:Two bugs in one place

[rew]

It was the same thing and already fixed

Wrong. There were two mremap bugs. Regretfully, some people with the right background didn't have time to look at the bug and the fix before the first one went public. So a second public fix was needed.

Facts of life?

[nmoog]

"People have resigned themselves to this being a fact of life. "

Life, death, taxes, and patching flaky patches.

Re:Yo

[Canadian1729]

and Linux has never released a security patch..or two patches in 24 hours?

Patches

[black mariah]

Exactly how is this different from the multitude of patches to fix things in the Linux kernel? Or patches in ANY OSS project? Are you trying to tell me that there has never been a security patch to any Linux kernel ever?

I seem to recall a /. story just a short while back about a security vulnerability in the Linux kernel that was patched and te resulting posts were nothing but a bunch of open source taint nuzzling. When MS fixes a problem on the other hand, it's a bad thing.

Re:Patches

[rusty0101]

Nope. When Microsoft releases a patch, it's not always good or bad. I think that most people would catagorize what is updated into one of three catagories,

Good thing: patches that prevent remote exploits of upnp, remote takeover via corrupted mp3 files, or valid mp3 files with embeded URL's to locations that allow script kiddies to make use of your computer, and the like.

Bad thing: patches that update the EULA to allow Microsoft to keep track of what music, videos, etc. you like to pay attention to. Patches that break your firewall, knocking you off the Internet completely.

WTF?: stuff that gets tossed in, updating files that do not seem to have anything to do with the documented issues that the patch supposedly addresses.

Then again, how many of us know exactly what each file in the Windows package is responsible for what actions? Not a lot of us. So if you do a md5sum catalog of the files on your system, install the patch, then compare the md5sums and discover a bunch of files that you can't explain have been changed, who would you go to?

As far as comparing it to patches for Linux, again, there really are not all that many people who know exactly what every line affected by a patch does, but you can at least look for yourself, and if you have questions, there there are an abundance of people who _can_ read the affected files, with understanding, who can explain what the patch does affect.

Then again what do I know, I only use Win2kP, and a couple different distributions of Linux. I'm probably some crazy Linux advocate who would threaten your very existance if you said anything realy bad about Linux.

-Rusty

Uh....

[mrseigen]

So what, they did a dupe?

Apache OS

[Eberlin]

Ok, ok, patching is a part of life -- that's understood. We have to patch our Linux installs too, after all. However, the Linux community doesn't seem to wrap itself in this strange PR shroud that MS does. You know the one -- how hackers are good for testing MS software and then how hacks aren't found until after MS releases a patch...oh and this business about making patch management easier by bundling patches monthly instead of releasing them sooner to protect their customers from harm.

Right. So here we have a patch that should've probably been QA-ed to death (since they're doing this monthly instead of knee-jerk) and then later issuing another patch to properly plug the hole.

I guess after they um...opened the source to some of Windows, they're only following suit by doing the "Release early, release often" mantra. Next thing we know, they'll be sponsoring Linux-friendly news sites and even exhibiting in Open Source conventions.

Re:Apache OS

[Anonymous Coward]

The patch itself was fine. Re-issuing the patch (in this case) means that they changed the severity level. It doesn't mean that they changed the code or that the original patch had some problems with it.

Also, the monthly patch release scenario is NOT for critical security updates, but non-security bugfixes. Security-related patches are released as often as need be.

that patch must be huge

[minusthink]

"Microsoft Rereleases Patch to Fix Problems"

all of them?

Re:that patch must be huge

[dynamo]

No, the EULA reads 'Caveat Emptor'.

Great choice of article

[mattgreen]

I applaud the Slashdot editors once again in choosing a relevant and timely news story. Never before has a patch been reissued. This is surely a momentous day on the Internet.

Plus we can have a chance to talk about how our favorite operating system would never do such a thing! This IS a great post!

They did not re-issue a new patch!

[Nevo]

It's the same patch they released yesterday. They just discovered it's more serious than they first thought, so they released the same binaries with a higher severity.

http://www.microsoft.com/technet/security/bullet in/ms04-009.mspx

Read the revisions section

Re:They did not re-issue a new patch!

