Microsoft denies flaw in XP upgrade
501620
Microsoft Corp. is flatly denying what it calls &quot;misguided reports&quot; of a flaw in its new Windows XP Service Pack 2 upgrade that exposes security information to hackers.
761157
Microsoft's security-minded SP2 update to Windows XP finally makes it out the door, but not without stumbling.
193527
Microsoft says it has distributed about 106 million copies of its major security update for the Windows XP operating system. Microsoft completed work on the update, called Service Pack 2, more than two months ago.
461237
(InfoWorld) - A Microsoft security executive released data Thursday showing that, six months after shipping Windows Vista, his company has left more publicly disclosed Vista bugs unpatched than it did with Windows XP. In total, Microsoft has patched 12 out of 27 disclosedÂ Vista vulnerabilitiesÂ in the six months after it first shipped last November. During XP's first six months, Microsoft's security team patched 36 out of 39 known bugs. The data was published by Jeff Jones, a Microsoft security strategy director, who said that overall, Vista was doing better than XP. "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to its predecessor product, Windows XP," he wrote. Jones didn't address the larger number of unpatched vulnerabilities, but he did note most of the unpatched Vista bugs were not critical. Microsoft had left only one high-severity Vista vulnerability unpatched during the period. At the end of XP's first six months, there were two high-severity bugs that were unpatched. Microsoft patched 23 high-severity XP bugs during its first six months, compared with only one high-severity Vista flaw. Jones argued that Vista had a lower number of vulnerabilities than competitive operating system products such as Red Hat Enterprise Linux and Mac OS X. He published the data in an effort to show how Microsoft's software development methodology, called the Security Development Lifecycle (SDL) is yielding dividends. But his method of comparing Windows to Linux and Mac OS X is problematic, according to some. "This is an apples-to-oranges comparison," said HD Moore, one of the hackers behind the popular Metasploit penetration testing toolkit. "If you want a more accurate view, try comparing the number of flaws between Microsoft-developed software and vendor-X-developed software. Most Linux vendors don't actually write the majority of the packages they include," he said via e-mail. "Alternatively, force Microsoft to include all vulnerabilities in common third-party software," he added. "For example, the thousands of exploitable ActiveX controls that... vendors include with a Windows system." According to Randy Abrams, director of technical education with antivirus vendor Eset, it will be more interesting to look at vulnerability statistics once Vista becomes more popular than XP, and the target of more hackers. But Microsoft has stepped up its security practices, he added. "I think their Security Development Lifecycle initiative has improved the quality of the code," he said. Â
317145
Microsoft rejects claims from security researchers that a spoofing technique discovered on Internet Explorer is a vulnerability.
663590
Microsoft has issued a fix for a newly discovered flaw in Windows XP SP2 firewall. The flaw allows anyone on the Internet, access a Windows Firewall exception if the exception is configured to use the My network (subnet) only scope option.
553808
The stealth update that Microsoft recently delivered to customers blocks 80 patches and fixes from installing after Windows XP is restored using its "repair" feature.
355686
A security firm says it has found 10 major security flaws in Microsoft's (Nasdaq: MSFT) Windows XP Service Pack 2. The weaknesses could allow intruders to bypass many of the security measures implemented by the update.
55391
Microsoft released a &quot;critical&quot; fix on Thursday for a security issue left unresolved by the Windows XP Service Pack 2. The configuration change closed a hole in the Windows firewall settings that could open
250599
REDMOND, Washington Microsoft has delayed the automated distribution of a major security upgrade to its Windows XP Professional computer operating system, citing a desire to give companies more time to test it.
155594
Security researchers inspecting a new update to Microsoft Corp.'s Windows XP found two software flaws that could allow virus writers and malicious hackers to sidestep new security features in the operating system.
273091
Security experts are warning of a new and highly critical security flaw in Microsoft (Nasdaq: MSFT) Internet Explorer, when running under Windows XP SP2.
