Slashdot Mirror
Microsoft Rereleases Patch to Fix Problems
AbdullahHaydar writes "From CRN: 'One day after releasing a fix for an Office XP flaw, Microsoft upgraded the severity of the vulnerability to critical and re-issued a new patch to address a new attack scenario discovered in the last 24 hours.' The funny thing is that the second bug they missed with the first fix is 'critical' whereas the original bug the fix was for is 'important.'"
The fact that 24 hours after releasing an 'important' bug patch, Microsoft re-released a 'critical' bugpatch should *not* be held against them! It certainly would not be the first time someone had realised that the consequences of X are far more than previously thought.
:-), but re-relasing a new patch at a higher security classification ought to be applauded, not ridiculed. Fair play, guys, and play the game according to *all* the rules, not just the "Redmond -4" ruleset...
I'm no apologist for MS (see my posting history
Simon
Physicists get Hadrons!
I knew eventually microsoft would do something right...
---
Universe, n.:
Remember, to Microsoft it is not an important problem unless they already have a fix for it!
"Freedom means freedom for everybody" -- Dick Cheney
More information on the vulnerability can be found here.
As I recall it took more than 24 hours for the second bug in the mremap function to be found in Linux. While bashing MS is always fun & exciting (and I do think their security sucks). I think Slashdot should try to post more stories about how Linux could be improved (security & functionality). Not to imply that Linux is bad, but there is this reactionary attitude where we must adapt to everything MS does as opposed to doing things first. No Longhorn till 2006 should not mean we sit around waiting for MS to come out with something to whine about. It should be seen as an opportunity to evolve Linux in new directions that MS can't emulate. Don't be afraid to embrace changes that could propel us way ahead of them.
Exactly how is this different from the multitude of patches to fix things in the Linux kernel? Or patches in ANY OSS project? Are you trying to tell me that there has never been a security patch to any Linux kernel ever?
/. story just a short while back about a security vulnerability in the Linux kernel that was patched and te resulting posts were nothing but a bunch of open source taint nuzzling. When MS fixes a problem on the other hand, it's a bad thing.
I seem to recall a
'Standards' in computing only impress those who are impressed by things like 'standards'.
Ok, ok, patching is a part of life -- that's understood. We have to patch our Linux installs too, after all. However, the Linux community doesn't seem to wrap itself in this strange PR shroud that MS does. You know the one -- how hackers are good for testing MS software and then how hacks aren't found until after MS releases a patch...oh and this business about making patch management easier by bundling patches monthly instead of releasing them sooner to protect their customers from harm.
Right. So here we have a patch that should've probably been QA-ed to death (since they're doing this monthly instead of knee-jerk) and then later issuing another patch to properly plug the hole.
I guess after they um...opened the source to some of Windows, they're only following suit by doing the "Release early, release often" mantra. Next thing we know, they'll be sponsoring Linux-friendly news sites and even exhibiting in Open Source conventions.
"Microsoft Rereleases Patch to Fix Problems"
all of them?
"when life gets complicated, I like to take a nap in a tree and wait for dinner" - Hobbes.
MS releasing patches reminds me of a cartoon character trying to stop a dam from leaking where they are stretching and using poles and brooms and all of their fingers and toes to stop all of the little water leaks.
I applaud the Slashdot editors once again in choosing a relevant and timely news story. Never before has a patch been reissued. This is surely a momentous day on the Internet.
Plus we can have a chance to talk about how our favorite operating system would never do such a thing! This IS a great post!
http://www.microsoft.com/technet/security/bullet in/ms04-009.mspx
Read the revisions section
"The funny thing"? The funny thing? That's like walking out of a Monty Python show and saying, "Man, that one joke was really funny."
Stop learning! Only you can prevent esoterrorism.
...the broken PGP signature on the e-mail update Microsoft sent round relating to this? (The original was fine.) Just seemed a bit sloppy from a company who's now supposed to be taking security so seriously is all...
BTW The Register chastised MS for marking the original as only "important", looks like they were right on the money!How is this completely ignored(march 7th 11:22AM)?
I think you should read more slashdot before thinking they arent up to snuff with their vulnarability reporting.
....I am tempted to check the kernel cvs source tree history.
But why inject objectivity and reality into an otherwise excellent discussion?
I am very small, utmostly microscopic.
I tried to install the first patch last night and found that I had to apply office SP2 first. Ok. So, I ran office SP2 and it required the install CDs.
I travel extensively for work and I don't carry around all my install CDs for my laptop. So, I cannot even install the critical security patch because I cannot install office SP2.
I think this is a problem when people that would want to install this 'critical' security patch are not able to. Why can't this patch be stand-alone (not require install CDs) like the ones available from the windows update site?
SYS 49152
Please moderate this story as both "Redundant" and "Flamebait" (definitely not clever enough to be a "Troll"). What, we're not allowed to moderate stories? Sounds like Slashdot needs a patch...
How aggravating that many people won't install these service packs because Microsoft requires you have the original CD to install them.
There is a workaround: Download the larger (the 58MB one with "fullfile" in the name) file on this page here and you can do the update without a CD.
filmcritic.com - Movie reviews on Internet time
...because when right click on the paperclip and ask it if there is a security problem... and he told me Word already had security features.
Thank god!
