Microsoft: No March Security Updates
9131
After a whopping twelve security updates last month, March will bring Windows users a welcome sigh of relief: Microsoft has no patches planned for next week. The company will, however, release a number of non-security updates; 2 will appear on Windows Update and 4 on Microsoft update.
737244
Windows update doesn't play well with all applications, even Redmond's. Also: CNET Reviews on security work still to be done.
738931
In sharp contrast to last month&#39;s barrage of critical patches, Microsoft today offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
501620
Microsoft Corp. is flatly denying what it calls &quot;misguided reports&quot; of a flaw in its new Windows XP Service Pack 2 upgrade that exposes security information to hackers.
381045
Microsoft&#39;s monthly patch day for December will produce security updates for five vulnerabilities affecting Windows users, the company said Thursday.
441173
After kicking off 2008 with just two security updates in January, Microsoft plans to release one of its largest bundles of patches ever next Tuesday.Twelve security updates are set to be released next week, the software vendor said Thursday in a note on its Web site. Seven of these have been given Microsoft&#39;s most serious rating of &quot;critical.&quot; The remaining five are rated &quot;important.&quot;The critical updates are for Microsoft&#39;s Windows operating system, Internet Explorer and the company&#39;s Office software, all of which are frequent targets of hackers. Here&#39;s how they break down: Two of the critical updates are for Windows, and there is one update each for Internet Explorer, Office, Office Publisher, and Microsoft Word. A critical update is also being readied for the VBScript and JScript scripting languages used by Internet Explorer.By exploiting vulnerabilities in these applications, attackers could, in theory, run unauthorized software on a victim&#39;s PC, Microsoft warns.The less-severe updates will be for Windows Vista, Active Directory, and Microsoft Works. Two important updates are also planned for the Internet Information Services Web server software.Microsoft releases its security updates on the second Tuesday of each month, a date known as &quot;Patch Tuesday&quot; in IT circles. Last year it released a total of 69 updates, an average of just under six per month, so next week&#39;s 12 releases are sure to keep IT administrators busy.
664507
(InfoWorld) - Microsoft will release five sets of security patches next Tuesday, including a critical update for users of Windows 2000,Â the company saidÂ Thursday. With the remaining four security updates rated as "important" by Microsoft, this latest round of patches appears to be less worrisome than the August updates. Last month,Â Microsoft released nine updates, six of which were rated critical. Microsoft rates its bug fixes as critical when attackers can exploit the flaws without requiring any user action. Also set to be patched this month are Visual Studio, Windows Services for Unix, SharePoint Services, and the Windows Live and MSN Messenger software. Microsoft releases its security patches on the second Tuesday of each month, generally around 11 a.m., Pacific time. With this latest rounds of patches, Microsoft will have released 55 updates in 2007, the same number it had released by September of last year.
55054
Microsoft issues fixes for more than 20 holes in its software in its February security update.
231180
Automatic updates to Windows Updates in August occurred without prior notification to users.
430010
Microsoft releases patches for three security holes, but does not have a fix for a Word 2000 flaw being used in attacks.
78946
Microsoft released 11 security updates Tuesday to&#160;fix critical flaws in its products, including a publicly known ActiveX bug that affects users of the Visual FoxPro database.In total, 17 individual software flaws were patched in the updates. Microsoft rates six updates as critical, meaning they should be installed as soon as possible, while the remaining five updates are considered &quot;important.&quot; Last month was an easier month on IT administrators, when Microsoft released just two updates.Microsoft surprised some by releasing one&#160;fewer update than expected. Last Thursday, the software vendor had said that it was&#160;readying a fix&#160;for critical VBScript and JScript flaws in Windows 2000, XP, and Windows Server 2003. That update wasn&#39;t included in this week&#39;s patches, but on Tuesday, Microsoft wouldn&#39;t confirm that it had actually dropped the update because &quot;this could put customers at risk,&quot; according a spokeswoman for the company&#39;s public relations agency.Security experts said Tuesday that the MS08-010 update, which fixes four bugs in Internet Explorer, should take top priority this week. &quot;There are four vulnerabilities within that particular patch and all of them are remote-code executable,&quot; said Jonathan Bitle, director of technical account management with Qualys.&quot;The way we&#39;re looking at it, our prioritization would put MS08-010 at the top, followed by MS08-007,&quot; said Don Leatham, director of solutions and strategy with Lumension Security.MS08-010 fixes a publicly disclosed ActiveX bug that affects Visual FoxPro users. Although hackers have already posted code showing how to exploit this vulnerability, the buggy ActiveX control is not included in Internet Explorer 7&#39;s default list of controls, so the flaw should not affect most users.The MS08-007 update fixes a critical flaw in the Windows XP and Vista WebDAV redirector software. WebDAV is a Web-based document sharing protocol. The flaw is rated important for Windows Server 2003 users.Microsoft&#39;s Office products are also a major source of patches this month. Tuesday&#39;s updates include critical fixes for Microsoft Word, Office Publisher, and Office itself. There is also a critical update for Windows&#39; Object Linking and Embedding (OLE) Automation software. The remaining updates, rated important, are for Active Directory, the Vista TCP/IP stack, the Microsoft Works file converter, and two bugs in the Internet Information Services (IIS) Web server.The Patch Tuesday updates show that client-side bugs continue to be a much higher risk than server-side vulnerabilities, said Andrew Storms, director of security operations with nCircle. &quot;One would have assumed that the IIS and Active Directory vulnerabilities would have been the most serious because they stand at the core of an enterprise and provide more critical services,&quot; he said via instant message. &quot;But with this month&#39;s patches, the hacker&#39;s best bet is to take advantage of the client-side attacks.&quot;
55085
Microsoft advised users of its Mac version of Microsoft Office that a security patch inadvertently issued through its software update service was not ready for release. It advised those that may have applied the patch to uninstall the update.
