Slashdot Mirror
MS Monthly Patch Omits Word Zero-Days
bungee jumper writes "Microsoft released four bulletins with patches for 10 vulnerabilities but there are no fixes for known MS Word zero-day flaws that are under active attack, eWeek.com reports. The January batch covers critical bugs in Excel, Outlook, and Windows. The first confirmed Windows Vista flaw, a denial-of-service issue that was publicly released on an underground hacker site in Russia, also remains unpatched." eWeek notes that Microsoft originally scheduled eight bulletins for release, but pulled four last Friday without explanation.
The patches caused more harm than good so they decided to pull them?
Damn them for not releasing patches that make a more unstable system! Damn them I say!
Microsoft released four bulletins with patches for 10 vulnerabilities but there are no fixes for known MS Word zero-day flaws that are under active attack
Well, that's because there aren't any zero-day flaws. Microsoft changed the name to ">1 day flaws", thereby solving the problem forever.
The theory of relativity doesn't work right in Arkansas.
It's OK, as long as they have the patch of the patch of the bug formerly known as Prince.
A feeling of having made the same mistake before: Deja Foobar
Local elevation of privilege is now considered a DoS attack on Vista? I guess even submitters don't have to RTFA here anymore to get published. I did read the article though since I was worried about any DoS attack for Vista and wanted to see what ports, processes, etc. it was using. All that was there though was a local only elevation of privs (where an authenticated user logged on to the box can get admin rights). Not good of course, but far from a DoS...
It's been 18 days since I've been able to us MS Word. My boss is very unhappy-- I may lose my job.
Damn you Microsoft!
If a particular vulnerability affects multiple versions of the program, you generally don't count them all as separate vulnerabilities. eWeek is counting MS07-02 as five separate patches, but really it's the same flaw in five different versions. How many people have multiple versions of Excel on their system anyway?
Microsoft is such a big company, you would think that they would have been able to solve this by now. Why couldn't they have, for example, had two or three different teams working on a patch, and then choosing the best solution? They could even offer a nice reward to the winning team as an incentive.
I like my coffee the way I like my women - roasted and ground up into little tiny pieces.
I just installed these updates and what I want to know is why updating Outlook makes it your default email application. I know I just have to click OK when I start Thunderbird again but it is annoying that I should even have to do that.
:(){
Anyone else read that as: MS Monthly Patch Omits Word "Zero-Days" ?
They aren't zero day, they're "highly relevant to your enterprise investment"!
the image is embedded in the email. thunderbird has the same "issue."
Here's the original:
- Three Microsoft Security Bulletins affecting Microsoft Windows. The
highest Maximum Severity rating for these is Critical. These updates will be
detectable using the Microsoft Baseline Security Analyzer and the Enterprise
Scan Tool. Some of these updates will require a restart.
- One Microsoft Security Bulletins affecting Microsoft Windows and Microsoft
Visual Studio. The highest Maximum Severity rating for this is Important.
These updates will be detectable using the Microsoft Baseline Security
Analyzer and the Enterprise Scan Tool. These updates will require a restart.
- One Microsoft Security Bulletins affecting Microsoft Windows and Microsoft
Office. The highest Maximum Severity rating for this is Important. These
updates will be detectable using the Microsoft Baseline Security Analyzer.
These updates may require a restart.
- Three Microsoft Security Bulletins affecting Microsoft Office. The highest
Maximum Severity rating for these is Critical. These updates will be
detectable using the Microsoft Baseline Security Analyzer. These updates may
require a restart.
In the end there was only one Windows patch - a critical flaw in VML - along with critical patches Outlook and Excel. The only 'important' patch was for Office 2003 but seemed to only affect the Brazilian Portugese version.I was surprised to find, following the TFA, that eWeek got hold of this last Friday.
"Zero-day" is an exploit classification.
It goes like this. Software has bugs. These bugs can cause security vulnerabilities, which are then published and patches issued to fix the vulnerabilities. Hopefully, all this happens before the black hats can take advantage of -- or exploit -- these vulnerabilities.
An exploit of a vulnerability is the virus, worm, SQL injection, hack attempt, etc. itself. An exploit can be labelled "zero-day" when an in-the-wild exploit has been detected on the same day that the vulnerability was made known to the security industry. Most often, "zero-day" means "we learned there was a vulnerability when we found this exploit". This is rather like finding out the locks on your doors don't work when a thief has already been and gone. Zero-day exploits then will have a maximal timeframe to affect vulnerable systems since no work has been done on fixing the vulnerability (presumably).
The Slammer worm, for example, was an [i]exploit[/i] of MS SQL Server 2000. SQL Server 2000 had a buffer overflow vulerability which was the subject of Slammer. Slammer was not zero-day, however, since this security vulnerability had been known about for many months and MS had already issued patches for it (six months prior to Slammer).
The vast majority of exploits are *not* zero-day, but uninformed reporters for computer news services (like CNet, or anything Ziff Davis owns) are now using "zero-day" as a synonym for "new vulnerability" instead of the proper "new exploit to unknown vulnerability".
The road to tyranny has always been paved with claims of necessity.
In case of emergency, break out the OpenOffice, specifically the "Writer" program. It can handle .doc files almost as well as Word, and it's free. .doc files to your home computer, since your boss is apparently keeping an eye on what software is on your work computer.
Also consider e-mailing the
Disclaimer:
I am getting two MS Updates today--one for IE7, and the usual malware "stinger." I don't actually use IE--I updated it for security...
This has actually been a better month for MS update-downloads than most months last year.
There is a fine line between recklessness and courage... -- Paul McCartney
Does anyone else see the irony in: "a denial-of-service issue that was publicly released on an underground hacker site in Russia, also remains unpatched."