Ryan Kennedy opposes comm
As opposed to releasing a patch that breaks a previous patch? As was the primary problem with the SQL issue that SQL slammer exploited?
You never know...
Your sig: I'm being modbombed for my opinions. Check my posting history.
No... you're getting modded down because you're wrong.
//Blessed are they that run around in circles, for they shall be known as wheels.
The update released with the original version of this security bulletin is effective in protecting from the vulnerability and users who have applied the update or have installed Office XP Service Pack 3 do not need to take additional action.(emphasis mine)
In addition, Microsoft is making available an additional "client update" for customers on the Microsoft Download Center. This additional update does not contain new fixes or functionality, but is instead an additional offering of the update that provides an alternative for customers. More information on the client update is available in the Security Update Information section.
So they didn't actually release a new update, just a new way of applying the update, and they increased the importance.
So does this patch require a restart? Because I'd hate to lose my 8 hours of uptime.
correct me if I'm wrong but it seems like this is not the first time Microsoft is wasting customer's time:
It seems like a patch for SP1 Internet explorer 6.0 (released released February 2, 2004 - KB832894) also broke functionality on several websites in the form of displaying "HTTP 500 internal server error" messages for no reason. 5 days later they released a patch to fix the patch.
[alk]
"As a result, Microsoft has re-released this bulletin with a new severity rating of "critical" to reflect the expanded attack vector. The update released with the original version of this security bulletin is effective in protecting from the vulnerability and users who have applied the update or have installed Office XP Service Pack 3 do not need to take additional action. "
" In addition, Microsoft is making available an additional "client update" for customers on the Microsoft Download Center. This additional update does not contain new fixes or functionality, but is instead an additional offering of the update that provides an alternative for customers. More information on the client update is available in the Security Update Information section."
"AbdullahHaydar writes "From CRN: 'One day after releasing a fix for an Office XP flaw, Microsoft upgraded the severity of the vulnerability to critical and re-issued a new patch to address a new attack scenario discovered in the last 24 hours.' The funny thing is that the second bug they missed with the first fix is 'critical' whereas the original bug the fix was for is 'important.'"
What a deliberate trick. Bias at its worst. Why don't people check their sources?
Why can't we moderate news as Moronic or better yet moderate people as Stupid?
FWIW, you can use Microsoft's qchain utility that purportedly allows you to apply several patches a single reboot. Haven't tried it yet, as my hours are still being spent trying to figure out what patches I need on my systems. Seems that between the Windows update site, the HFNetChk commandline utility, and a handful of patch management programs I've been looking at, I'm getting a variety of results as to what's needed and what's been installed.
If anybody has any favourite suggestions for managing this mess, I'm all ears.
It shows that Microsoft is taking things more seriously. And maybe next time, maybe they'll catch more potential problems before they're discovered. If MS were to actually break itself up into smaller companies, it wouldn't have to worry about keep tabs on so much stuff. I know it won't do that, but I think it would be alot more efficient. When it comes to patches, Microsoft is like a giant. Someone hits it on the leg, so it has to look down and find the source of the attack and fix it. But at the same time, someone could be attacking it on the back and neck.
Really?
It reminds me of a company trying to fix problems with a popular software product so that their customers' computers aren't fucked up by hackers.
But, you know, your cartoon analogy is good, too.
Hey freaks: now you're ju
of these threatening severity levels. I will install no patch less severe than "orgasmic" or possiblity "chocolicious".
I heard that MS is releasing a new SP for Office that would fix all the problems. They're calling it OpenOffice. The new Windows SP, code named Linux, is suppose to be released soon as well.
Windows is as solid as quicksand.
My first thought was, "Damn, that would be a tremendous patch."
Qchain is no longer required to install multiple patches with a single reboot. Qchain functionality has been included in all windows patches for a while now. Just hit "no" when it asks you to reboot, then reboot manually when you've installed them all. If you want to script it, there are command line switches for all the patches allowing silent installs with no reboot.
Also, you should be using the new MBSA (Microsoft Baseline Security Analyser) instead of HFNetChk.
Another great tool is SUS (Software Update Services). It's basically in internal copy of Windows Update, where you can approve patches that you've tested, and the clients will then pull approved updates down automatically according the schedule you set. Set the schedule via AD group policy, by manually editing the registry, or with a logon script.
Carpe Cerevisi - Seize the Beer
I get your anger at... but I think you are missing the forest for the trees when you say things like "Slashdotters don't care much about the truth as long as they can whine... If they're not complaining...when did anyone on Slashdot..." Come on. Slashdot isn't some monolithic discussion board. That's what makes it great. That's why YOU come here and that's why YOU post. It's because Slashdot is the home the great unwashed masses -- the strongest from every side here come to passionately defend their case. You never see one "side" persuaded... you don't ever get to see one side win...
...but I don't know. I come here, not to have my point of view reinforced but rather to read intelligent people discussing an issue. I don't spend all my time discussing issues. I go out with friends to bars. I watch movies. But sometimes I like to think about issues. And this is a great place to come to find ideas. Sometimes I even find myself being surprised by a different point of view...
... wouldn't you say that the VAST MAJORITY of us are just keeping quiet on this because there isn't that much insightful to say? I mean, really, releasing patches of known vulnerabilities is a good thing. Duh.
I just think the parent post dripped with a little too much bravado. And just to stay on topic
I would have to say that explosives are the most abused technology in all of history.