237726
Microsoft Corp. is offering an olive branch to users of pirated versions of the Windows XP operating system. The software giant on Wednesday unveiled the Windows XP Counterfeit Project in the UK, offering
87464
Computer giant Microsoft has launched a pilot scheme to replace counterfeit versions of Windows XP with legal ones. The first-time initiative is restricted to the UK and to users with pre-installed copies
360314
Windows XP and Windows Vista systems can be exploited if they haven't been updated with Redmond's first patch of 2008, says security firm.
702221
(InfoWorld) - The contentious stealth update that Microsoft delivered to customers this summer blocks 80 patches and fixes from installing after Windows XP is restored using its "repair" feature, researchers said Thursday. Scott Dunn, who first reported the problem in a story posted Thursday morning to the "Windows Secrets" newsletter, said that users who reinstall Windows XP with the repair option cannot retrieve the full set of updates from Windows Update (WU). The problem, he said, has been traced to the so-called "stealth update" to WU which Microsoft has acknowledged sending to users beginning in July. Two weeks ago,Â Dunn broke the story of the background updates,Â which were sent to most non-corporate Windows XP and Vista users. The updates were delivered and installed without prior notification, even when the PC's owner had told the operating system not to download or install updates without notification and permission. The revelation launched a firestorm of protest from users, which in turnÂ prompted Microsoft to defend the practiceÂ as well as say it would think about ways to clarify its update policies. "Two weeks ago we said that the silent update was harmless," said Dunn Thursday. "But now we're saying it is a problem." That problem affects any user who restores Windows XP using the setup CD's "repair" option, sometimes also called an "in-place reinstallation" because it reinstalls the operating system files without disturbing the applications and data already on the disk drive. Because repair is essentially a roll-back to XP's original state, the OS must be updated with all subsequent patches and hotfixes using WU. A system bought soon after Windows XP SP2 was released, for example, would need to download and install about three years' worth of updates. After a repair, XP defaults to the "Automatic" setting for Automatic Updates, which means WU is immediately updated to version 7.0.600.381, the version pushed to PCs by the summer's undercover upgrade, said Dunn. Seven of the DLL (dynamic link library) files that make up 7.0.600.381, however, fail to register themselves with Windows. That, in turn, keeps XP from successfully installing approximately 80 of the most recent patches and fixes. In a normal, non-repair situation, there's no indication of a glitch, since DLLs by the same name have previously been keyed into Windows' registry. "On a repaired copy of XP, however, no such registration has occurred, and failing to register the new DLLs costs Windows Update the ability to install any patches," he said Dunn pointed out workarounds, which included installing an older version of WU over the top of 7.0.600.381. "Windows Secrets" has also posted instructions for creating a batch file that registers the seven DLLs. While the registration failure and the unsuccessful patch installations aren't directly related to the fact that Microsoft didn't disclose the silent WU updates, Dunn sees it as part of a bigger, and disturbing, picture. "It's part of the whole problem with the silent update, and all part of the pattern of Microsoft's sloppiness," he said. "They're keeping us out of the loop. They're not working well with the IT community." If anyone needed proof that stealth updates are a bad idea, Microsoft's defense of the practice notwithstanding, this is it, said Dunn. "IT needs to test updates for this very reason. It's why companies like to download and test updates before they install to the rest of the network," he said. It's not clear how long WU has prevented post-repair updates, but searches through Microsoft's support newsgroups revealed questions about similar behavior as long ago as June. Responses by other users, including some with Most Valued Professional (MVP) designation -- a honorific Microsoft gives to users who make major contributions to the Windows community -- offered advice much like Dunn's. Several of them pointed users to the support document KB916259. The earliest such postings, however, preceded the silent WU update to version 7.0.600.381. When questioned about the discrepancy, Dunn acknowledged the similarities, but in an e-mail said that the two issues were different. He cited several inconsistencies, including an error message called out in the support document that doesn't appear in his test machines. In fact, Microsoft has updated WU twice since late May: the July-August silent update and a visible update rolled out in June. That update was designed to fix aÂ long-standing problem with Automatic UpdatesÂ in which the PCs' CPUs maxed out at 100 percent. Microsoft was not available for comment early Thursday morning. ComputerworldÂ is an InfoWorld affiliate.
560856
Microsoft was not alone to release a security update to one of their applications this week (they updated the firewall, which was shipped with Windows XP).