Microsoft Releases Critical IE Patch

Laura Brown writes "Microsoft has released its security software patches for April. The most anticipated is the MS06-013 patch, which fixes several IE bugs, including the "create TextRange ()" vulnerability. Hackers had been exploiting this problem by installing unauthorized software on PCs. "

Comments

The Exploit

[eldavojohn]

The Exploit If you want to know more about the exploit that this release is supposed to fix, here is a shellcoded from of it (dated 03.22.2006).

And here's Microsoft's acknowledgement of the exploit (dated 03.23.2006).

And here's an "expert" saying that releasing the above exploit is irresponsible (dated 03.24.2006).

It is now 04.12.2006 and a patch is out to correct it.

*checks his watch*

Not bad, but your response time could use some imporvement.

Re:The Exploit

[Ravatar]

It was released on the second Tuesday of the month (April 11). Microsoft has been releasing fixes on this schedule for several months now, maybe longer. They do this so that every patch on the release board gets the full testing cycle it deserves. Microsoft rarely releases patches off-schedule now.

Re:The Exploit

[Billosaur]

Not bad, but your response time could use some imporvement.

From TFA: Microsoft Corp. has released its security software patches for April...

Microsoft has adopted the policy of "no patch before its time." These patches must be left on the vine, to ripen in the sun, until they are full of succulent flavor that brings out the best in an OS... sorry... anyway, it didn't matter how important the exploit was or that it was compromising machines left and right and letting the botnetters have a field day, Microsoft was in no rush. And you have to admit, that 3 weeks is not bad compared to some exploits which seem to be out there for months before anything is done. Now if Oracle could get their patch time down to three weeks...

Re:The Exploit

[Bromskloss]

The Exploit If you want to know more about the exploit that this release is supposed to fix, here is a shellcoded from of it

Good link. Thanks. Anyone knows what it does? All the code comment says is "Impact: Remote System Access", and it's hard to read the bulk data.

Re:The Exploit

[truthsearch]

Considering the Windows Help system was exploitable for 7 years I'd say they're improving, although they still are usually too slow. Today there's no way to know how long they're aware of any bug. They may know about an exploit for years and just never publicly notify anyone. Or they may not know until a few days before they acknowledge it. Being a closed system that they work under (both software and business) we'll never really know.

Re:The Exploit

[I'm Don Giovanni]

Being a closed system that they work under (both software and business) we'll never really know.

And yet Mozilla/Firefox keeps security bugs off of the public bugs list until they are fixed, so you don't know how long Mozilla devs know about security bugs before fixing them either.

Re:The Exploit

[mav[LAG]]

That's as may be - it's still a patch.

Re:The Exploit

[Billosaur]

We use only the finest monthly patches, dew picked and flow from Redmond, cleansed in the finest quality review process, lightly killed, and sealed in a succulent, Swiss, quintuple-smooth, treble-milk chocolate update, and lovingly frosted with reboots.

This patch should come with a big red label: "WARNING: BALLMER VOMIT!"

Apparently levity now rates an "Offtopic"; will someone mod the parent of this reply up a bit?

Re:The Exploit

[bunratty]

Brilliant idea: just look at the date the bug was opened. I know, I can't believe I figured it out on my own either! ;-)

Re:The Exploit

[darkonc]

It's not that Microsoft waited until the patch was 'perfect' to release it. It's that somebody in marketing determined that it's hurting their public image to be releasing 'critical security releases' 2-3times per week/month/day (depending on how bad the week/month/day is). Instead, they're now releasing patches on a fixed monthly schedule no matter when the fix is ready.

This makes things easier on the marketing people who don't have to deal with complaints about security patches coming out far too often, but it also means that customers can be exposed to serious (effectively 'zero-day')exploits for up to a month at a time before MS's monthly release kicks in.

In time, we're going to see hackers 'releasing' their exploits on the Wednesday after patch-day to maximize how many machines they can exploit before the next MS 'patch day'.` It's a stupid way of 'serving your customer'.

ActiveX, Java and Flash controls may be impacted

[Dynamoo]

Bundled in with this patch is a change to the behaviour of embedded controls in IE6 on Windows XP, due to the Eolas patent issue. This means that things like Flash navigation or Java widgets might not work without being clicked first to activate. TechWeb have a good article with a summary of the changes, along with some links elswhere.

This won't affect IE6 on Windows 2000, and it's worth noting that things like Flash will work just fine in Firefox, Mozilla or Opera on Windows too.

Re:"Hackers"

[lathama]

Anyone smarter than the writer is a hacker. To quote a client: "Hackers should be jailed unless they are working for me."

Dammed if they do, dammed if they do not..

[Tominva1045]

If they don't update their products people will comment on how much they suck.

If they do update them people will claim instability due to the number of patches.

It's a matter of perception. Some people see ongoing updates as true support. Others simply hate anything Microsoft.

You decide.

Re:Dammed if they do, dammed if they do not..

[Foofoobar]

Most open source projects of equivalent size get patched in 24 hours. Do they have more money? no. Do they have more resources? According to Microsoft, thats another no.

So how is it that programmers working for free developing a product for free can patch fatser than a multimillion dollar company with hundreds of highly paid developers?

That's the ongoing question.

Re:Dammed if they do, dammed if they do not..

[thrillseeker]

If they don't update their products people will comment on how much they suck. If they do update them people will claim instability due to the number of patches. It's a matter of perception.

No, it's a matter of quality. If the product had been built properly in the first place this vicious cycle would never have been born. However, it was not built that way. You pay now or you pay later - but you do pay, and later always costs more.

