Microsoft downplays stealth Windows Update file updates
231180
Automatic updates to Windows Updates in August occurred without prior notification to users.
15812
Microsoft has quietly released an update to Windows XP to fix a potentially serious configuration problem in the firewall that ships as part of Windows XP Service Pack 2. Users who installed SP2 on their Windows
768081
Microsoft Corp. on Tuesday released several security fixes for its Windows operating system and Office software, and rereleased two previous patches.
6705
OCTOBER 12, 2004  - Microsoft Corp.&#39;s monthly patch release cycle may be making it more predictable for users to deploy software updates, but there appears to be little letup in the number of holes being discovered in the company&#39;s software
452953
Microsoft has released its last regular security update of the year which includes five new patches, all rated &#39;important&#39;, and the reissue of a &#39;critical&#39; patch after extensive revisions.
395498
NOVEMBER 04, 2004 (IDG NEWS SERVICE) - Microsoft Corp. will give customers advance notice of its monthly security updates in an effort to help them prepare to install related software patches, the company announced today.
411156
Microsoft's consumer security software changes the AU (Automatic Updates) settings in Windows XP and Vista without telling users or getting their approval, a researcher said Thursday -- behavior that may explain recent reports of patches being installed and systems rebooting without permission.When Microsoft responded to new charges of silent changes last week, however, it denied that AU settings were ever altered without user approval, and it didn't mention OneCare as a possible culprit.Scott Dunn, an editor at the "Windows Secrets" newsletter, reported Thursday morning that OneCare silently changes AU settings as it installs. No matter what AU setting the user selected previously, OneCare's installer quietly changes it to the fully automatic option."Some security products have turned on AU in the past," said Dunn, who also tested several other current consumer suites, including Symantec's Norton 360 and Norton Internet Security, McAfee's Internet Security Suite, and Check Point Software's ZoneAlarm Internet Security Suite. "But OneCare was the only guilty party."OneCare's willful way with AU may be an explanation for the reports two weeks ago of machines downloading and installing the Oct. 9 set of security fixes even though their owners had explicitly instructed Windows to ignore all downloads or notify them before they were installed.Several days later, after it wrapped up an investigation, Microsoft said AU settings were never changed without user consent, and it blamed absent-minded users for making modifications and then forgetting that they had."I find this surprising and very disturbing," said Dunn. "If they're going to change [AU] settings, they should let you know."Four options, down to one In both Windows XP and Vista, users can select from four options in AU: Download and install all updates automatically; download files but do not install them without user consent; check for but neither download nor install without permission; and disable Automatic Updates entirely.OneCare, sold for $49.95 and offered as a free 90-day trial, sets AU to the first, and all-automatic, setting, said Dunn, on both operating systems. "It does that even if Automatic Updates is completely disabled," he added. If users later uninstall OneCare -- for instance, after a trial has expired -- the software does not return the machine to the earlier settings; they must be reset by the user."Worse, OneCare silently turns on [Windows] services that have been disabled by the user," Dunn said, referring to the two services that some users, frustrated at earlier incidents in which Windows retrieved and installed patches without permission, have manually turned off: Automatic Updates and Background Intelligent Transfer Service. The services can be switched off manually using the Windows services.msc utility. Normally, once disabled, they remain that way until the user manually turns them back on.ComputerWorld confirmed Dunn's account of OneCare's AU changes by installing the security suite on both Windows XP and Windows Vista.At no time during installation, said Dunn, does OneCare tell the user that the software will modify Windows' settings or provide an opt-in dialog. Nor do the various online documents -- including Microsoft's privacy statement and an addendum for OneCare -- that are offered up early during the process contain any information about the changes. "It turns out there's a brief mention of it buried deep in one of the OneCare help files," said Dunn. "But that's not the same as telling users upfront."The help file (select "What does Windows Live Update do to help manage and maintain my computer's software updates?" to view the pertinent section) acknowledges that OneCare makes changes without bothering to ask. "When you first install Windows Live OneCare, setup automatically enlists your computer in Microsoft Update and changes your computer's settings to download and install updates automatically using Automatic Updates," it reads.Who's 'forgetful' now? Although Microsoft was not immediately available for comment this morning, it made it clear last week that reports of unauthorized updates, and even PC reboots, could not be blamed on its software."I want to stress that the Windows Update client does not change AU settings without users' consent," said Nate Clinton, a program manager with the Microsoft Update team in a company blog entry a week ago. He went on to list five possible explanations; all require the user to take action or accept one option from several offered.Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing/remembering doing so," she said last Tuesday. She also called out OneCare's installation as one such possible moment and claimed that the security suite offered users the option of changing AU settings. It does not."This is just one more example of Microsoft having the attitude that we know better than you do, that you should just stop asking questions and let us do what we want," said Dunn.Computerworld is an InfoWorld affiliate
252938
OCTOBER 18, 2004  - Microsoft Corp.&#39;s move to a monthly patch-release cycle one year ago this month has made it easier to install security updates for Windows and other products, IT managers said last weekâeven as they were greeted with a
32227
Computer giant Microsoft has fully rolled out its crucial security update to computers running its Windows XP. Last week, it &quot;soft launched&quot; Service Pack 2 (SP2) security update, making it available for some
61854
Microsoft has started to send out its latest major security patch to home PCs--but some people won&#39;t get it for a while.
484861
On October 10, Microsoft will issue 11 security bulletins as part of this month's Patch Tuesday. Six of the updates affect Windows, with the highest severity being "critical." Another four patches will cover Microsoft Office, also with critical severity, while a moderate fix is slated for the .NET Framework.
302281
InfoWorld - September&#39;s batch of Microsoft security patches was trimmed Friday as Microsoft announced that a planned update to its SharePoint collaboration software would not be released this month.
717255
Microsoft will have patches for Windows and Visual Studio on Tuesday, but apparently not for a Word flaw being used in cyberattacks.
715770
MicrosoftÂ has quietly released an update to Windows XP to fix a potentially serious configuration problem in the firewall that ships as part of Windows XP Service Pack 2 (SP2).
641672
September's batch of Microsoft security patches was trimmed Friday, as Microsoft announced that a planned updat...
371153
(InfoWorld) - Microsoft plans to release 13 sets of security patches next Tuesday fixing critical vulnerabilities in a number of its products, including the company's new security software. The bulk of the patches will fix flaws in the Windows operating system and Office, Microsoft said in a statement published Thursday on its Web site. Five of the updates will be for Windows, and two of them will be for Office. Microsoft also plans to release one less-critical update that addresses flaws in both Windows and Office. The patches will be released as part of Microsoft's monthly cycle of security updates. There will also be patches for Microsoft's Step-by-Step Interactive Training andÂ Microsoft Data Access Components and an update that covers both Windows and Visual Studio. Finally, Microsoft will also publish an update that patches critical flaws in its Windows Live OneCare, Antigen, Windows Defender, and ForeFront security software. The Office patches have been anticipated as online criminals have been exploiting unpatched vulnerabilities in Word and Excel for several months now. These attacks, which are occurring on a limited scale according to Microsoft, try to trick the victim into opening a maliciously coded Office attachment in order to compromise the PC.
174866
Monthly security updates include IE, Windows Media, and Visual Studio fixes.