[Nevo]

Just to quote the relevant section:

Why is Microsoft re-issuing this bulletin
Subsequent to the release of this bulletin, it was determined that this vulnerability could also affect users who do not have the "Outlook Today" folder home page as their default home page in Outlook 2002. As a result, Microsoft has re-released this bulletin with a new severity rating of "critical" to reflect the expanded attack vector. The update released with the original version of this security bulletin is effective in protecting from the vulnerability and users who have applied the update or have installed Office XP Service Pack 3 do not need to take additional action.

Re:They did not re-issue a new patch!

[AbdullahHaydar]

Wrong! From the microsoft patch site:

• V1.0 (March 9, 2004): Bulletin published
• V2.0 (March 10, 2004): Bulletin updated to reflect on a revised severity rating of Critical and to advise of a new client update.
• V2.1 (March 10, 2004): Frequently Asked Question "What is the scope of the vulnerability?" updated.

Re:They did not re-issue a new patch!

[praxis]

Right! From the microsoft patch site:

"In addition, Microsoft is making available an additional "client update" for customers on the Microsoft Download Center. This additional update does not contain new fixes or functionality, but is instead an additional offering of the update that provides an alternative for customers. More information on the client update is available in the Security Update Information section."

They re-issued the bulletin to upgrade the security rating to "critical" due to new information. See here:

"Subsequent to the release of this bulletin, it was determined that this vulnerability could also affect users who do not have the "Outlook Today" folder home page as their default home page in Outlook 2002. As a result, Microsoft has re-released this bulletin with a new severity rating of "critical" to reflect the expanded attack vector. The update released with the original version of this security bulletin is effective in protecting from the vulnerability and users who have applied the update or have installed Office XP Service Pack 3 do not need to take additional action. "

Excuse me...

[Quinn_Inuit]

"The funny thing"? The funny thing? That's like walking out of a Monty Python show and saying, "Man, that one joke was really funny."

Anyone else notice...

[ManxStef]

...the broken PGP signature on the e-mail update Microsoft sent round relating to this? (The original was fine.) Just seemed a bit sloppy from a company who's now supposed to be taking security so seriously is all...

BTW The Register chastised MS for marking the original as only "important", looks like they were right on the money!

Re:What about the recent Linux kernel vulnarabilit

[toltas]

How is this completely ignored(march 7th 11:22AM)?

I think you should read more slashdot before thinking they arent up to snuff with their vulnarability reporting.

new method

[firstadopter.com]

Microsoft needs a new method of installing these patches. How many us have spent HOURS a day installing and installing and rebooting and rebooting.

Re:new method

[value_added]

FWIW, you can use Microsoft's qchain utility that purportedly allows you to apply several patches a single reboot. Haven't tried it yet, as my hours are still being spent trying to figure out what patches I need on my systems. Seems that between the Windows update site, the HFNetChk commandline utility, and a handful of patch management programs I've been looking at, I'm getting a variety of results as to what's needed and what's been installed.

If anybody has any favourite suggestions for managing this mess, I'm all ears.

Re:new method

[agallagh42]

Qchain is no longer required to install multiple patches with a single reboot. Qchain functionality has been included in all windows patches for a while now. Just hit "no" when it asks you to reboot, then reboot manually when you've installed them all. If you want to script it, there are command line switches for all the patches allowing silent installs with no reboot.

Also, you should be using the new MBSA (Microsoft Baseline Security Analyser) instead of HFNetChk.

Another great tool is SUS (Software Update Services). It's basically in internal copy of Windows Update, where you can approve patches that you've tested, and the clients will then pull approved updates down automatically according the schedule you set. Set the schedule via AD group policy, by manually editing the registry, or with a logon script.

Everytime a story like this is posted....

[gatkinso]

....I am tempted to check the kernel cvs source tree history.

But why inject objectivity and reality into an otherwise excellent discussion?

Us vs Them

[Anonymous Coward]

Don't be afraid to embrace changes that could propel us way ahead of them.

So this is what it's come down to? How many people share the "us" vs. "them" mentality? I thought people contributed to Linux in order to take part in something greater than what they could do alone, rather than as a way of beating Gates & Co.

I know, I know... I must be new around here.

Patch requires install CDs

[mmusson]

I tried to install the first patch last night and found that I had to apply office SP2 first. Ok. So, I ran office SP2 and it required the install CDs.