Re:Dammed if they do, dammed if they do not..

[Nasarius]

Maybe because the Opensource developer is not responsible if the patch / update breaks something else?

Legally, neither is Microsoft. Read your EULA.

And in most cases nothing else interacts with or depends on his / their code?

Yeah, nothing interacts with or depends on sendmail, or glibc, or the Linux kernel...

Re:Dammed if they do, dammed if they do not..

[asuffield]

People are not complaining about the patches, they are complaining about the bugs. The unending stream of horribly horribly bad bugs.

It's not news that IE is full of more security holes than a DHS project. Microsoft have had years to sort this mess out.

Have they?

No. We still have multiple grave remotely-exploitable security holes in IE every year.

That's why people complain.

Ongoing updates are not an indication of "true support". Nor are they an indication of hating Microsoft (although I admit, I find your logic for that part quite nonexistant). True support would be providing software that does not have security holes all the fricking time. You *can* get that kind of service, you just can't get it for Microsoft products (and you're going to have to pay for it, so you won't get it from many free software projects either).

Third - Party Patches

[Kijori]

Does anyone know whether this patch will 'play nice' with the third party patches that've been available for a while?

I've been recommending them to anyone that was worried about the vulnerabilies - I wish Microsoft would support them, it's very difficult to convince people that the fact that Microsoft doesn't recommend them is because it's bad PR to be seen having to be helped out, and not that the code is full of viruses that destroy your PC.

Ah well, I only use Windows for gaming anyway.

Schedule Over Security?

[eldavojohn]

They do this so that every patch on the release board gets the full testing cycle it deserves.

Imagine you are Microsoft. This means you have nearly unlimited resources and a consumer base of astronomical proportions. I would imagine that a testing cycle could be accelerated for something as small as patches by a adequately equipped largely staffed team of people who's sole job is to know IE inside and out and study it daily.

The following excerpt is alarming:

Over the past year, Mozilla averaged about 21 days before it issued fixes for flaws in Firefox, compared with the 135 days it took for Microsoft to address problems.

I wasn't aware a cycle constituted 135 days.

Microsoft rarely releases patches off-schedule now.

That's interesting.

I'm surprised to discover that a business to which I have paid loads of money values a schedule over my security. I shall take note of that.

Re:Schedule Over Security?

[Tim C]

Unfortunately Microsoft does listen to its customers, and its biggest (and loudest) customers are corporate IT departments. Those customers have specifically demanded that patches be released on a regular schedule, to ease their own testing and rollout procedures.

No, MS doesn't always release patches as quickly as they could, but in this particular case it certainly looks as though they got it out at the earliest opportunity, where this is defined as "as quickly as the largest proportion of their customer base allows them to".

I'm surprised to discover that a business to which I have paid loads of money values a schedule over my security.

Blame MS for bowing to pressure from their customers; blame the corporations for bringing that pressure to bear in the first place.

Re:Schedule Over Security?

[bunratty]

Couldn't they at least make the patch available ASAP to those who want it ASAP, and roll it out in a monthly patch cycle for those who want a monthly patch cycle? For the number and caliber of computer science researchers Microsoft has at its disposal, and the priority they've put on increased security, it's strange that they somehow haven't figured out how to do this. Is there some issue I'm not understanding?

Re:Schedule Over Security?

[shawnce]

They haven't figured out how to do what? What does making it available ASAP instead of on a schedule that their major corporate customers have strongly requested have to do with "number and caliber of computer science researchers" at Microsoft.

Regardless they will and do relevant testing, takes days to weeks depending on scope of change its effects... sometimes the effects ripple out to third-parties which can further delay deployment.

I generally don't like Windows the product or many of MS current and prior practices but I do understand the issue they face when releasing a patch into such a large and diverse customer ecosystem.

Re:Schedule Over Security?

[boskone]

yes...

many exploits are made by examining the patch, so in most cases, it's better if everyone gets the patch at the same time (crackers and legitimate users) rather than the crackers getting it ahead of business users.

Re:Schedule Over Security?

[DrXym]

Unfortunately Microsoft does listen to its customers, and its biggest (and loudest) customers are corporate IT departments. Those customers have specifically demanded that patches be released on a regular schedule, to ease their own testing and rollout procedures.

There are probably a few issues to consider here. Whether a corporate wants a scheduled regular service you can sure as hell bet they want the option to receive critical patches as soon as humanly possible. They'll wait for the other things, but critical patches should be available out of band. Secondly, there would be nothing to stop MS releasing the hotfix in the meantime via Windows Update since most corporates don't use it anyway.

I think its extremely poor that MS takes so long to fix such an obvious problem. It's more reason if any were needed that a closed source product is no guarantee that it will be any more secure or better supported than an open source one.

Re:Schedule Over Security?

[geobeck]

Unfortunately Microsoft does listen to its customers, and its biggest (and loudest) customers are corporate IT departments. Those customers have specifically demanded that patches be released on a regular schedule, to ease their own testing and rollout procedures.

I call BS on that one. It takes me five minutes to apply a patch to a test machine, and after a suitable test period it takes me another five minutes to walk into the server room, log in to the WSUS server, and approve an update.

If I want to deploy an update off-schedule, it doesn't take a lot of time to do so. And if I don't want to deploy it off-schedule, it can just sit there on WSUS until Patch Tuesday comes around.

Microsoft's patch schedule has nothing to do with its customers' demands, any more than Norton's ridiculous virus update schedule. Saying that they're doing it to satisfy customer requirements is like the sign at Safeway that says "For your convenience, please leave heavy items in the cart." My convenience, my ass. It's because the 16-year-old, 90-pound checkout girl can't lift the 5-gallon water jug I'm buying.

