Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Plugs a Record 26 Security Holes

Posted by ryuzaki0 on from the there's-another-one dept.

An anonymous reader writes "Microsoft today released ten patches to fix at least 26 separate security holes, including a whopping 16 flaws in Microsoft Office and its constituent apps. According to Washingtonpost.com's Security Fix blog, this is the most number of patches ever released by Redmond outside of a Windows service pack. Also of note, six of today's updates apply to fully patched Windows XP systems, and two of the flaws are actually present in Windows Vista."

15 of 200 comments (clear)

  1. It could have been worse... by xTantrum · · Score: 4, Funny

    It could have been 27!

    --
    $action = empty(PHP) ? backToC() : unset(PHP) ; "when the concrete cases are understood, the abstractions are readily
  2. It's not how many were patched... by rjamestaylor · · Score: 3, Insightful

    It's how many remain that's important.

    And, how many were created in the making of the 26 patches?

    --
    -- @rjamestaylor on Ello
  3. DISASTROUS NEWS ! by unity100 · · Score: 3, Funny

    microsoft introduces 2-3 holes while fixing one .. if they patch up with that speed from now on, it means ... uh oh ...

    --
    Read radical news here
    1. Re:DISASTROUS NEWS ! by ronkronk · · Score: 5, Interesting

      I remember when Windows 95 came out, with its weak, obviously-an-afterthought "web browser" (IE 3.0). It was painfully obvious that Microsoft had missed the Internet boat, and shortly thereafter, Bill Gates sent his historic all-hands memo pointing the company in the direction of the Internet.

      It took them some time to get it right, but eventually IE took over. Now, you'd have a hard time finding a Microsoft product more complex than Minesweeper or calc.exe that doesn't connect to the Net somehow. And let's not forget that Netscape provided Microsoft with some much-appreciated help in taking over the Web, by screwing up their own release schedule so badly that there never was a Netscape 5.0.

      Flash-forward to a couple of years ago, when Bill sent out yet another all-hands memo, pointing the company in the direction of security. At first, we all laughed. But now it's becoming more and more obvious that they're taking security every bit as seriously as they once took the Internet. They are aiming to be the top of the heap in security, and they've got drive, ambition and aggression.

      Make no mistake, this kind of event is exactly what a company that wants to get secure should be doing. Thomlinson's comments about how seeing their code exploited "hits people in the gut", and the fact that "he was glad to see the crowd of engineers taking things personally" -- these things are right on the money. These things say to me that, within a few years, we're going to see some really damn secure stuff coming out of Microsoft.

      In the meantime, Firefox exploits are cropping up at a seemingly greater pace. This worries me. It looks like a repeat of 1997, when Netscape lost huge amounts of ground to IE by producing a product that wasn't as good as the competition. SP2 wa s huge leap forward in security for Windows and for IE, and Blue Hat makes it obvious that Microsoft is just going to get better at it. In the meantime, Firefox appears to be standing still on the security front, or maybe even losing a little ground. Sure, it's still miles ahead of IE's security, but if IE keeps up the pace, it will overtake Firefox sooner or later -- probably sooner.

      Is there any way the Firefox development team (and the OO.o team, and anyone else who's working on high-profile F/OSS projects) can take a lesson from Blue hat? Can we get together events like this of our own?

      If we don't, I can already see that by 2009 or so, at the latest, I'll be telling clients to go with Microsoft products, because they're more secure than F/OSS. And I don't want to see that happen.

    2. Re:DISASTROUS NEWS ! by truthsearch · · Score: 4, Insightful

      Let's not forget that we'll never know exactly how many total exploits IE really has. Microsoft may know of 100 more that they simply haven't disclosed. We'll never know. But anyone can inspect Firefox. Don't think that simply because IE has less publicly documented exploits that it's more secure. Unless you work for the software vendor, you will never really know how secure any proprietary software is.

      Also look at how quickly Microsoft fixes security vulnerabilities. They've let major holes exist for 3 years or more. Even if they have fewer vulnerabilities it's almost irrelevant if they don't fix the ones they have.

      It's a more complex issue that simply how many vulnerabilies each camp discloses.

      --
      Developers: We can use your help.
    3. Re:DISASTROUS NEWS ! by batkiwi · · Score: 3, Informative

      Yes, you can. It can be on any web server.

      Now for the kicker:
      If that URL happens to point to a sharepoint server, when you click "save" it will save it back to the site, update the document history, prompt you for any necessary meta-data, and (with 2007) kick off a workflow for (example here) document approval.

    4. Re:DISASTROUS NEWS ! by stonedonkey · · Score: 3, Insightful

      I remember when Windows 95 came out, with its weak, obviously-an-afterthought "web browser" (IE 3.0). It was painfully obvious that Microsoft had missed the Internet boat, and shortly thereafter, Bill Gates sent his historic all-hands memo pointing the company in the direction of the Internet.

      [Hi, my name is Stonedonkey. I noticed that your extremely shitty post got marked "5 interesting." My notations will be in brackets. Enjoy!]

