Slashdot Mirror
Microsoft Flubs Patch, Putting Users At Risk
An anonymous reader writes "Microsoft is rushing to fix a flaw introduced by the company's latest security update to Internet Explorer. From the article: 'The flaw, initially thought to only crash Internet Explorer, actually allows an attacker to run code on computers running Windows 2000 and Windows XP Service Pack 1 that have applied the August cumulative update to Internet Explorer 6 Service Pack 1, security firm eEye Digital Security asserted. The update, released on August 8, fixed eight security holes but also introduced a bug of its own, according to Marc Maiffret, chief hacking officer for the security firm, which notified Microsoft last week that the issue is exploitable.'"
the MS has a security hole post has now become, trite, cliche, and dare I say it.... (-1, Redundant)
Cliff Claven
K.E.G. Party Chairman
Founding Leader of: Koncerned for Egalitarin Governance
As long as, over the course of a year, the number of security holes plugged by the patches manages to outnumber the number of security holes introduced by these same patches, we're in real good shape right?
Where were you when the voynix came?
...to switch to Vista. That way, this sort of thing will never happen again. You betcha.
Weaselmancer
rediculous.
The update, released on August 8, fixed eight security holes but also introduced a bug of its own, according to Marc Maiffret, chief hacking officer for the security firm, which notified Microsoft last week that the issue is exploitable.
Chief Hacking Officer? I wasn't aware companies had those these days.
The theory of relativity doesn't work right in Arkansas.
Haha! This sort of thing would never happen if you used Ubuntu!
I'll probably be modded down for this...
whilst this is no doubt a bit of a "d'oh" moment for MS I doubt it will be a serious problem for anyone. * For this to have any affect on you you need to have SP1 but have the latest update of security for IE 6, surely if anyone updated regularly and applied security updates they'd be using SP2 anyway...
*If I'm wrong correct me, not being a windows user it's hard to remember what service pack is current
*''I can't believe it's not a hyperlink.''
Some clients accessing systems at the Chicago Board of Trade were rendered useless by this bug; the flaw essentially resulted in a crash on login. Didn't know until today that it was exploitable, though.
The solution for us was simple: install Firefox on affected clients. Problem solved, users happy.
-Rob
Biblical fiscal responsibility
Yes, but this is a hole created by a patch to fix a hole. On the whole, different and somewhat amusing. Or it would be amusing if I didn't have to administer Windows systems. :P
What if the Hokey Pokey really is what it's all about?
Please don't automatically reboot my machines again when the patch's patch is installed. I have the custom options in MS Update to allow me to control install/reboot for the updates. Well, it ignored that this week and rebooted 2 of my machines for me.
Then, I noticed that The Register had a couple of articles this week about the same thing happening to others.
Just who in the hell does MS think they are?
Oh, and if the patch's patch's patch needs a reboot as well, don't do that too.
Oh, and if.... nevermind.
"If you want to improve, be content to be thought foolish and stupid." - Epictetus
Do you ever get the feeling that IE6 is like a cartoon characters hole-riddled row-boat?
The cartoon character (lets just say it's Elmer Fudd) tries to plug a leak with his thumb, only to have another pop open on the other end of the boat. He stretchs over there to plug it with his other hand. A third appears, and he has to use his toe. Eventually, the number of leaks outnumbers the number of limbs (Or at least, the number of limbs one is allowed to show on TV. *wink* *wink*), and the boat finally goes down. A Fox riding in a Motorboat then speeds by...
I bet that a lot of what they're talking about isn't so much "work" as having the automatic update option set to "on" by default, and most users not knowing or caring about it. And still, most users won't care about this issue either, as it too will be automatically fixed when the patch is released and downloaded by the updating service that they may not even aware they have running.
I'm not saying this is a good or bad thing, I'm just saying.
There is no mod option "-1: Disagree" for a reason. "Overrated" is not an acceptable substitute. Post something instead.
likey they rushed this patch to get it ready for the patch day and they did not fully test it. M$ will be better off with put the updates out when they are done not on a fixed time table.
What if Band-Aid ran their business this way?
"Oh, never mind that our latest shipment of bandages had sharp rusty jagged bits of razor blades embedded in the cloth".
Or office building sprinkler systems?
"We at Paragon Office Protection Systems do not think it is anything to get upset about that our sprinkler system sprayed gasoline instead of water on that paper-room fire last week."
Where were you when the voynix came?
My computer is full of snakes!
Microsoft's idea of testing patches
1.) Perform Windows update
2.) Wait for system to reboot
3.) If system turns back on successfully after reboot, release!
Wake me up when there is a security risk that doesn't need to go through IE.
Technoli
8 bugs have been replaced with 1 bug. That is an improvement unless the bugs it fixed were all minor bugs.
No, Microsoft will start a new initiative called the Genuine Double Patch Advantage (GDPA)
AT&ROFLMAO
I really don't understand why Microsoft doesnt just use their marketing power and explain how executing code from another machine is actually a feature. There is really no need to purchase applications such as pcAnywhere. Thank God for Microsoft saving us all that money!
Yes, but this is a hole created by a patch to fix a hole. On the whole, different and somewhat amusing. Or it would be amusing if I didn't have to administer Windows systems. :P
Actually this really isn't unique. There have been a few of these in the past. And only after some noticed this was happening, who knows how often it happened before people took notice of the fix busting other code than that fixed.