Don't tell me you're doing something for my sake when I know you're doing it for your own business reasons.

Re:Schedule Over Security?

[rs232]

"corporate IT departments .. have specifically demanded that patches be released on a regular schedule"

I work in an IT department. I know of no techie that looks forward to the next round of 'patches`. In fact most/all of them hold off on installing for fear of breaking something.

"blame the corporations for bringing that pressure to bear in the first place."

This could have been written by the MS publicity bureau.
Blame the corporations for the patch cycle and
blame the competitors for MS failing to secure Windows.

"the whole notion of improving software and making it better for users has been attacked because it makes it tough for competitors"

Bill Gates Feb 15 2006

Re:Schedule Over Security?

[adarn]

>Blame MS for bowing to pressure from their customers; blame the corporations for bringing that pressure to bear in the first place.

        Blame microsoft a second time for designing their operating system to be such a nuisance to patch.

Adarn

Re:Schedule Over Security?

[enosys]

However, if information about an exploit is publicly available there is no reason to not get a patch ASAP to those who want that.

Re:Schedule Over Security?

[YU Nicks NE Way]

Actually, that's not true. A patch for a vulnerability often provides a great deal more infomration about the vulnerability than the original exploit, particularly becouse it provides malicious people with code pattern samples which might expose other exploitable code. In that regard, Microsoft's response or providing a workaround to block the attack and then providing a correct and fully tested patch later is better then providing a half-baked patch.

Re:Schedule Over Security?

[MarkByers]

many exploits are made by examining the patch, so in most cases, it's better if everyone gets the patch at the same time (crackers and legitimate users) rather than the crackers getting it ahead of business users.

If there is already an exploit in the wild (with freely available source code) I really don't see how releasing a patch earlier for home users makes it *easier* to exploit.

It's just a poor excuse for being slow to patch.

Re:Schedule Over Security?

[Slime-dogg]

There is still no legitemate reason for them not to make a patch available as soon as they finish it. They can include the patch into their scheduled cycle, but they can also then cater to the early adopters, and those who don't want vulnerable systems laying around.

Re:Schedule Over Security?

[rbochan]

...For the number and caliber of computer science researchers Microsoft has at its disposal, and the priority they've put on increased marketing bullshit, it's strange ...

There, fixed that for you.

Re:Schedule Over Security?

[bunratty]

Regardless they will and do relevant testing, takes days to weeks depending on scope of change its effects... sometimes the effects ripple out to third-parties which can further delay deployment.

Do the testers come in only on certain days of the month? What technical reason is there for delaying patches until a certain day of the month for all users? Why not make the patches available as soon as they're tested for those who want them, and delay them until a monthly rollout for those who want a monthly rollout? Is this an unsolved research problem?

Re:Schedule Over Security?

[conJunk]

not to be an MS fan boi here, but just stop and think for a minute. MS has literaly hundreds of versions of their OSes. All the different language versions. There are well documented examples (ctrl-f for "polish") of specific bugs for specific language versions

There's a *lot* of testing that needs done for a windows fix

Re:Schedule Over Security?

[shaitand]

That depends, I see when exploit code was released into the wild and Microsoft acknowledged it. But how long before that was microsoft made aware of the problem and refused to acknowledge before the developer got frustrated enough to release the code?

Re:Schedule Over Security?

[duh P3rf3ss3r]

The simple solution is to make the system which downloads patches more finely-grained, thereby putting the user in control of the dowload/patch schedule. That way, MS could post patches whenever they felt it appropriate and sysadmins would be responsible for fetching them and installing them as they (sysadmins) see fit. So, for example, a dialogue box something like this.

How do you want to check for and download updates?
1 Check for (Critical/Nice 2 have/Who cares?) updates and download automatically once per (minute/day/week/month/eclipse/millenium) and then (install/don't install) automatically
2 Don't download automatically but notify me when (Critical/Nice 2 Have/Who cares?) updates are available
3 Fuhgeddaboudit -- I'm raw!

Of course, this is a bit simplistic for real purposes but I think you get the drift of what I mean. For command-line users, there should be a way of scheduling a command with these options using cron or whatever Windows has that has cron-like functionality.

Re:Schedule Over Security?

[LO0G]

According to the MSRC blog here, here. and here, they decided not to do an OOB release because the problem was only seen on a limited number of sites and those sites were being taken down as soon as they came up.

Re:Schedule Over Security?

[BeanThere]

Those customers have specifically demanded that patches be released on a regular schedule, to ease their own testing and rollout procedures.

Why, are those customers forced to install it as soon as Microsoft releases it? If they wanted to install it later, they are unable to do so? What's stopping them from waiting? That would not only give them the choice, but give them longer to test the patches first. Yeah I can just picture those alleged customers now: "Hey Microsoft, please give us less choice and greater delays, in fact we demand you do so"

Stop the FUD, thanks.

Re:Schedule Over Security?

[BeanThere]

Actually you've just made an argument for releasing sooner: If the bugs in the patches are caught sooner (because of the 'patch early adopters'), then the corporates will be protected against those exploits because they won't have installed the patches yet and the new improved patch will be out in time for their update schedule.

Re:Schedule Over Security?

[v1]

Nobody forces you to install patches. If you don't want to install an out of schedule patch, then don't. It's not like they're twisting your arm. Run your software update app once a month or set it to only check monthly or on whatever schedule you'd like.

I personally prefer updates to be delivered the day they are available and tested.