560856
Microsoft was not alone to release a security update to one of their applications this week (they updated the firewall, which was shipped with Windows XP).
666199
Microsoft said it would not use Windows' Automatic Updates to push out the large Office upgrade for several months, but some users got it anyway.
411146
Six high priority updates, in all Microsoft is to issue four critical security fixes for this month's Patch Tuesday. Three of these affect either Windows Vista or Internet Explorer 7, which the software maker holds out as a paragon of its conversion to secure computing. In all, Microsoft will push six high-priority updates this Tuesday, the company announced today.â¦
660592
(InfoWorld) - After handling 19 sets of patches inÂ JulyÂ andÂ August, system administrators will catch a bit of a break next week when Microsoft Corp. is expected to release just three security updates for its Windows and Office products. On Thursday, Microsoft said that only one of these updates, for Office, is rated as critical. The updates will be released Tuesday in line with Microsoft's monthly patch release schedule. Microsoft'sÂ advance notification on the updatesÂ can be found at its Web site. The other two updates, which fix problems with Windows, are rated no higher than Important, meaning that user action would be required before an attack based on these flaws could succeed. As usual, Microsoft did not release any further details on the patches. That information will be divulged when the patches are made available Tuesday. But the company may be planning to patch aÂ recently reported flaw in its Word 2000 software. Earlier this week Symantec Corp. warned that the flaw was being exploited by attackers to run unauthorized software on a victim's computer. Â
411156
Microsoft's consumer security software changes the AU (Automatic Updates) settings in Windows XP and Vista without telling users or getting their approval, a researcher said Thursday -- behavior that may explain recent reports of patches being installed and systems rebooting without permission.When Microsoft responded to new charges of silent changes last week, however, it denied that AU settings were ever altered without user approval, and it didn't mention OneCare as a possible culprit.Scott Dunn, an editor at the "Windows Secrets" newsletter, reported Thursday morning that OneCare silently changes AU settings as it installs. No matter what AU setting the user selected previously, OneCare's installer quietly changes it to the fully automatic option."Some security products have turned on AU in the past," said Dunn, who also tested several other current consumer suites, including Symantec's Norton 360 and Norton Internet Security, McAfee's Internet Security Suite, and Check Point Software's ZoneAlarm Internet Security Suite. "But OneCare was the only guilty party."OneCare's willful way with AU may be an explanation for the reports two weeks ago of machines downloading and installing the Oct. 9 set of security fixes even though their owners had explicitly instructed Windows to ignore all downloads or notify them before they were installed.Several days later, after it wrapped up an investigation, Microsoft said AU settings were never changed without user consent, and it blamed absent-minded users for making modifications and then forgetting that they had."I find this surprising and very disturbing," said Dunn. "If they're going to change [AU] settings, they should let you know."Four options, down to one In both Windows XP and Vista, users can select from four options in AU: Download and install all updates automatically; download files but do not install them without user consent; check for but neither download nor install without permission; and disable Automatic Updates entirely.OneCare, sold for $49.95 and offered as a free 90-day trial, sets AU to the first, and all-automatic, setting, said Dunn, on both operating systems. "It does that even if Automatic Updates is completely disabled," he added. If users later uninstall OneCare -- for instance, after a trial has expired -- the software does not return the machine to the earlier settings; they must be reset by the user."Worse, OneCare silently turns on [Windows] services that have been disabled by the user," Dunn said, referring to the two services that some users, frustrated at earlier incidents in which Windows retrieved and installed patches without permission, have manually turned off: Automatic Updates and Background Intelligent Transfer Service. The services can be switched off manually using the Windows services.msc utility. Normally, once disabled, they remain that way until the user manually turns them back on.ComputerWorld confirmed Dunn's account of OneCare's AU changes by installing the security suite on both Windows XP and Windows Vista.At no time during installation, said Dunn, does OneCare tell the user that the software will modify Windows' settings or provide an opt-in dialog. Nor do the various online documents -- including Microsoft's privacy statement and an addendum for OneCare -- that are offered up early during the process contain any information about the changes. "It turns out there's a brief mention of it buried deep in one of the OneCare help files," said Dunn. "But that's not the same as telling users upfront."The help file (select "What does Windows Live Update do to help manage and maintain my computer's software updates?" to view the pertinent section) acknowledges that OneCare makes changes without bothering to ask. "When you first install Windows Live OneCare, setup automatically enlists your computer in Microsoft Update and changes your computer's settings to download and install updates automatically using Automatic Updates," it reads.Who's 'forgetful' now? Although Microsoft was not immediately available for comment this morning, it made it clear last week that reports of unauthorized updates, and even PC reboots, could not be blamed on its software."I want to stress that the Windows Update client does not change AU settings without users' consent," said Nate Clinton, a program manager with the Microsoft Update team in a company blog entry a week ago. He went on to list five possible explanations; all require the user to take action or accept one option from several offered.Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing/remembering doing so," she said last Tuesday. She also called out OneCare's installation as one such possible moment and claimed that the security suite offered users the option of changing AU settings. It does not."This is just one more example of Microsoft having the attitude that we know better than you do, that you should just stop asking questions and let us do what we want," said Dunn.Computerworld is an InfoWorld affiliate