Slashdot Mirror

← Back to Stories (view on slashdot.org)

MS Monthly Patch Omits Word Zero-Days

Posted by kdawson on from the swelling-botnets dept.

bungee jumper writes "Microsoft released four bulletins with patches for 10 vulnerabilities but there are no fixes for known MS Word zero-day flaws that are under active attack, eWeek.com reports. The January batch covers critical bugs in Excel, Outlook, and Windows. The first confirmed Windows Vista flaw, a denial-of-service issue that was publicly released on an underground hacker site in Russia, also remains unpatched." eWeek notes that Microsoft originally scheduled eight bulletins for release, but pulled four last Friday without explanation.

80 comments

  1. Ummmm... by needacoolnickname · · Score: 5, Insightful

    The patches caused more harm than good so they decided to pull them?

    Damn them for not releasing patches that make a more unstable system! Damn them I say!

    1. Re:Ummmm... by marcello_dl · · Score: 3, Funny

      >The patches caused more harm than good so they decided to pull them?

      Not much of an excuse, considering that most Microsoft software causes more harm than good, yet they release it.

      *ducks*

      --
      ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
    2. Re:Ummmm... by needacoolnickname · · Score: 3, Insightful

      Who are you ducking from around here?

      Sit back, relax, and wait for the Insightful rather than the Redundant moderation points to start rolling in on your comment.

    3. Re:Ummmm... by marcello_dl · · Score: 5, Funny

      > Who are you ducking from around here?

      Sorry for the qui pro quack, I actually meant that Microsoft software is likely to have been conceived and released by ducks.

      --
      ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
    4. Re:Ummmm... by needacoolnickname · · Score: 1

      Sorry. Now that makes complete sense. I can't argue with you there. Please accept my humble apologies.

    5. Re:Ummmm... by Anonymous Coward · · Score: 0

      You mean Microsoft's programmers could not fix the flaws in their system (even with the billions of dollars they can spend for concentrated man-hours of programming) and so Microsoft's customers have to continue to be at risk of known insecurities in their operating system? Maybe if Bill had not blown the attention of his company on a shitty CES presentation (thanks for making the bus stop "fun"), my work system that continues to be Window due to bureaucratic inertia (see the State of Massechussets trying to use an open standard for yet another example of how difficult it is to escape Microsoft reliance) is still not secured properly? Wonderful.

    6. Re:Ummmm... by Fulcrum+of+Evil · · Score: 2, Funny

      I actually meant that Microsoft software is likely to have been conceived and released by ducks.

      Not ducks - Canadian Geese. Have you seen the way they shit?

      --
      "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
    7. Re:Ummmm... by Anonymous Coward · · Score: 0

      Sit back, relax, and wait for the Insightful rather than the Redundant moderation points to start rolling in on your comment.

      And to such moderators, sit back, relax, and wait for your moderation privileges to be revoked for receiving too many "unfair" metamods.

      Then again, this is Yet Another Article About Microsoft Security (YAAA MS), which only has one purpose and one result here on Slashdot, to troll for and receive page hits.

      (Posting anon, lest I suffer karmic death from a horde of angry Slashdot moderation abusers. Although my operatives would avenge my death. And some of them, are meta-moderators.)

    8. Re:Ummmm... by Anonymous Coward · · Score: 0

      Because it is insightful. I just modded it this way.

      KiloByte.

    9. Re:Ummmm... by Anonymous Coward · · Score: 0

      I actually meant that Microsoft software is likely to have been conceived and released by ducks.

      Not ducks - Canadian Geese. Have you seen the way they shit?

      How can you not? If Francis Scott Key had written the Star Spangled Banner after seeing an area Canadias Geese passed through the lyrics would have read "Green waves of Shit."
  2. I like that solution. by User+956 · · Score: 4, Funny

    Microsoft released four bulletins with patches for 10 vulnerabilities but there are no fixes for known MS Word zero-day flaws that are under active attack

    Well, that's because there aren't any zero-day flaws. Microsoft changed the name to ">1 day flaws", thereby solving the problem forever.