The concept of a release date means nothing here anyway. Say the next scheduled patch day is tomorrow. Say you come up with a fix today. Do you release it tomorrow? I wonder? Technically it's Patch Tuesday, so lets go for it! I don't see how this keeping to a schedule does anything to increase testing prior to release.

If they wanted to do something like that, they'd also have to have a limit saying "we will not release a patch on patch tuesday unless it has been in its final form and unmodified/unfixed for the last two weeks." I don't think they work that way.

Any system admin that is complaining about getting patches too often (so long as they are not having to be revised every 2 days to patch the patches!) is lazy on multiple fronts.

If my network just happens to be getting its butt kicked by some script kiddie with a mission, who is MS to decide whether or not I need the patch now ? (sometimes the risk of even bleeding edge beta is the preferred option)

Re:Schedule Over Security?

[MerlTurkin]

All the more reason to use ANOTHER OS. Simple.

Re:Schedule Over Security?

[Ravatar]

It sounds like you're just looking for a poor excuse to bash their patching cycle. There is no perfect solution in this scenario, and they're pandering to the wishes of the majority of their customers.

Re:Schedule Over Security?

[bfischer]

And then you find it causes another problem and bitch because they released it without adequate testing?

Troll?? Pull your head out of your ass, moderator - the above post is exactly what used to happen when MS would release patches on short schedules and something would get broke for certain users.

Re:Schedule Over Security?

[mattsday]

Yeah, because Microsoft has no risk if they release broken patches, optional or not, to its consumer base... Come on! I'm no MS fanboy, but it's easy enough to see that they risk a lot by putting out 'test' patches that haven't gone through all their QA process...

Meanwhile...

[StevenHenderson]

Firefox users point and laugh...

Re:Meanwhile...

[dextromulous]

It's not leaked memory. See Here for details. There is a difference between leaked memory (memory that is completely lost because it will never be deallocated,) and caching (which is what firefox does.)

Seriously though, if it is using 1.5gb of memory, you probably have it to spare, otherwise it wouldn't be using it. If this is still unacceptable, you can TURN IT OFF!

Re:Meanwhile...

[Rasit]

If you had done some coding you should know this. It is not a bug, it is an unplanned feature.

Re:Meanwhile...

[m50d]

And Opera users laugh at both...

Re:Meanwhile...

[dextromulous]

That's a nice link you have there. I love how the "lengthy do-it-yourself process" they state is exactly this: "These memory leaks cause Firefox to not release memory that it is no longer using. 1.5.0.1 fixed several memory leaks. If you have not already, you should upgrade to this release."

Heaven forbid you should have to upgrade a release to fix bugs, oh my!</sarcasm>

Re:Meanwhile...

[dextromulous]

It could be worse, they could be anonymously ridiculing someone's browser preference on the Internet. ... or making a post to point that out, whoops!

Re:I DLed them this AM. A question...

[gregarican]

Probably. There are many hidden places in Windows where the default browser might not be Firefox. For example, if you use Microsoft Lookout and have mail message format set as HTML perhaps. Or certain other apps might launch IE when displaying HTML content too. To play it safe I would download and install the patch.

The Bob Damn them.

[ackthpt]

If they don't update their products people will comment on how much they suck.
If they do update them people will claim instability due to the number of patches.
It's a matter of perception. Some people see ongoing updates as true support. Others simply hate anything Microsoft.
You decide.

I hate the fact I have to purchase anti-viral software even though I exercise great care in what I download, install, execute, etc.

I hate the fact that I have to download patches frequently, which are massive files and I'm still on a dial-up so they can take hours.

I hate knowing something is running on my computer, chewing up CPU time, but because the way the task manager works I can't really see everything that's in memory and running.

The Bob damn them and their monolithic view of the world.

Re:The Bob Damn them.

[sremick]

"I hate the fact I have to purchase anti-viral software even though I exercise great care in what I download, install, execute, etc.

I hate the fact that I have to download patches frequently, which are massive files and I'm still on a dial-up so they can take hours."

Actually, you don't. Because you don't "have to" run Windows. Seriously. I'm not trying to be a prick, but to emphasize that somewhere along the line, the user (you) is choosing to run Windows, so you are choosing to take on all these burdens in the process. You can rid yourself of them simply by choosing any of the other growingly-popular OSes out there. Yes it'd be work. Yes the transition might incurr costs. Yes you might have to switch apps, convert data, retrain. But you are choosing to do it or not do it, regardless. You can choose the one-time painful conversion, or choose to remain in the eternal servitude to the pains of your status quo.

Your choice.

Re:The Bob Damn them.

[westlake]

I hate the fact that I have to download patches frequently, which are massive files and I'm still on a dial-up so they can take hours.

Microsoft releases most patches on the second Tuesday of each month.

The patches are generally small (under 1 MB) and can be automatically downloaded in the background. Let the program do its job and install when you are ready.

Re:The Bob Damn them.

[neoform]

tell that to your boss when he asks you why you don't wanna use the same OS as everyone else at work..

Re:The Bob Damn them.

[sremick]

Since slavery is illegal in most countries, I'm pretty sure you chose your job as well. If you don't like it, find a new job. Otherwise, it still comes down to your own choice. There are plenty of places looking for Mac/Linux/BSD geeks.

I work with Windows at my own job. But I don't pretend that I'm "forced". I chose my job based upon pay, location, etc. I choose to put up with the headaches as a balance taking everything else into account. But no one is holding a gun to my head.

Like I said before... you don't "have to". Somewhere along the line, it's your own choice.

How much longer is this going to be NEWS?