I travel extensively for work and I don't carry around all my install CDs for my laptop. So, I cannot even install the critical security patch because I cannot install office SP2.

I think this is a problem when people that would want to install this 'critical' security patch are not able to. Why can't this patch be stand-alone (not require install CDs) like the ones available from the windows update site?

Re:Patch requires install CDs

[enosys]

Office XP SP3 also fixes the problem. You can get a version of SP3 that doesn't require access to the install CDs:
OfficeXpSp3-kb832671-fullfile-enu.exe 58925 KB

attention moderators

[GunFodder]

Please moderate this story as both "Redundant" and "Flamebait" (definitely not clever enough to be a "Troll"). What, we're not allowed to moderate stories? Sounds like Slashdot needs a patch...

Must have CD to install

[ccnull]

How aggravating that many people won't install these service packs because Microsoft requires you have the original CD to install them.

There is a workaround: Download the larger (the 58MB one with "fullfile" in the name) file on this page here and you can do the update without a CD.

Re:Must have CD to install

[ccnull]

... on second analysis, this method has now failed on 2 different machines -- both of which asked me for the CD despite being eligible for the CD-free patch per Microsoft's own rules. Use at your own risk, folks! (And apologies if I led anyone astray...)

My copy of Office must not need the patch...

[pdcryan]

...because when right click on the paperclip and ask it if there is a security problem... and he told me Word already had security features.

Thank god!

Re:What about the recent Linux kernel vulnarabilit

[Anonymous Coward]

Not only that, but the response times on the Linux patches were seven months faster than Microsoft's response time, the patches and vulnerabilities were both well (and correctly) documented due to better research than the Microsoft patch, AND that the Linux exploits required you to have local access to the machine, and the Microsoft vuln was remotely exploitable. They're soooooo similar!

Re:Press the ReDo button.....

[rusty0101]

As opposed to releasing a patch that breaks a previous patch? As was the primary problem with the SQL issue that SQL slammer exploited?

Re:What about the recent Linux kernel vulnarabilit

[U.I.D 754625]

Your sig: I'm being modbombed for my opinions. Check my posting history.

No... you're getting modded down because you're wrong.

Of course we could read the updated bulletin

[TheRealSlimShady]

Straight from the horses mouth:

The update released with the original version of this security bulletin is effective in protecting from the vulnerability and users who have applied the update or have installed Office XP Service Pack 3 do not need to take additional action.(emphasis mine)

In addition, Microsoft is making available an additional "client update" for customers on the Microsoft Download Center. This additional update does not contain new fixes or functionality, but is instead an additional offering of the update that provides an alternative for customers. More information on the client update is available in the Security Update Information section.

So they didn't actually release a new update, just a new way of applying the update, and they increased the importance.

My question is...

[Anonymous Coward]

So does this patch require a restart? Because I'd hate to lose my 8 hours of uptime.

Not the first time?

[loconet]

correct me if I'm wrong but it seems like this is not the first time Microsoft is wasting customer's time:

It seems like a patch for SP1 Internet explorer 6.0 (released released February 2, 2004 - KB832894) also broke functionality on several websites in the form of displaying "HTTP 500 internal server error" messages for no reason. 5 days later they released a patch to fix the patch.

Slashdot is so biased

[Anonymous Coward]

"As a result, Microsoft has re-released this bulletin with a new severity rating of "critical" to reflect the expanded attack vector. The update released with the original version of this security bulletin is effective in protecting from the vulnerability and users who have applied the update or have installed Office XP Service Pack 3 do not need to take additional action. "

" In addition, Microsoft is making available an additional "client update" for customers on the Microsoft Download Center. This additional update does not contain new fixes or functionality, but is instead an additional offering of the update that provides an alternative for customers. More information on the client update is available in the Security Update Information section."

"AbdullahHaydar writes "From CRN: 'One day after releasing a fix for an Office XP flaw, Microsoft upgraded the severity of the vulnerability to critical and re-issued a new patch to address a new attack scenario discovered in the last 24 hours.' The funny thing is that the second bug they missed with the first fix is 'critical' whereas the original bug the fix was for is 'important.'"

What a deliberate trick. Bias at its worst. Why don't people check their sources?

Why can't we moderate news as Moronic or better yet moderate people as Stupid?