    --
    The theory of relativity doesn't work right in Arkansas.
    1. Re:I like that solution. by Opportunist · · Score: 3, Insightful

      In other words, from now on they will only patch issues that have been around long enough to be known by pretty much every malware writer in existance. This is, of course, only to be compliant with the request from anti-malware and firewall companies to still have a share in the biz.

      How dare we accuse MS of being anything but anti-monopolizing and doing good? That's their way of keeping the competition in business!

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:I like that solution. by buraianto · · Score: 1

      I think you mean 1 day flaws.

    3. Re:I like that solution. by buraianto · · Score: 1

      Where did my "" go? It was supposed to say 1 day flaws.

    4. Re:I like that solution. by buraianto · · Score: 1

      OK, Slashdot. Where are my less-than signs going? I'm typing plain old text.

    5. Re:I like that solution. by Anonymous Coward · · Score: 0

      Maybe try just < even for plain old text.

    6. Re:I like that solution. by jZnat · · Score: 1

      Write < to get it.

      --
      'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
    7. Re:I like that solution. by Anonymous Coward · · Score: 0

      The preview function is your friend, jackass.

      Why would you neglect your one and only friend?

    8. Re:I like that solution. by ComaVN · · Score: 1

      Sure, he's a jackass for expecting "Plain Old Text" to mean "plain text, without markup"

      --
      Be wary of any facts that confirm your opinion.
    9. Re:I like that solution. by jo42 · · Score: 1

      Don't you mean "1 a day flaws"..?

  3. Oh no, they found our backdoor... by ultramkancool · · Score: 1, Funny

    Now we have to spend a few years rewriting before we can make a patch.

  4. stupid drinking all afternoon by User+956 · · Score: 0

    yeah, or 1 day flaws. whatever. :)

    --
    The theory of relativity doesn't work right in Arkansas.
  5. As long as... by ackthpt · · Score: 2, Funny

    It's OK, as long as they have the patch of the patch of the bug formerly known as Prince.

    --

    A feeling of having made the same mistake before: Deja Foobar
  6. Local elevation of privilege by GIL_Dude · · Score: 5, Informative

    Local elevation of privilege is now considered a DoS attack on Vista? I guess even submitters don't have to RTFA here anymore to get published. I did read the article though since I was worried about any DoS attack for Vista and wanted to see what ports, processes, etc. it was using. All that was there though was a local only elevation of privs (where an authenticated user logged on to the box can get admin rights). Not good of course, but far from a DoS...

    1. Re:Local elevation of privilege by Anonymous Coward · · Score: 0

      Clean up your grammar:

      "Where a user, who is authenticated to a box, can get admin rights"

    2. Re:Local elevation of privilege by Creepy+Crawler · · Score: 2, Funny

      --Local elevation of privilege is now considered a DoS attack on Vista?

      Absolutely. Considering that all the anti-user media playback programs are running under SYSTEM-like permissions, any sort of elevations breaks DRM.

      Not patching broken DRM means the media ogres get really mad.

      --
    3. Re:Local elevation of privilege by Osty · · Score: 3, Informative

      Local elevation of privilege is now considered a DoS attack on Vista? I guess even submitters don't have to RTFA here anymore to get published.

      The submitter read the article, and then directly lifted that line right out of it. Is the submitter an idiot for confusing local privilege escalation with DoS? No, because he wasn't the one who made that claim. Is the article author an idiot for making that statement? Definitely. Is the submitter an idiot for directly quoting the article without attributing it as a quote, thus passing it off as his own words and thoughts? Absolutely.

    4. Re:Local elevation of privilege by Anonymous Coward · · Score: 2, Insightful

      Whoa, I didn't realize that Vista has garnered a huge marketshare, cuz ya know, script children only target OS with the highest marketshare.