[ink]

All software companies fix bugs all the time. Why do we have to have a story every time a bug is fixed in IE or Firefox...? It boggles the mind.

Re:How much longer is this going to be NEWS?

[castoridae]

Why do we have to have a story every time a bug is fixed in IE or Firefox...?

Because Slashdorks like ourselves keep reading them and posting comments. You can bet if people stopped reading & commenting, the editors would stop posting these stories.

Re:How much longer is this going to be NEWS?

[alphasubzero949]

You must be new...oh...uhm...never mind.

Re:How much longer is this going to be NEWS?

[Cally]

I used to post lots of comments. Now, I never post.

Re:ActiveX, Java and Flash controls may be impacte

[Tackhead]

> Bundled in with this patch is a change to the behaviour of embedded controls in IE6 on Windows XP, due to the Eolas patent issue. This means that things like Flash navigation or Java widgets might not work without being clicked first to activate. TechWeb have a good article with a summary of the changes, along with some links elswhere.
>
>This won't affect IE6 on Windows 2000, and it's worth noting that things like Flash will work just fine in Firefox, Mozilla or Opera on Windows too.

So for the first time in history, IE's more secure out of the box than Firefox and Opera?

"Microsoft: Where information security is the 521,000,001st priority."

Why can't we all have portage

[BoredWolf]

Would it not be better for MS to release individual patches as they are deemed (and I use this word loosely) stable? I can understand the reasoning behind a monthly update, but so many individual users are set for auto-updates. Also, businesses could then install the patches they deem necessary, while avoiding or reverting from patches which cause problems on their networks. This method would prevent the 1-month window (or longer in the case of Service Packs) that hackers have for exploiting a known vulnerability.

Re:Why can't we all have portage

[flight_master]

I agree, but this is part of Microsoft's Business strategy. To one point, it actually helps. I admin quite a few Win2K3 servers, and having all the patches on one day, allows me to go about patching once a month, as opposed to every few days. Just my $0.02

Re:Why can't we all have portage

[BoredWolf]

I understand the problems with updating servers that you point-out. To compare to Linux: you've got your portage tree updates. You don't have to sync every single day and do world updates, but you can if you want. You have options! With this method, you could select which patches you want to implement on a case-by-case basis. When I was working IT a few years back, we NEVER installed Windows Service Packs because of all the known issues with them. If you could break them up into individual patches, you could test them in a contained environment to see what played well with your system and what didn't, then implement your own 'service packs' based on your department's needs/preferences. MS would be smart to realize that they are beginning to make a product that is too large and diverse for them to maintain within a reasonable time frame, and that other groups will eventually capitalize on this by creating their own patches (IE 7, for example). If they would consider moving from their set monthly update scheme, more companies might be willing to upgrade their PCs (from 2000 to XP, let's say). No matter how functional, diverse, or inventive your product is, it isn't worth a penny if you can't fix it when it breaks.

Re:Why can't we all have portage

[Keeper]

Microsoft used to do this: patches were released the instant they left QA. It doesn't work that way you'd hope it to.

The instant you release a patch, you're in a race between "l33t haxx0rs" reverse engineering the patch and the customers applying the patch. Now, this doesn't seem like a big deal when you've just got a single patch you release.

Imagine for a moment you've got 1 patch released per day, every day, for a week. Now imagine how quickly it takes your customer to apply, validate, and deploy each of those patches ... note that patches are released faster than a customer can apply, validate, and deploy each patch.

The net result is that the act of releasing patches as they're available gives the black hats a larger window to reverse engineer and exploit the unpatched binary. For proof, go back a few years and read about the blaster worm.

Now, is this true in all cases (or, specifically in cases where exploits have been made public)? No. However, you still end up with the patch arrival/test collision regardless, and lots of unhappy customers in the process. Microsoft has stated that they would release a patch out of cycle for certain types of problems (ie: a publicly disclosed remote attacks), but in cases where it requires the user to actively "do" something to be attacked I don't blame them for sticking to the cycle.

Re:Why can't we all have portage

[Ash-Fox]

> To compare to Linux: you've got your portage tree updates.

But people who run servers tend to use: Redhat, Debian, Fedora, SuSE, Mandriva more so than Gentoo. Infact, I've never seen a Gentoo server in a commericial setup before.

Re:ActiveX, Java and Flash controls may be impacte

[Takeel]

Bundled in with this patch is a change to the behaviour of embedded controls in IE6 on Windows XP, due to the Eolas patent issue [slashdot.org]. This means that things like Flash navigation or Java widgets might not work without being clicked first to activate. TechWeb have a good article [techweb.com] with a summary of the changes, along with some links elswhere.

Amusingly, this behavior can be disabled with either a patch or a registry change.

Concerning date formats

[Bromskloss]

There was a great post about it.

Re:I DLed them this AM. A question...

[flight_master]

Don't forget all the proprietary apps out there that use the IE ActiveX plugin!

My question about TFA is

[guzzirider]

At what point do the authors of this information just do a search and replace on the last news release for the last patch (last Month, Week Yesterday, 5 minutes ago ...) TFA kind'a looks like a filled out form ...

My other question is when does M$ release the patch that changes activation codes to valid credit card numbers. ?? I guess they could do a rural version that uses the modem to call a 1 - 900 - xxx xxxx

A fix was released long ago

[Jugalator]

Download here

OK, OK, so I wanted to be different from those "get Firefox" jokes!

Re:A fix was released long ago

[WilliamSChips]

Security will be maximum

No it won't

Re:ActiveX, Java and Flash controls may be impacte

[palndron]

The change isn't about security, at least the ActiveX click to activate one is not. It is complience to the patent dispute with Eolas.
They have bundled it WITH the security rollup.