      It took them some time to get it right, but eventually IE took over.

      [By being bundled into every version of the OS for the last ten years.]

      Now, you'd have a hard time finding a Microsoft product more complex than Minesweeper or calc.exe that doesn't connect to the Net somehow.

      [Specious exaggeration that isn't really relevant.]

      And let's not forget that Netscape provided Microsoft with some much-appreciated help in taking over the Web, by screwing up their own release schedule so badly that there never was a Netscape 5.0.

      [IE won because of its default desktop placement.]

      Flash-forward to a couple of years ago, when Bill sent out yet another all-hands memo, pointing the company in the direction of security. At first, we all laughed. But now it's becoming more and more obvious that they're taking security every bit as seriously as they once took the Internet. They are aiming to be the top of the heap in security, and they've got drive, ambition and aggression.

      [In what sector? Desktop consumers? Can you provide some supporting material for all these pronouns?]

      Make no mistake, this kind of event is exactly what a company that wants to get secure should be doing. Thomlinson's comments about how seeing their code exploited "hits people in the gut", and the fact that "he was glad to see the crowd of engineers taking things personally" -- these things are right on the money. These things say to me that, within a few years, we're going to see some really damn secure stuff coming out of Microsoft.

      [That's great. But right now, I can get superior software for free. Then again, you didn't specify what sector you're talking about, so I can't say for sure.]

      In the meantime, Firefox exploits are cropping up at a seemingly greater pace. This worries me.

      [See the other guy's response about open source.]

        It looks like a repeat of 1997, when Netscape lost huge amounts of ground to IE by producing a product that wasn't as good as the competition.

      [There you go again, glossing over IE's default inclusion.]

      SP2 was huge leap forward in security for Windows and for IE, and Blue Hat makes it obvious that Microsoft is just going to get better at it.

      [Oh, shut yo mouth. SP2 was not a "huge leap forward." Not when MS was so far behind to begin with. It sealed some painfully obvious cracks, but I wouldn't hand them any trophies for it.]

      In the meantime, Firefox appears to be standing still on the security front, or maybe even losing a little ground.

      [A little subjective. Is your assured tone suppose to make your reaction generalizable and trustworthy?]

      Sure, it's still miles ahead of IE's security, but if IE keeps up the pace, it will overtake Firefox sooner or later -- probably sooner.

      [This is a contradiction. Or, at best, a back-handed compliment.]

      Is there any way the Firefox development team (and the OO.o team, and anyone else who's working on high-profile F/OSS projects) can take a lesson from Blue hat? Can we get together events like this of our own?

      [Will it be another failure of open source if we don't? Should I be surprised when you sieze that "failure" as an example of some larger and wholly imagined problem?]

      If we don't, I can already see that by 2009 or so, at the latest, I'll be telling clients to go with Microsoft products, because they're more secure than F/OSS.

      [Suit yourself, Nostradamus. Maybe by then Microsoft will "share" some of its code to assuage your worries. By the way, how in the flaming fuck do you make the leap from "Mozilla" to "F/OSS"? I'm sorry, but that's pure jackassery, pal.]

      And I don't want to see that happen.

      [In that, we agree.]

  4. Re:One at a time, MS! by Anonymous Coward · · Score: 3, Informative

    No. They tried that. Corporate customers revolted because their IT teams couldn't keep up with patch testing/deployment. And as history has shown (MSBlaster), the worm-clock starts ticking once the patch is available to the general public (it is faster for exploiters to reverse engineer the patch to find the hole), meaning it isn't practical for IT departments to "hold" onto patches and deploy them on their own monthly cycle.

  5. Apple's last patch fixed 24 and was over 200 MB. by MSFanBoi2 · · Score: 5, Insightful

    So, at least Microsoft is fixing them.

    Microsoft has bugs, people complain.

    Microsoft fixes the bugs, people complain.

    Apple releases an incremental update to OS X 10.2 to 10.3 and charge you for it ($129.00), and when they release a MASSIVE update in September, not a peep of complaints...

  6. Re:Well Guess that means by Anonymous Coward · · Score: 4, Funny

    Vista ain't done until Firefox won't run!

    I kid! I kid!

  7. Wowee! We're falling behind! by rolfwind · · Score: 4, Funny

    I thought all those studies said that Linux had way more security bugs than Microsoft! The last report had Microsoft at somewhere around 52 security bugs and Linux at several times that.

    If I have my math right:

      52
    -26
    -----
      26 bugs left!

    Microsoft only has to fix them there 26 bugs until Windows is all perfect and flawless!

    *Does a happy dance!*

  8. Re:".NET" - a computer "language"?! by Planesdragon · · Score: 4, Funny

    This guy tries to explain to the average reader/non-geek that Microsoft .NET is a "computer language".

    So long as your precompiled code is a combination of English and C, and yet you still prefer to call it a "language", you shouldn't be surprised to hear others mis-use the word just as bad as you.