    5. Re:Local elevation of privilege by Anonymous Coward · · Score: 0

      No, the grammar was acceptable.

    6. Re:Local elevation of privilege by ultranova · · Score: 1

      All that was there though was a local only elevation of privs (where an authenticated user logged on to the box can get admin rights). Not good of course, but far from a DoS...

      On the contrary, keeping in mind that Vista includes DRM I think it's very good that Vista security is at the usual Microsoft level. It may chain the user, but the chains are made from recycled tin cans, the links are hollow to save material, and the lock pops open when anyone looks at it funny :).

      I guess the one thing that can overcome greed and evil is incompetence...

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

  7. Quck! Spread the Word! by SuluSulu · · Score: 0, Troll

    Quick! Spread the Word! Microsoft didn't fix a vulnerability!

  8. Damn... by locokamil · · Score: 3, Funny

    It's been 18 days since I've been able to us MS Word. My boss is very unhappy-- I may lose my job.

    Damn you Microsoft!

    1. Re:Damn... by locokamil · · Score: 1

      The lack of proper spelling bears out the truth of my last post...

    2. Re:Damn... by Takumi2501 · · Score: 1

      The lack of proper spelling bears out the truth of my last post... What are you talking about? My spellcheck says it's fin. :P
      --
      Sent from my computer.
      Now GET OFF MY LAWN!
  9. Skewed statistics by fluffy99 · · Score: 4, Insightful

    If a particular vulnerability affects multiple versions of the program, you generally don't count them all as separate vulnerabilities. eWeek is counting MS07-02 as five separate patches, but really it's the same flaw in five different versions. How many people have multiple versions of Excel on their system anyway?

    1. Re:Skewed statistics by segra · · Score: 1

      they are sold as different products, you cant just go and get a patch for office xp to make it office 2003

    2. Re:Skewed statistics by Kobold+Curry+Chef · · Score: 2, Informative

      Actually, it's one patch that fixes five different vulnerabilities (CVE-2007-0027 through CVE-2007-0031). Some of these vulnerabilities appear in five different versions of Excel or Works; other appear in as few as three. So eWeek is closer to the truth than you think.

    3. Re:Skewed statistics by Anonymous Coward · · Score: 0

      Um, no. It's five separate vulnerabilities in one patch.

  10. Microsoft is so large... by HeadlessNotAHorseman · · Score: 2, Interesting

    Microsoft is such a big company, you would think that they would have been able to solve this by now. Why couldn't they have, for example, had two or three different teams working on a patch, and then choosing the best solution? They could even offer a nice reward to the winning team as an incentive.

    --
    I like my coffee the way I like my women - roasted and ground up into little tiny pieces.
    1. Re:Microsoft is so large... by bailey86 · · Score: 1

      Software doesn't work like that. The more staff, the more bloat, the more breaking something new. At the end of the day the problem and fix have to be held in a single person's head. If the software is out of control and overly complex then this becomes impossible. Rewriting from scratch becomes the only answer. Code needs to be elegant to work well. That's why an elegent OS like Debian can be installed on a 386 - whereas a bloated OS like Windows needs a cray to sit there and do nothing.

  11. Too many geeks on Christmas vacation by Anonymous Coward · · Score: 0

    I think they most the engineers at Redmond on Christmas vacation so what poor slobs where left fixing the bugs which normally needs a army division to fix. Just like the first commenter, Damn the code, Damn them all!

  12. Default application by Bob54321 · · Score: 4, Informative

    I just installed these updates and what I want to know is why updating Outlook makes it your default email application. I know I just have to click OK when I start Thunderbird again but it is annoying that I should even have to do that.

    --
    :(){ :|:& };:
    1. Re:Default application by Anonymous Coward · · Score: 0

      Maybe your outlook wasn't working, so you 'update it' and hey, now it works!