Name change proposal

[Spy der Mann]

Let's rename "Internet Explorer" to "Apache Browser". After all, it's becoming "A patchy" browser! :D

Re:Name change proposal

[revlayle]

argh... NOoooooooooooooooooo... oh, for the love of every thing decent.... i have been puneed to death... *thud*

Shcheduled updates seem counter-intuitive

[multiOSfreak]

I understand that MS releases patches on a scheduled, monthly basis because lots of corporate IT departments demanded it (to make their jobs easier). I understand that; there's at least some logic to it.

What I don't get is why everone else in the world has to have their system unprotected for an extra couple of weeks. Why can't MS release the patches when they are "stable" and let the IT departments schedule their own updates as frequently or infrequently as they see fit? And further, is scheduling really *that* much more important than security for large companies?

Re:Shcheduled updates seem counter-intuitive

[Overly Critical Guy]

I understand that MS releases patches on a scheduled, monthly basis because lots of corporate IT departments demanded it (to make their jobs easier). I understand that; there's at least some logic to it.

I don't think there's logic to it; as you point out, the patches should come out when they're ready. If IT departments want a monthly schedule for patches, they should set one themselves. Why do they have to have Microsoft do it? Nobody's forcing them to install patches right away.

Re:Shcheduled updates seem counter-intuitive

[m50d]

Once a patch is out, every script kiddie on the planet can see what it fixes and exploit it. Until then you're only vulnerable to the moderately skilled.

Re:Shcheduled updates seem counter-intuitive

[limabone]

I agree. Release the patches when they are ready, and let the companies decide when to patch by implementing WSUS in their site:
http://www.microsoft.com/windowsserversystem/updat eservices/default.mspx
This way everyone gets what they want. Home users can be protected immediately, for corporate users using WSUS, they get to maintain their status quo. This would even be better for some corporate users who would like to patch quicker.

Re:Shcheduled updates seem counter-intuitive

[TheRaven64]

The theory goes that a lot of exploits are generated by running diffs of the pre- and post-patched versions of files. If MS releases patches in an ad-hoc fashion, then there is likely to be a longer delay between releasing the patches and them being applied. This delay is the time in which most MS malware strikes. By releasing them on a regular schedule, they are able to minimise this delay (since everyone schedules time to apply MS patches).

Re:Shcheduled updates seem counter-intuitive

[JohnnyCannuk]

I got news for you, script kiddies and crackers have been exploiting this since before it was an advisory.

Most of them can go to places like this to get the exploit. And if it is here, its been floating around the underground or IRC for a lot longer.

Releasing the patch sooner will protect more people. Holding off makes no sense. Once its patched no one can use it.

Re:Shcheduled updates seem counter-intuitive

[JohnnyCannuk]

http://www.milw0rm.com/

Damn /. there is the link I was referring to.

The article's titles doesn't do it justice

[suv4x4]

The patch in question patches not less than 10 critical patches in IE and Windows that can be used to compromise your system.

Re:The article's titles doesn't do it justice

[Cally]

Top be precise, the IE patch (MS06-013, in fact) fixes ten security bugs, but only eight of them allow remote code execution.

Mind you, MS released four other Security Bulletins today, two of which are remote code execution / rated 'critical' bugs. One's in Windows Explorer, the other's in MSDAC, some data access middleware crap that's also remotely exploitable.

gmail invite

[IamGarageGuy 2]

can't figure out your email address - u want one send me a request at tedbirmingham at gmail.com.

Re:gmail invite

[Bromskloss]

can't figure out your email address

I had to think twice on that one too. :-) You should apparently read it backwards. (An invitation has been sent, btw.)

open source projects of equivalant size?

[way2trivial]

Like- what? that has to be compatible with every pc configuration, with every software configuration, quite literally, known to man.

1st, what OSP is on par for raw bytes & complexity... to the windows OS?
2nd- which of that subset get's patches in 24 hours
3rd- how often do these "right out the door" patches cause loss of functionality, for a subset of users, as (my line one above) every system configuration possibility was considered in the patch, that is still just works?

it's kinda herculean if you think about it..

Re:open source projects of equivalant size?

[Moofie]

So these highly paid developers have developed something that they can't support.

And I'm supposed to give them money, why exactly?

Re:open source projects of equivalant size?

[Foofoobar]

Below are the answers to your obviously rhetorical question...

1. Apache, Linux, MySQL, Postgres, Sendmail, OpenExchange, SugarCRM,etc etc. The list goes on and on
2. Apache, Linux, MySQL, Postgres, Sendmail, OpenExchange, SugarCRM, etc etc. They were even recently recognized for it in a government research document stated that 24 hours was an average and that they even get patched faster on some systems.
3. According to the same government document, hardly ever. Pathces on open source projects general reduce the numbers of bugs in code (rather than increasing them *cough*microsoft*cough*

It's not herculean to do it right the first time and continue to do it right. It's called doing your job.

Source

[Goodgerster]

Downloadable immediately from here.

Re:Why?

[geobeck]

Why the hell is anyone still using IE?

Unfortunately, it's because of corporate inertia. Take my company, for example. I'm the IT department (no, that's not a typo) for a small Canadian company that is owned by a large European company. I've removed the big 'e' from everyone's desktop, installed Firefox, and told everyone to use it.

Unfortunately, we have a couple of applications we can only use through a centrally-administered terminal server environment. That environment includes IE. And of course the corporate IT guys can't replace Internet Exploiter because "It's a corporate standard," meaning the CIO is a manager, not a tech, and won't let them install "unlicensed" software. ("How can it be properly licensed if we don't pay for it?" ... "Free software is never free for business use!", etc.)

