Third-party Updates Not Enough to Plug Hole in Windows Shell
117966
It's another humbling admission that would have been distinctly uncharacteristic of Microsoft just years ago. But this morning, the company's security response communications manager, Bill Sisk, told customers on the MSRC blog that recent "third-party" efforts to plug a potentially serious vulnerability between Internet Explorer 7 and Windows XP can't go far enough to solve the underlying problem.
109425
Aargh! Server outage turns customers into pirates Over the weekend, thousands of Microsoft customers who tried to download patches or updates for Windows were falsely accused of running a pirated version of Windows.â¦
722556
John Mertic has a quick note on his blog about the latest release candidate for the Windows PHP installer (PHP5.2.0RC3) and some issues they've been having.    Rebuilt the installer for 5.2.0RC3. Edin was having problems building it so I'm going to do it and upload it; hopefully we can resolve the issue.   It's also noted that if you see issues with using the installer, try removing the previous PHP installation before running it again.
594651
A critical hole in Windows XP firewall in Service Pack 2 makes computers accessible to anyone on the network. The configuration problem only affects dial-up users: some dialling software mistakes the entire
698606
New virtual-machine technology can be used to test software patches and migrate aging Windows NT applications. By John Foley, Paula Rooney, CRN.
571395
Microsoft issues a third version of a troubled Internet Explorer patch to fix a bug in an earlier update.
658928
Microsoft Corp. has quietly released a &quot;critical&quot; Windows XP Service Pack 2 update to fix a serious flaw in the Windows Firewall utility.
553808
The stealth update that Microsoft recently delivered to customers blocks 80 patches and fixes from installing after Windows XP is restored using its "repair" feature.
265572
Microsoft says the scripting platform, called Shell, is not final.
702221
(InfoWorld) - The contentious stealth update that Microsoft delivered to customers this summer blocks 80 patches and fixes from installing after Windows XP is restored using its "repair" feature, researchers said Thursday. Scott Dunn, who first reported the problem in a story posted Thursday morning to the "Windows Secrets" newsletter, said that users who reinstall Windows XP with the repair option cannot retrieve the full set of updates from Windows Update (WU). The problem, he said, has been traced to the so-called "stealth update" to WU which Microsoft has acknowledged sending to users beginning in July. Two weeks ago,Â Dunn broke the story of the background updates,Â which were sent to most non-corporate Windows XP and Vista users. The updates were delivered and installed without prior notification, even when the PC's owner had told the operating system not to download or install updates without notification and permission. The revelation launched a firestorm of protest from users, which in turnÂ prompted Microsoft to defend the practiceÂ as well as say it would think about ways to clarify its update policies. "Two weeks ago we said that the silent update was harmless," said Dunn Thursday. "But now we're saying it is a problem." That problem affects any user who restores Windows XP using the setup CD's "repair" option, sometimes also called an "in-place reinstallation" because it reinstalls the operating system files without disturbing the applications and data already on the disk drive. Because repair is essentially a roll-back to XP's original state, the OS must be updated with all subsequent patches and hotfixes using WU. A system bought soon after Windows XP SP2 was released, for example, would need to download and install about three years' worth of updates. After a repair, XP defaults to the "Automatic" setting for Automatic Updates, which means WU is immediately updated to version 7.0.600.381, the version pushed to PCs by the summer's undercover upgrade, said Dunn. Seven of the DLL (dynamic link library) files that make up 7.0.600.381, however, fail to register themselves with Windows. That, in turn, keeps XP from successfully installing approximately 80 of the most recent patches and fixes. In a normal, non-repair situation, there's no indication of a glitch, since DLLs by the same name have previously been keyed into Windows' registry. "On a repaired copy of XP, however, no such registration has occurred, and failing to register the new DLLs costs Windows Update the ability to install any patches," he said Dunn pointed out workarounds, which included installing an older version of WU over the top of 7.0.600.381. "Windows Secrets" has also posted instructions for creating a batch file that registers the seven DLLs. While the registration failure and the unsuccessful patch installations aren't directly related to the fact that Microsoft didn't disclose the silent WU updates, Dunn sees it as part of a bigger, and disturbing, picture. "It's part of the whole problem with the silent update, and all part of the pattern of Microsoft's sloppiness," he said. "They're keeping us out of the loop. They're not working well with the IT community." If anyone needed proof that stealth updates are a bad idea, Microsoft's defense of the practice notwithstanding, this is it, said Dunn. "IT needs to test updates for this very reason. It's why companies like to download and test updates before they install to the rest of the network," he said. It's not clear how long WU has prevented post-repair updates, but searches through Microsoft's support newsgroups revealed questions about similar behavior as long ago as June. Responses by other users, including some with Most Valued Professional (MVP) designation -- a honorific Microsoft gives to users who make major contributions to the Windows community -- offered advice much like Dunn's. Several of them pointed users to the support document KB916259. The earliest such postings, however, preceded the silent WU update to version 7.0.600.381. When questioned about the discrepancy, Dunn acknowledged the similarities, but in an e-mail said that the two issues were different. He cited several inconsistencies, including an error message called out in the support document that doesn't appear in his test machines. In fact, Microsoft has updated WU twice since late May: the July-August silent update and a visible update rolled out in June. That update was designed to fix aÂ long-standing problem with Automatic UpdatesÂ in which the PCs' CPUs maxed out at 100 percent. Microsoft was not available for comment early Thursday morning. ComputerworldÂ is an InfoWorld affiliate.
663754
Microsoft has confirmed the existence of a vulnerability affecting the Windows Shell. The issue exists in the WebViewFolderIcon ActiveX control, and exploitation could result in an attacker gaining the same rights as a local user.
29062
Longhorn TCP offloading, Serial ATA 3Gbps - but no post-AC97 sound
116589
Some say Win XP SP2 enhancements cause conflicts, don't protect as claimed.
498993
But warns it's a dummy installer with no update code
481430
Following their public availability on Microsoft's Download Center, two hotfix packs for Windows Vista that improve performance and reliability are now available as optional downloads via Windows Update. They will not, however, be delivered automatically to Vista users.
250638
Windows, Linux and Java each fail some basic integrity rules.
68810
Rare, out-of-cycle Windows patch fixes one flaw, but attacks through other known, yet-to-be-plugged holes continue.