Slashdot Mirror
Microsoft Rereleases Patch to Fix Problems
AbdullahHaydar writes "From CRN: 'One day after releasing a fix for an Office XP flaw, Microsoft upgraded the severity of the vulnerability to critical and re-issued a new patch to address a new attack scenario discovered in the last 24 hours.' The funny thing is that the second bug they missed with the first fix is 'critical' whereas the original bug the fix was for is 'important.'"
The fact that 24 hours after releasing an 'important' bug patch, Microsoft re-released a 'critical' bugpatch should *not* be held against them! It certainly would not be the first time someone had realised that the consequences of X are far more than previously thought.
:-), but re-relasing a new patch at a higher security classification ought to be applauded, not ridiculed. Fair play, guys, and play the game according to *all* the rules, not just the "Redmond -4" ruleset...
I'm no apologist for MS (see my posting history
Simon
Physicists get Hadrons!
I knew eventually microsoft would do something right...
---
Universe, n.:
Remember, to Microsoft it is not an important problem unless they already have a fix for it!
"Freedom means freedom for everybody" -- Dick Cheney
More information on the vulnerability can be found here.
As I recall it took more than 24 hours for the second bug in the mremap function to be found in Linux. While bashing MS is always fun & exciting (and I do think their security sucks). I think Slashdot should try to post more stories about how Linux could be improved (security & functionality). Not to imply that Linux is bad, but there is this reactionary attitude where we must adapt to everything MS does as opposed to doing things first. No Longhorn till 2006 should not mean we sit around waiting for MS to come out with something to whine about. It should be seen as an opportunity to evolve Linux in new directions that MS can't emulate. Don't be afraid to embrace changes that could propel us way ahead of them.
Exactly how is this different from the multitude of patches to fix things in the Linux kernel? Or patches in ANY OSS project? Are you trying to tell me that there has never been a security patch to any Linux kernel ever?
/. story just a short while back about a security vulnerability in the Linux kernel that was patched and te resulting posts were nothing but a bunch of open source taint nuzzling. When MS fixes a problem on the other hand, it's a bad thing.
I seem to recall a
'Standards' in computing only impress those who are impressed by things like 'standards'.
Ok, ok, patching is a part of life -- that's understood. We have to patch our Linux installs too, after all. However, the Linux community doesn't seem to wrap itself in this strange PR shroud that MS does. You know the one -- how hackers are good for testing MS software and then how hacks aren't found until after MS releases a patch...oh and this business about making patch management easier by bundling patches monthly instead of releasing them sooner to protect their customers from harm.
Right. So here we have a patch that should've probably been QA-ed to death (since they're doing this monthly instead of knee-jerk) and then later issuing another patch to properly plug the hole.
I guess after they um...opened the source to some of Windows, they're only following suit by doing the "Release early, release often" mantra. Next thing we know, they'll be sponsoring Linux-friendly news sites and even exhibiting in Open Source conventions.
I applaud the Slashdot editors once again in choosing a relevant and timely news story. Never before has a patch been reissued. This is surely a momentous day on the Internet.
Plus we can have a chance to talk about how our favorite operating system would never do such a thing! This IS a great post!
http://www.microsoft.com/technet/security/bullet in/ms04-009.mspx
Read the revisions section
"The funny thing"? The funny thing? That's like walking out of a Monty Python show and saying, "Man, that one joke was really funny."
Stop learning! Only you can prevent esoterrorism.
...the broken PGP signature on the e-mail update Microsoft sent round relating to this? (The original was fine.) Just seemed a bit sloppy from a company who's now supposed to be taking security so seriously is all...
BTW The Register chastised MS for marking the original as only "important", looks like they were right on the money!....I am tempted to check the kernel cvs source tree history.
But why inject objectivity and reality into an otherwise excellent discussion?
I am very small, utmostly microscopic.
I tried to install the first patch last night and found that I had to apply office SP2 first. Ok. So, I ran office SP2 and it required the install CDs.
I travel extensively for work and I don't carry around all my install CDs for my laptop. So, I cannot even install the critical security patch because I cannot install office SP2.
I think this is a problem when people that would want to install this 'critical' security patch are not able to. Why can't this patch be stand-alone (not require install CDs) like the ones available from the windows update site?
SYS 49152
How aggravating that many people won't install these service packs because Microsoft requires you have the original CD to install them.
There is a workaround: Download the larger (the 58MB one with "fullfile" in the name) file on this page here and you can do the update without a CD.
filmcritic.com - Movie reviews on Internet time
...because when right click on the paperclip and ask it if there is a security problem... and he told me Word already had security features.
Thank god!
Ryan Kennedy opposes comm
So does this patch require a restart? Because I'd hate to lose my 8 hours of uptime.
FWIW, you can use Microsoft's qchain utility that purportedly allows you to apply several patches a single reboot. Haven't tried it yet, as my hours are still being spent trying to figure out what patches I need on my systems. Seems that between the Windows update site, the HFNetChk commandline utility, and a handful of patch management programs I've been looking at, I'm getting a variety of results as to what's needed and what's been installed.
If anybody has any favourite suggestions for managing this mess, I'm all ears.
Really?
It reminds me of a company trying to fix problems with a popular software product so that their customers' computers aren't fucked up by hackers.
But, you know, your cartoon analogy is good, too.
Hey freaks: now you're ju
of these threatening severity levels. I will install no patch less severe than "orgasmic" or possiblity "chocolicious".
I heard that MS is releasing a new SP for Office that would fix all the problems. They're calling it OpenOffice. The new Windows SP, code named Linux, is suppose to be released soon as well.
Windows is as solid as quicksand.
I get your anger at... but I think you are missing the forest for the trees when you say things like "Slashdotters don't care much about the truth as long as they can whine... If they're not complaining...when did anyone on Slashdot..." Come on. Slashdot isn't some monolithic discussion board. That's what makes it great. That's why YOU come here and that's why YOU post. It's because Slashdot is the home the great unwashed masses -- the strongest from every side here come to passionately defend their case. You never see one "side" persuaded... you don't ever get to see one side win...
...but I don't know. I come here, not to have my point of view reinforced but rather to read intelligent people discussing an issue. I don't spend all my time discussing issues. I go out with friends to bars. I watch movies. But sometimes I like to think about issues. And this is a great place to come to find ideas. Sometimes I even find myself being surprised by a different point of view...
... wouldn't you say that the VAST MAJORITY of us are just keeping quiet on this because there isn't that much insightful to say? I mean, really, releasing patches of known vulnerabilities is a good thing. Duh.
I just think the parent post dripped with a little too much bravado. And just to stay on topic
I would have to say that explosives are the most abused technology in all of history.