I used to admin a mainframe and keep up on patches rigorously, as we had any number of weasels in the labs waiting for us to leave our guard down for 'arf a mo' One patch back then did indeed open a hole, but the vendor (DEC) was on top of it within days and overnighted a patch tape to fix it. Even then they advised us how to block any attempts while we waited for the patch tape.
A feeling of having made the same mistake before: Deja Foobar
Internet Explorer 6 Service Pack 1 unexpectedly exits after you install the 918899 update
Additionally they go on to say in this article: A new version of security update 918899 is currently in development and will be released to all Microsoft Internet Explorer 6 Service Pack 1 customers by August 22, 2006.
This patch was NOT released today - they LIED! :-)
Since that change, the crashes stopped at least but now that this is out I have much move incentive to upgrade our last few W2K machines up to WinXPSP2.
Namaste
If you unplug the power cord and make the laptop go to battery power, it will give up applying the rest of the updates. You'll then have to apply them the next day when you shut down.
I did that for about a week until I actually had enough time to sit there and watch it finish installing updates and shut down.
And Bill Gates has said this new OS is going to be the whing dinger of all time.
Meaning, the number of serious holes is going to be astonishing, because they are so sophisticated and well hidden that only the best hackers can find and exploit them without users and IT admins finding them.
Aaaaak
I was once running an experiment for a prof. The computer controlling the experiment has a GPIB card, which is controlling several other devices in the room (PID temperature controller, Lock in amp, yada yada yada.) The software running the experiment was written in LabVIEW.
I'm in the middle of a nine-hour experiment when this dialog box pops up. "Your computer will restart in 5 minutes to apply updates."
Now, let's review. What have I done wrong?
- This isn't a server
- AFAIK there is no "LabVIEW" for Linux. I could have written all the GPIB software in C but then no one else would have the expertise to change it, plus getting the card to work in linux would probably be hell
- I'm not using IE
- Windows update is on? Oh, that's what I'm doing wrong.
Luckily my software is much better written, so I was able to discontinue and resume the experiment wihtout losing data. But still, is this the kind of OS that is intended for a production environment? "Who the hell do they think they are" indeed."Live as if you'll die tomorrow." Ridiculous. You could die later today.
See what I mean. All Hail the 'Soft.
This is pretty typical from what I've seen.
Although I'm an IT professional, I'm speaking as an end user here.
Last night my laptop (our company's corporate build, no additions or weird stuff) auto-applied a bunch of patches. When I came in this morning, it told me to reboot. No problem. Reboot to...bluescreen. Did some digging, and found that my install is hosed. I can't do anything until I get an XP boot CD and get to a rescue console. I have no clue if it's SP1 or SP2, and quite honestly, I shouldn't have to. If I had this sort of difficulty with a car, a furnace, or a kitchen appliance, it would go RIGHT BACK TO THE MANUFACTURER! There is no way a company
This isn't a rant against MS per se, it's against all shitty computer companies (hardware and software) who build shitty products that can't do the job they're designed for in a reliable and consistent manner. The entire computer industry needs to be taken out back and shot.
Yeah, I'm railing and blowing off steam here. Doesn't matter--I challenge you to come up with a single product in the industry that (a) does what it's supposed to, in a (b) reliable and (c) consistent manner.
Linux? Nope. Firefox? Close, but nope. MS Office? Nope. OpenOffice? Nope. Any and all media players? Nope. Most hardware now? Nope.
This industry is pathetic. It shouldn't be allowed to exist, let alone thrive.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
IIRC, according to the Jargon File, Windows has reached critical mass.
critical mass: n. Of a software product, describes a condition of the software such that fixing one bug introduces one plus epsilon bugs. (This malady has many causes: creeping featurism, ports to too many disparate environments, poor initial design, etc.) When software achieves critical mass, it can never be fixed; it can only be discarded and rewritten.
Vista is their re-write, which is an admission of this situation.
Oh wait, its actually a new bug. Or wait, its just the same bug over and over.
/. readers) recognize that MS will repeatedly issues patches, patches to patches, and will never really fix anything. Anyone with any sense in the IT/Net field that STILL actually uses Internet Explorer except in a heavily restricted sandbox for testing websites that the driveling masses will use it to visit is either too ignorant or blindly loyal to care about security.
/. really thinks this needs to be news, just add it as a permanent headline. In fact, heck, maybe it should get its own whole section 'Security update to MS software introduces new security hole'
Seriously, how is this news? Everyone with even half a clue (and certainly almost all
If for some reason
It's not quite that simple. If you have a corporate install of several tens of thousands PCs using the same base OS package, then the base package must be compatible with all applications that are to be deployed upon it. Now, XP SP2 breaks several applications, this is a known fact. Therefore, it may be more trouble rolling out SP2 on short notice instead of keeping up with hotfixes and using other measures (firewalls, anti-virus, IDS) to keep on top of security vulnerabilities in the SP1 base package.
Corporate installs are thus more likely to be one or more Service Packs behind. This has been common practice since NT4 times.
Mart"I know I will be modded down for this": where's the option '-1, Asking for it'?