    2. Re:Default application by Anonymous Coward · · Score: 0

      Because Microsoft programmers are incompetent and their marketing department ensures that they are. This is only one of the many, many reasons I hate using MS programs. My question is, why do you have to patch a program you're not even using? I mean, do Opera users have to patch Firefox?

  13. What the hell does "Zero-day" mean, anyway? by markhb · · Score: 1, Insightful

    Seriously: I think I understand the original meaning of the phrase, to refer to known bugs in the first release of a piece of software, but we're talking about Office 2000 or maybe even earlier in some cases (although MS won't support the older stuff anyway), so what is "zero-day" supposed to refer to? Yes, I looked at Wikipedia, but their Zero-day page (or at least the US-English version) reads to me like a garbled mess.

    --
    Save Maine's economy: write stuff down. All comments are exclusively my own, not my employer.
    1. Re:What the hell does "Zero-day" mean, anyway? by Anonymous Coward · · Score: 0

      Zero-day software flaws are unpatched flaws that affect everyone who has that particular piece of software, meaning it has been zero-days since it was fixed.

    2. Re:What the hell does "Zero-day" mean, anyway? by joebubba · · Score: 1
      Zero-day (to me) means an exploit is in the wild the same day the vulnerability is discovered/announced.

      My translation may be a garbled mess as well.

    3. Re:What the hell does "Zero-day" mean, anyway? by Bacon+Bits · · Score: 5, Informative

      "Zero-day" is an exploit classification.

      It goes like this. Software has bugs. These bugs can cause security vulnerabilities, which are then published and patches issued to fix the vulnerabilities. Hopefully, all this happens before the black hats can take advantage of -- or exploit -- these vulnerabilities.

      An exploit of a vulnerability is the virus, worm, SQL injection, hack attempt, etc. itself. An exploit can be labelled "zero-day" when an in-the-wild exploit has been detected on the same day that the vulnerability was made known to the security industry. Most often, "zero-day" means "we learned there was a vulnerability when we found this exploit". This is rather like finding out the locks on your doors don't work when a thief has already been and gone. Zero-day exploits then will have a maximal timeframe to affect vulnerable systems since no work has been done on fixing the vulnerability (presumably).

      The Slammer worm, for example, was an [i]exploit[/i] of MS SQL Server 2000. SQL Server 2000 had a buffer overflow vulerability which was the subject of Slammer. Slammer was not zero-day, however, since this security vulnerability had been known about for many months and MS had already issued patches for it (six months prior to Slammer).

      The vast majority of exploits are *not* zero-day, but uninformed reporters for computer news services (like CNet, or anything Ziff Davis owns) are now using "zero-day" as a synonym for "new vulnerability" instead of the proper "new exploit to unknown vulnerability".

      --
      The road to tyranny has always been paved with claims of necessity.
    4. Re:What the hell does "Zero-day" mean, anyway? by LordOfTheNoobs · · Score: 1

      That or a hack created the day the software is released ( with etymology likely from game cracking groups ). The anonymous coward post about yours strikes me as a bastardization of proper usage for the term, likely caused by its ever more "buzzword" existence.

      --
      They're there affecting their effect.
    5. Re:What the hell does "Zero-day" mean, anyway? by markhb · · Score: 1
      Most often, "zero-day" means "we learned there was a vulnerability when we found this exploit".


      Now that makes sense. Thanks!
      --
      Save Maine's economy: write stuff down. All comments are exclusively my own, not my employer.
  14. no worries :) by Anonymous Coward · · Score: 0

    does it strike anybody else as funny that the release groups had patches out long before Office 2007 was even available, yet Microsoft can't get their shit together even with root access to the source codes?

  15. Am I the only one by AVryhof · · Score: 1

    Am I the only one who glanced at that and saw

    "Ms. Monthly Patch" and thought "She's on the rag again?"