Re:I DLed them this AM. A question...

[Tim C]

There are many hidden places in Windows where the default browser might not be Firefox.

Essentially almost any Windows app that displays HTML and isn't either Firefox, Mozilla, Opera or Thunderbird is most likely using mshtml.dll and so is likely to be vulnerable to the exploit.

Bottom line is that any Windows user should download and apply every IE update whether they use IE or not, as simply not using IE does not guarantee safety.

Re:ActiveX, Java and Flash controls may be impacte

[suv4x4]

"Bundled in with this patch is a change to the behaviour of embedded controls in IE6 on Windows XP, due to the Eolas patent issue. This means that things like Flash navigation or Java widgets might not work without being clicked first to activate."

To solve the issues with Flash, check out my sig. It's free.

A ay to fix IE??

[ssego]

You mean they finally released an uninstaller???

I don't get it

[penguin-collective]

This is "News for Nerds. Stuff that Matters."; a serious IE exploit seems to fit neither category.

not an automatic FlashBlocker

[Tumbleweed]

A permanent FlashBlock-style behaviour would have an interesting effect on how e-adverts are played.

Unfortunately, this won't act as an automatic FlashBlocker. It disables _interacting_ with the ActiveX component until it's activated. So all those lovely ads will still load and play automatically; you just won't be able to click on, say, movie volume or playback controls until you've authorized it. Basically the worst of both models, really. Sucks to be IE. *shrug*

Re:I DLed them this AM. A question...

[flight_master]

I'd like to know how though; Here at work, we use internal software, which has a browser window built in to access a tasks list. It's IE-based, using the activeX control. How would I get rid of it? ;)

not in 24 hours, no

[way2trivial]

but rather, after testing, and validating- then they support it.

how much do you pay for OS updates?

Re:not in 24 hours, no

[Moofie]

After months and months of sometimes ineffective testing and validating (their patches still break a LOT of stuff), they charge you insane $$ for lousy support.

I pay for the OS, which allegedly includes updates.

I should say that I don't pay for squat...I buy Macs for my own use. Their updates seem to work just fine, and there are far fewer of them (both in number and scope).

Re:I DLed them this AM. A question...

[Jtheletter]

There are many hidden places in Windows where the default browser might not be Firefox.

Very true, I found one of these today, itnerestingly enough in Flash itself. It indicated there was an update available, and the link to describe the details of the update opened up IE despite FF being my default on this machine. Talk about a security hole, an unsecure app, opening an unsecure broswer, all w/o checking user prefs on the machine or even alerting the user to the action before it is taken. Brilliant! (I know, dump flash you say, but I can't for what I do on this machine, however you can bet it's not loaded on any others I own!)

Re:Yawn

[Bromskloss]

Still saving for The Switch...

Come on, hop on the train and go for free software. No savings needed!

Re:Why?

[J0nne]

The IETab extension can switch the rendering engine within Firefox. You can even add a list of websites that should always use IE's engine. This way your users won't have to start IE seperately (and probably won't even notice the switching of the engine).

I'm not sure if you can install it automatically (through sms or whatever it's called), so it might not be practical if you have to install it on a lot of computers.

Grammar!

[slavemowgli]

Argh:

"Hackers had been exploiting this problem by installing unauthorized software on PCs."

No, no, no. The fact that "hacker" isn't the correct term to use here anyway nonwithstanding [1], people have been installing unauthorised software on PCs by exploiting this problem, NOT the other way around.

1. Feel free to whine that the general public does use the word "hacker" that way if you want to, but this is Slashdot, and I think we can expect a somewhat higher standard here.

Re:Grammar!

[AME]

but this is Slashdot, and I think we can expect a somewhat higher standard here.

Funniest thing I've read all week. Thanks for that!

Re:ActiveX, Java and Flash controls may be impacte

[TubeSteak]

This won't affect IE6 on Windows 2000

That's good. I just updated from SP2 to SP4 & had to deal with >30 SP4 specific patches.

Is it possible that (for Win2k at least) staying a bit behind in the service pack game could afford you a bit of protection?

Either the exploit is going effect only the latest SP, or MS is going to write a patch for all versions. In the first case, you can ignore the exploit and go about your way and in the second case, you weren't any safer than the up-to-date people.

Though, if I was doing a fresh install today, I'd be using a CD with the current service pack already present.

You mean, IE users point and laugh

[koweja]

So basically it's going to make it more difficult to see obnoxious flash ads take over websites as soon as a page is loaded. And in the rare chance you actually want to see a flash or java object, you have to click a button. Sounds like MS should toss this on the feature list.

Re:You mean, IE users point and laugh

[Bromskloss]

So basically it's going to make it more difficult to see obnoxious flash ads take over websites as soon as a page is loaded. And in the rare chance you actually want to see a flash or java object, you have to click a button. Sounds like MS should toss this on the feature list.

Click a button in the way us firefoxers already can do, you mean?

Re:You mean, IE users point and laugh

[StevenHenderson]

So basically it's going to make it more difficult to see obnoxious flash ads take over websites as soon as a page is loaded. And in the rare chance you actually want to see a flash or java object, you have to click a button. Sounds like MS should toss this on the feature list.

Gee, I wonder where they got that idea?

Re:You mean, IE users point and laugh

[Anonymous Coward]

Flash ads will keep working. You need to click only if you want to start *interacting* with the object.

Also, this "click to enable" feature can be bypassed using JavaScript. That is not a bug, Microsoft allowed this as a workaround.

