No Fix for Word Next 'Patch Tuesday'

Sktea writes "A spokesman for Microsoft has said that they will issue no patches on the next 'Patch Tuesday' for versions of Word vulnerable to the recent zero-day threat. There is no mention whatsoever of the omission in the latest advance notification at the company's security site." From the article: "The software maker is working on a security update, but apparently needs more time. The company did not specify how many flaws Tuesday's updates will address or in which components of Windows the holes lie. The Visual Studio update could offer a patch for a zero-day vulnerability in the developer tools that was made public last month. "

Comments

Does this mean a new catch phrase?

[zappepcs]

Are we going to start calling them zero-week or zero-month vulnerabilities?

Re:Does this mean a new catch phrase?

[Overly Critical Guy]

If this was a WMA DRM crack, we'd see a patch within three days. Don't you just love Microsoft?

Re:Does this mean a new catch phrase?

[Osiris Ani]

I have never ever encountered someone in my direct environment who has upgraded any kind of non-free software (I mean going to a shop to buy a new version).

Believe it or not, there exists a non-trivial percentage of end users who seek out and pay for software upgrades that provide new features. I, for one, eagerly await Adobe Photoshop CS3. Some of us are not so cheap and actually have specific needs and desires for improved productivity and functionality.

Then, of course, there's also corporate IT. That's pretty much Microsoft's core demographic for upgrades.

Re:Does this mean a new catch phrase?

[meclamar]

How about zero-fix vulnerabilities?

Re:Does this mean a new catch phrase?

[Oddscurity]

That's probably because of license agreements made with the corporate consumers of said DRM, allowing them to sue (or jane, or ...) Microsoft's pants off when the product 'protecting' their music/video fails. This in stark contrast to the EULA which disclaims any warranties and then some.

They don't have time to patch

[Anarke_Incarnate]

This isn't anything critical like fixing a problem with their DRM. This only hurts the end users, not anybody they are beholden to RIGHT NOW in order to attempt to become the supreme overlords of the livingroom, like they so desperately want to be.

Re:They don't have time to patch

[morgan_greywolf]

This isn't anything critical like fixing a problem with their DRM. This only hurts the end users, not anybody they are beholden to RIGHT NOW in order to attempt to become the supreme overlords of the livingroom, like they so desperately want to be.

Exactly. Who cares about existing users in markets they already control, who are addicted to you and will stay with you forever? After all, when you have to spend all of this time throwing chairs about, f**king killing Google, figuring out ways to steal Apple's successful online music business out from under them, and scheming to keep those Linux guys from getting anywhere, you can't be focused on such silly things as customer support. No siree! Win, win, win! That's what I always say!

But...

[feld]

Their solution certainly said that we aren't to open any MS Word documents. Does this mean Microsoft will pay unemployment to the people that deal with Word documents all day, but can't open them due to security issues?

Re:But...

[wytcld]

"received unexpected from trusted sources"

"Expected" is the tricky word there. Most people who receive Word docs in the course of work expect their normal, trusted sources to send them documents that are themselves somewhat new, newsworthy, you know, containing information that's worth sending. A doc that's totally expected probably didn't need to be sent.

Let's say you're the editor of a newsletter or magazine. You expect docs from a few score people who occassionally submit stuff. You expect them to show up with e-mails that say, "Hi George, Here it is!" The bad guys can easily fake that stuff - and often do - but you're a normal editor, not a security expert, so you give the normal English reading to "receive unexpected," and this stuff all looks like stuff you expected, so you open it....

What Microsoft should say is, "Don't open any attached docs without phoning the source first and specifically confirming the file." As it is, they're saying just enough to cover their ass ("We warned you!"), without saying enough to enable the typical user to really practice safe Word use.

Popeye

[spidkit]

Wimpey: "I will gladly fix it on Tuesday."

Ok, bad guys, you heard 'em: they need more time!!

[The_REAL_DZA]

"The software maker is working on a security update, but apparently needs more time..."

 
So be nice and give 'em a few extra days to come up with some patches (it's the sporting thing to do!!) After all, all that innovation makes it tough to respond quickly to threats to their legacy apps!!

Shucks

[Overly Critical Guy]

A spokesman for Microsoft has said that they will issue no patches on the next 'Patch Tuesday' for versions of Word vulnerable to the recent zero-day threat.

And why should they? The devs are still trying to finish Twilight Princess on the Wii, goshdarnit. Leave them be! The users can last without opening any attachments from anybody for a little while longer, right?

Re:uninsightful

[LearnToSpell]

Somebody forgot to turn on his sarcasm detector this morning...

I'm not at all surprised or unhappy

[tarlos25]

I'd rather they take a little more time and "fix" it the first time, rather than having to issue multiple patches to fix it, each one opening up more glaring holes. Of course, I'd prefer it wasn't there to begin with, but hey, the world isn't perfect.

Re:I'm not at all surprised or unhappy

[db32]

Typo Notifaction Post

Typed: ", the world isn't perfect."
Corrected ", Word isn't perfect."

Re:(-1) Did not actually read advisory

[feld]

Yeah, ok. Like it's that easy. Tell that to the Human Resources lady who has to open up Word documents containing resumes/cover letters from random people. Get my drift? Why do you all have to be pricks without thinking first?

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:(-1) Did not actually read advisory

[Anonymous Coward]

Yeah, ok. Like it's that easy. Tell that to the Human Resources lady who has to open up Word documents containing resumes/cover letters from random people. This is exactly what part of my job is. I handle the resumes we get from candidates and input them into our database. What do I tell my boss? Sorry, can't get any new hires because if I open a resume my computer will explode? That won't fly.

Why would they?

[Osiris Ani]

"There is no mention whatsoever of the omission in the latest advance notification at the company's security site."

My first thought leads me to ask, why would there be any mention of bug fixes that are not included in a patch cluster's content notification? Why would any company specifically call out features that are not being provided in a particular software distribution, in circumstances other than the discovery of a clear and consistent workaround (aside from the standard "temporarily avoid use of [software x]")?

The situation of miscellaneous zero-day exploits must be embarrassing enough already; I couldn't imagine them calling even more attention to it. "Hey, guess what we're not fixing next week. Check it out!"

Re:Word 2007

[Nasarius]

Conspiracy? Nah. For once, MS doesn't really need strongarm tactics to sell a product. Office 2007, with the first UI overhaul since the days of Windows 3.1, is genuinely worth the upgrade. And it's not even publicly for sale yet. So while you're free to rightly accuse them of incompetence for failing to patch their older (and current) products in a timely fashion, they're probably not being evil.

Here's how we get it fixed.

[nobodyman]

Here's how we get microsoft to act. Let's just tweak the headlines a bit, from:

New Zero-day Attack Affects Word Users

To:

New Zero-day Attack Circumvents Zune DRM

There, much better. I guarantee Microsoft will release a patch *immediately*.

Re:uninsightful

[LeedsSideStreets]

Sarcasm detector... that's a real useful invention. [explosion]


obligatory

So Is Everybody Using NotePad or What?

[littlewink]

WTF do corporations do when viruses and worms are whizzing past on their internal networks and there's no fix available? Do they blindly continue working with Word?

I talked to a friend whose corporate computer was infested by spyware that planted porno on his system. He paid the blackmail for the antispyware to remove it. A month later he de-installed the antispyware and guess what - the porno returned.