    --
    Make America grate again!
    1. Re:Am I the only one by Anonymous Coward · · Score: 0

      Yes, you are the only one whose observational skills and/or reading comprehension fucking suck that much. Congratulations.

      Thanks for sharing.

    2. Re:Am I the only one by Anonymous Coward · · Score: 0

      When did you last have a girlfriend? Some time ago, eh?

  16. As a literal word? by staticdaze · · Score: 4, Funny

    Anyone else read that as: MS Monthly Patch Omits Word "Zero-Days" ?

    They aren't zero day, they're "highly relevant to your enterprise investment"!

  17. Outlook Express flaw? by anss123 · · Score: 1, Interesting
    Lately I've received spam with images displayed in Outlook Express, despite said feature being blocked. The image links look like these: mhtml:mid://00000088/!cid:003e01c7342e$d54bc0c0@Lo calHost

    Anyone know what this is about?

    1. Re:Outlook Express flaw? by Anonymous Coward · · Score: 2, Informative

      the image is embedded in the email. thunderbird has the same "issue."

    2. Re:Outlook Express flaw? by Anonymous Coward · · Score: 0

      Looks to me like you have something bad on your computer. The url seems to point to a resource on your own computer ("@Lo calHost"). Do some scans.

    3. Re:Outlook Express flaw? by Dissman · · Score: 1

      Not if you view in plain text. But then, very little effects you if you use that.

  18. Conceived by ducks ? by this+great+guy · · Score: 1

    No way. Real ducks would have built better software.

    1. Re:Conceived by ducks ? by cp.tar · · Score: 1

      Hey, if Google uses pigeons...

      --
      Ignore this signature. By order.
  19. Details by jginspace · · Score: 2, Informative
    I've got into the habit of saving Microsoft's advance notifications using the wonderful Scrapbook extension.

    Here's the original:
    • Three Microsoft Security Bulletins affecting Microsoft Windows. The highest Maximum Severity rating for these is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool. Some of these updates will require a restart.
    • One Microsoft Security Bulletins affecting Microsoft Windows and Microsoft Visual Studio. The highest Maximum Severity rating for this is Important. These updates will be detectable using the Microsoft Baseline Security Analyzer and the Enterprise Scan Tool. These updates will require a restart.
    • One Microsoft Security Bulletins affecting Microsoft Windows and Microsoft Office. The highest Maximum Severity rating for this is Important. These updates will be detectable using the Microsoft Baseline Security Analyzer. These updates may require a restart.
    • Three Microsoft Security Bulletins affecting Microsoft Office. The highest Maximum Severity rating for these is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer. These updates may require a restart.
    In the end there was only one Windows patch - a critical flaw in VML - along with critical patches Outlook and Excel. The only 'important' patch was for Office 2003 but seemed to only affect the Brazilian Portugese version.

    I was surprised to find, following the TFA, that eWeek got hold of this last Friday.
  20. What is a zero day flaw by priyank_bolia · · Score: 1

    Sorry to be so kiddish, but can someone explain me what a zero day flaw is? I guess from wikipedia, its the number of days difference between a security vulnerability and exploit.

    1. Re:What is a zero day flaw by Anonymous Coward · · Score: 0

      I have no idea where they get that goofy idea from. 0-day would be brand spanking new exploits for (generally) unpatched holes. It seemed to originally be used in a manner mocking the software piracy (warez) scene. In the old BBS era there was a lag time between the time when an organized warez group released a title and when it'd appear on various boards. Highly popular boards with good affiliations usually had a lot of couriers that would quickly (as quickly as possible via modem at least) upload new releases. Other smaller boards had to wait for the release to trickle down to them. These lower tiered BBS's were loosely rated by a concept of the average time between group release and it appearing on their board. I can recall some of my local boards calling themselves "+1 day" (sort of like timezones). I also recall hack/phreak sites making fun of the practice by calling themselves -1 to -10 day boards :)

    2. Re:What is a zero day flaw by Joebert · · Score: 1

      A zero day flaw is one that occurs on the zero day of the month, it's kinda like a leapyear, but it happens more often.
      What happens is that virus writers tend to release things on the zero day because it gives them an advantage against companies like Microsoft. Microsoft doesn't like to acknowledge that zero day exists because it's not widely accepted enough to place on calendars.
      Thus, virus writers get an entire day to test their products since Microsoft has to wait untill the 1st day to issue a patch.