Good response time

[Gary Destruction]

It shows that Microsoft is taking things more seriously. And maybe next time, maybe they'll catch more potential problems before they're discovered. If MS were to actually break itself up into smaller companies, it wouldn't have to worry about keep tabs on so much stuff. I know it won't do that, but I think it would be alot more efficient. When it comes to patches, Microsoft is like a giant. Someone hits it on the leg, so it has to look down and find the source of the attack and fix it. But at the same time, someone could be attacking it on the back and neck.

What Differentiates Linux from Windows

[jlrowe]

It is odd that only moments after reading about 'What differentiates Linux from Windows', how the very design of Windows leads to problems making fixes for security things gone wrong, the story of this latest patch problem appears. It is verification of the story I just read, in perfect example.

Synopsis:
Microsoft reacts to marketing pressure to make design decisions favoring running a few processes faster but then finds itself forced first to layer in backward compatibility and then to engage in a patch-and-kludge upgrade process until the code becomes so bloated, slow and unreliable that wholesale replacement is again called for.

I grow weary...

[Epistax]

of these threatening severity levels. I will install no patch less severe than "orgasmic" or possiblity "chocolicious".

New Service Pack

[CycoChuck]

I heard that MS is releasing a new SP for Office that would fix all the problems. They're calling it OpenOffice. The new Windows SP, code named Linux, is suppose to be released soon as well.

Nice headline

[Anonymous Coward]

My first thought was, "Damn, that would be a tremendous patch."

Download?

[utlemming]

And the big problem of the day is that you cannot download the file, because, well Microsoft is having problems with their website. Go figure. I mean, they say that the file is a critical upgrade, and then it is inaccessable. You would think that for the $300-$800 people pay for Office, they would at least have the bandwidth to get critical patches.

Re:Download?

[utlemming]

Just another update -- they removed the link, as of 8:32MST, from the download page. The link is here. Which is rather interesting. Too much demand or did they find another bug?

What Else is a Patch For?

[handy_vandal]

Microsoft Rereleases Patch to Fix Problems

Well, that's a relief -- could be worse -- imagine a headline that reads "Microsoft Rereleases Patch to Cause Problems" ....

-kgj

The thing is

[uptownguy]

I get your anger at... but I think you are missing the forest for the trees when you say things like "Slashdotters don't care much about the truth as long as they can whine... If they're not complaining...when did anyone on Slashdot..." Come on. Slashdot isn't some monolithic discussion board. That's what makes it great. That's why YOU come here and that's why YOU post. It's because Slashdot is the home the great unwashed masses -- the strongest from every side here come to passionately defend their case. You never see one "side" persuaded... you don't ever get to see one side win...

...but I don't know. I come here, not to have my point of view reinforced but rather to read intelligent people discussing an issue. I don't spend all my time discussing issues. I go out with friends to bars. I watch movies. But sometimes I like to think about issues. And this is a great place to come to find ideas. Sometimes I even find myself being surprised by a different point of view...

I just think the parent post dripped with a little too much bravado. And just to stay on topic ... wouldn't you say that the VAST MAJORITY of us are just keeping quiet on this because there isn't that much insightful to say? I mean, really, releasing patches of known vulnerabilities is a good thing. Duh.

critical second patch

[natex84]

the second patch was critical? whaddya bet it fixed a new, more serious hole introduced by the first patch? :P

But they had enough time to find out before!

[Slashi]

The timeline of the vulnerability tells us that Microsoft was informed November 12, 2003. Now, they got 4 months to find a patch and release their security bulletin. Couldn't they find out that it was more critical in the 24*30*4 hours before?

From MS04-009:
Reason for Major Revision
Subsequent to the release of this bulletin, it was determined that this vulnerability could also affect users who do not have the "Outlook Today" folder home page as their default home page in Outlook 2002. As a result, Microsoft has re-released this bulletin with a new severity rating of "critical" to reflect the expanded attack vector.

What the heck? Does the severity of a bug depend upon how much people are affected?

Does a local root depend upon the number of people who are potentially affected? Ask someone who has lost money via such a local root.

Another interesting posting is available on full-disclosure mailing list, covering Microsoft's understanding of "security" (the Author, Nick FitzGerald, is a helpful and understanding regular poster on full-disclosure)