    C, C++, VB, Java, Perl, Pascal, Javascript, and all the rest are syntaxes, not languages.

  9. Re:Apple's last patch fixed 24 and was over 200 MB by Overly+Critical+Guy · · Score: 4, Interesting

    That "incremental update," as you ignorantly call it (nice nick, by the way), was a major version release with a whole new version of OS X, new features, and new technologies. It wasn't some minor service pack.

    And that massive update in September isn't so massive when you point out that it's the most we'll see all year. Meanwhile, Microsoft released an IE patch, then released a patch to fix the patch, then released a patch to fix THAT patch. And you wonder why people complain about Microsoft?

    --
    "Sufferin' succotash."
  10. Re:The only vista on my OS horizon: Ubuntu by drsmithy · · Score: 3, Insightful

    Almost any OS that is free... After all, it is hard to argue that Ubuntu (for example), should be flawless when it costs nothing and is in fact shipped out at someone else's expense if one asks for a few sets of the install discs.

    So if it's free it can't suck ?

    How about all those versions of Linux that *aren't* free ?

    Why waste money on a bigger, slower, pile of crapware from Microsoft when it offers nothing substantial in the way of practical improvements over the mess that is XP?

    It offers masses of "substantial, practical improvements". The important question people need to ask is if any of those are important enough to them to upgrade.

    What I'm reading these days is that the Vista release is being given the yawn treatment by many IT professionals.

    IT professionals are waiting for a) the server-side complement to Vista and b) the early rounds of bugs to be shaken out.

    In fact, I'm worried that security will be much worse on Vista than it is on XP since 3rd party security vendors are being prevented by Microsoft from hooking in at the level their code needs to run at to be most effective. I don't trust Microsoft to handle security issues. It has a pathetic track record. The programmers at MS clearly don't understand their own code.

    Sounds to me like you're buying into the standard anti-Windows and anti-Microsoft FUD.

  11. what really happened to Netscape by rs232 · · Score: 3, Informative

    "I remember when Windows 95 came out, with its weak, obviously-an-afterthought "web browser" (IE 3.0)", ronkronk

    It wasn't an afterthought it was a renamed Spyglass browser which they subsequently 'gave away' with Windows so as they wouldn't have to pay royaltees. After failing to buyout Netscape and get an exclusive deal from NCSA they settled with Spyglass.

    "It took them some time to get it right, but eventually IE took over", ronkronk

    IE took over by billg strong arming the OEMs to take Netscape off the desktop. Can't you remember what the MS AOL court case was all about.

    "AOL's March 12 and October 28, 1996 agreements with Microsoft also guaranteed that, for all practical purposes, Internet Explorer would be AOL's browser of choice"

    "Compaq was the only one to fully commit itself to Microsoft's terms for distributing and promoting Internet Explorer to the exclusion of Navigator"

    "now it's becoming more and more obvious that they're taking security every bit as seriously as they once took the Internet", ronkronk

    Like as an after thought.

    "within a few years, we're going to see some really damn secure stuff coming out of Microsoft", ronkronk

    I've heard exactly the same kind of thing when NT came out.

    "In the meantime, Firefox exploits are cropping up at a seemingly greater pace. This worries me. It looks like a repeat of 1997, when Netscape lost huge amounts of ground to IE by producing a product that wasn't as good as the competition.", ronkronk

    Netcape was never inferior to IE. As this test proves. The MS stratagy at the time was to make it a jolting experience for the enduser. Why are you trolling slashdot with patently false pro-MS propaganda.

    "We will bind the (Windows) shell to the Internet Explorer, so that running any other browser is a jolting experience" .

    Firefox running on a more secure OS as standard user are not as serious as bugs in IE running on WinVista. You see as MS embedded the browser directly into the OS so as it couldn't be removed.

    Secondly Netscape lost ground because of backroom shenagenans by billg an Co. After threatening to withold technical information, they offered to carve up the market between them or else they would cut off Netscapes oxygen supply.

    `The delay in turn forced Netscape to postpone the release of its Windows 95 browser until substantially after the release of Windows 95 (and Internet Explorer) in August 1995. As a result, Netscape was excluded from most of the holiday selling season.'

    "Microsoft representative J. Allard had told Barksdale that the way in which the two companies concluded the meeting would determine whether Netscape received the RNA API immediately or in three months.'"

    `After Netscape refused Microsoft's offer to divide the browser market, Microsoft embarked on a predatory campaign to eliminate the browser threat'

    `In subsequent meetings in the Fall of 1995, Microsoft explained to Intel that its strategy would be to kill Netscape and control Internet standards'

    `in exchange for steering clear of the Windows browser segment Netscape would be made a preferred Microsoft partner'

    "I'll be telling clients to go with Microsoft products, because they're more secure than F/OSS. And I don't want to see that happen.", ronkronk

    I'm really an Open Source advocate except for bla, bla, bla

    http://www.usdoj.gov/atr/cases/f2600/2613-1.htm
    http://www.theregister.co.u

    --
    davecb5620@gmail.com