      --
      Wanna fight ? Bend over, stick your head up your ass, and fight for air.
  21. Re:Dear Sir by Anonymous Coward · · Score: 0

    misspelled*

  22. Darn? by Anonymous+McCartneyf · · Score: 3, Insightful

    In case of emergency, break out the OpenOffice, specifically the "Writer" program. It can handle .doc files almost as well as Word, and it's free.
    Also consider e-mailing the .doc files to your home computer, since your boss is apparently keeping an eye on what software is on your work computer.
    Disclaimer:
    I am getting two MS Updates today--one for IE7, and the usual malware "stinger." I don't actually use IE--I updated it for security...
    This has actually been a better month for MS update-downloads than most months last year.

    --
    There is a fine line between recklessness and courage... -- Paul McCartney
    1. Re:Darn? by locokamil · · Score: 1

      I was joking. We're a Linux shop for the most part, and I spend most of my days in xemacs on a SLES 9.0 box (working on getting that changed), and read my mail in Pine. Office is overkill unless I'm trying to make something pretty, and even then, I use LaTeX. Never had to make a presentation, so powerpoint is not necessary-- we are most fortunate in that the management operates on the same wavelength as us cogs, and understands our ideas without pretty graphs and charts. :)

  23. Ghasp! by StarkRG · · Score: 1

    Microsoft fails to fix known problem in any less than six months? How could this possibly be? They've always been so prompt about that kind of thing.

    And while I'm at it, my unicorn swallowed my key to the TARDIS, can I borrow yours?

  24. Re:Score 5, Insightful? by marcello_dl · · Score: 1

    > Funny maybe, but what "insight" or "information" does the parent post provide?

    You haven't experienced MS vs. others' stacks (be it Mac, Linux, or even mature Amiga OS) long enough to realize it.

    I agree with your criticism, though: due to the absence of "Obvious", stating that MS software ain't that good is probably "Redundant".

    --
    ---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
  25. is called mod trolling .. by rs232 · · Score: 1

    "Even more baffling, the current moderation is "40% Insightful, 30% Informative". Funny maybe, but what "insight" or "information" does the parent post provide? Ridiculous"

    It's called mod trolling where a good comment gets modded down while an obvious attempt at astroturfing gets modded up. You see the same thing happening over on DIGG.

    was: Score 5, Insightful? (Score:-1, Offtopic)

    --
    davecb5620@gmail.com
  26. Publicly Underground by SunTzuWarmaster · · Score: 2, Funny

    Does anyone else see the irony in: "a denial-of-service issue that was publicly released on an underground hacker site in Russia, also remains unpatched."

  27. I know why there's only three by Aqua_boy17 · · Score: 1
    Microsoft originally scheduled eight bulletins for release, but pulled four last Friday without explanation.
    That's because all available developers were redeployed to design the iPhone killer to be codenamed "zone".
    --
    What if the Hokey Pokey really is what it's all about?
  28. Re:Default application switching by Ken+Erfourth · · Score: 0, Flamebait

    Probably for the same reason security updates to MSN Messenger turn it back on by default when Windows starts.

    Because Microsoft is a greedy monopoly and they'll make you use their garbage whether you want to or not. Competition is for the rabble.

    --
    Fundamentalism is a crime against humanity
  29. 0-day defined by Anonymous Coward · · Score: 0

    0-day is a lot like 'ground zero' or 'patient zero'. It simply refers to the very begining of a devestation; one that is not preventable currently.