Re:You mean, IE users point and laugh

[Ash-Fox]

Konqueror has had this for ages for *every* plugin. Which I prefer.

Re:ActiveX, Java and Flash controls may be impacte

[araemo]

Overall, I'm fine with that. I'm actually used to that behavoir - I use scriptblock for firefox at home, and flashblock at work. I LIKE not seeing active content when I don't want to.

I do NOT look forward to the calls I get the day after we deploy this patch at work though.. "My internet doesn't work!".

Didn't work for me.

[antdude]

I use Siebel products, and it didn't fix my issues. IE still continued to freeze. Had to remove KB912812 update and reboot. :(

Also, note that it mentioned Java with ActiveX.

They damned themselves in 1997...

[argent]

They shipped Active Desktop, which is where they started integrating IE (or rather, the HTML control that's almost the whole of IE) so deeply into the OS that it couldn't be disabled or removed without heroic measures, in 1997.

Every new OS release since them has been an opportunity for them to step back from the brink and turn IE into just another application. Not only have they not turned back, but they have run faster and faster with every step.

I wish them joy of their damnation, their salvation is in no-one's hands but their own.

Re:I DLed them this AM. A question...

[Cally]

I just had to set up my Dad's new Dell for him - lovely hardware BTW (well, compared to the no-name crap pulled out of skips that I normally deal with, and not counting rackmount ProLiants and whatnot at work :) - but did you know that in 2006, Windows XP (which being NT a full-blown proper multi-user kernel) *still* sets up a default user account as an administrator, with no password?! Couldn't believe my eyes. I was also amused to see the new Windows 'security' features, which are causing him no end of problems -- there are dialogs and popups and animated bubbles out of the toolbar demanding to know whether so-and-so program should be allowed to talk to the Internet - many of which shouldn't need to, so are presumably phoning home - amongst these is the "McAfee security centre" which apart from trying to get him to pressure him into buying a subscription, I noticed was using IE as it's web-browser. Surely that's a breach of the Trade Descriptions Act, selling "security software" that uses IE?? Anyway, in beween telling him he should have got a Mac like I told him, he's good to go now with Firefox, T'bird and Open Office. (He was horrified when I explained that Word, Access and Excel aren't part of Windows, and that you have to pay an extra £250 if you want to use all his old files. And no, I can't just move the old programs onto the new computer... apart from anything else, I suspect he found some dodgy geezer to fix it at some point when I wasn't around, and he doesn't seem to have any Office install CDs... heh! I think that's what they call a teachable moment.

How does Apple compare?

[v1]

I hear a lot of noise about MS patches and "Patch Tuesday" curse words, but no one has much to say about Apple's patch schedule. Now I realize there are a lot less security updates from Apple, but that's another debate for another thread. What do people think of Apple's timeliness in the release of security updates? Have they been known to drag their feet on releasing, or maybe are they showing some hustle?

Another dup?

[chrism238]

Well this patch is very likely original, but isn't this Subject line and the Contents another perennial duplicate?

Let's check

[way2trivial]

the windows installer for apache is 4.2 mb I can't actually determine it's size-
the download for sendmail is 1.89 MB
postgres is 22mb
these are single purpose- using system calls- apps..
they aren't OS's (except for linux) and do any of those come close to 1.5 gigabytes of code/apps/parts?

re read my list of challenge requirements for #1.. what OSP is on par for raw bytes & complexity... to the windows OS?

I can't vett "linux" as there is no "one linux" to compare against.- and none of them come 'core' with as many features INCLUDED in the os as microsoft- the same functionality is available I grant you- but not 'stock model'- as add-ons you can add as you determine your need.

this means however that a windows patch has to play niceley with all the other 'stock model' features.. which is my point- there is nothing more complex- serving more people- that makes it so unreasonable that a testing cycle is required to make sure that it won't break compatibility with some bizzare element 4 OS bits removed (but part of windows) over from the site of the problem.

Re:Let's check

[Foofoobar]

These projects have been in use for longer than Microsofts products, are bundled with ALL Linux distros making most Linux distros have equivalent functionallity and even exceeding functionality in some cases.

Now if you want to say the projects are not equivalet due to the lines of code used, thats just plain stupid. Good code take fewer lines whereas bad code can go on forever and ever.

Every engineer knows that to build a better mousetrap, you don't make it more complex... you simplify.

Linux and those open source applications are engineering marvels in simplification in the fact that they compete and beat standard models and are still more secure and stable.

Re:I DLed them this AM. A question...

[Ash-Fox]

If you actually spent a little time learning how directx works, you could find the IE active x component at:

HKEY_CLASSES_ROOT\CLSID\{8856F961-340A-11D0-A96B-0 0C04FD705A2}

and remove it.

You can always use ReactOS's activex snapin replacement for it which uses the Gecko rendering engine.

Re:I DLed them this AM. A question...

[Ash-Fox]

Oh poo, I just noticed I said 'directx' earlier when I meant 'active X'.

Perhaps we'll never agree

[way2trivial]

Yes, I consider the total size of the codebase to be patched a consideration.
yes, microsoft code is likely bloated and inefficient
But the featureset, and functionality- is a order of magnitude or more complex than "SENDMAIL"

the simple fact (I see) is that -a patch for a microsoft OS, with all the variables it can affect- is a much greater undertaking- with
greater needs for getting it right the first time- than for most any other software available..

Hotfix 908531 BROKEN

[Kobold Curry Chef]

The Windows Explorer patch (KB 908531) is broken. It causes Office and IE massive problems in saving and opening files.