Microsoft downplays stealth Windows Update file updates
231180
Automatic updates to Windows Updates in August occurred without prior notification to users.
501620
Microsoft Corp. is flatly denying what it calls &quot;misguided reports&quot; of a flaw in its new Windows XP Service Pack 2 upgrade that exposes security information to hackers.
702221
(InfoWorld) - The contentious stealth update that Microsoft delivered to customers this summer blocks 80 patches and fixes from installing after Windows XP is restored using its "repair" feature, researchers said Thursday. Scott Dunn, who first reported the problem in a story posted Thursday morning to the "Windows Secrets" newsletter, said that users who reinstall Windows XP with the repair option cannot retrieve the full set of updates from Windows Update (WU). The problem, he said, has been traced to the so-called "stealth update" to WU which Microsoft has acknowledged sending to users beginning in July. Two weeks ago,Â Dunn broke the story of the background updates,Â which were sent to most non-corporate Windows XP and Vista users. The updates were delivered and installed without prior notification, even when the PC's owner had told the operating system not to download or install updates without notification and permission. The revelation launched a firestorm of protest from users, which in turnÂ prompted Microsoft to defend the practiceÂ as well as say it would think about ways to clarify its update policies. "Two weeks ago we said that the silent update was harmless," said Dunn Thursday. "But now we're saying it is a problem." That problem affects any user who restores Windows XP using the setup CD's "repair" option, sometimes also called an "in-place reinstallation" because it reinstalls the operating system files without disturbing the applications and data already on the disk drive. Because repair is essentially a roll-back to XP's original state, the OS must be updated with all subsequent patches and hotfixes using WU. A system bought soon after Windows XP SP2 was released, for example, would need to download and install about three years' worth of updates. After a repair, XP defaults to the "Automatic" setting for Automatic Updates, which means WU is immediately updated to version 7.0.600.381, the version pushed to PCs by the summer's undercover upgrade, said Dunn. Seven of the DLL (dynamic link library) files that make up 7.0.600.381, however, fail to register themselves with Windows. That, in turn, keeps XP from successfully installing approximately 80 of the most recent patches and fixes. In a normal, non-repair situation, there's no indication of a glitch, since DLLs by the same name have previously been keyed into Windows' registry. "On a repaired copy of XP, however, no such registration has occurred, and failing to register the new DLLs costs Windows Update the ability to install any patches," he said Dunn pointed out workarounds, which included installing an older version of WU over the top of 7.0.600.381. "Windows Secrets" has also posted instructions for creating a batch file that registers the seven DLLs. While the registration failure and the unsuccessful patch installations aren't directly related to the fact that Microsoft didn't disclose the silent WU updates, Dunn sees it as part of a bigger, and disturbing, picture. "It's part of the whole problem with the silent update, and all part of the pattern of Microsoft's sloppiness," he said. "They're keeping us out of the loop. They're not working well with the IT community." If anyone needed proof that stealth updates are a bad idea, Microsoft's defense of the practice notwithstanding, this is it, said Dunn. "IT needs to test updates for this very reason. It's why companies like to download and test updates before they install to the rest of the network," he said. It's not clear how long WU has prevented post-repair updates, but searches through Microsoft's support newsgroups revealed questions about similar behavior as long ago as June. Responses by other users, including some with Most Valued Professional (MVP) designation -- a honorific Microsoft gives to users who make major contributions to the Windows community -- offered advice much like Dunn's. Several of them pointed users to the support document KB916259. The earliest such postings, however, preceded the silent WU update to version 7.0.600.381. When questioned about the discrepancy, Dunn acknowledged the similarities, but in an e-mail said that the two issues were different. He cited several inconsistencies, including an error message called out in the support document that doesn't appear in his test machines. In fact, Microsoft has updated WU twice since late May: the July-August silent update and a visible update rolled out in June. That update was designed to fix aÂ long-standing problem with Automatic UpdatesÂ in which the PCs' CPUs maxed out at 100 percent. Microsoft was not available for comment early Thursday morning. ComputerworldÂ is an InfoWorld affiliate.
193527
Microsoft says it has distributed about 106 million copies of its major security update for the Windows XP operating system. Microsoft completed work on the update, called Service Pack 2, more than two months ago.
478958
Microsoft Corp. today released just two security updates that patch three vulnerabilities in Windows, with just one of the three flaws rated critical.
408632
Microsoft denied Wednesday that its software had arbitrarily changed Windows Vista's update settings, saying that users were responsible for the modifications that generated claims of unauthorized patch installs.Reacting to reports that first surfaced last Friday, a program manager for Windows Update said today that an investigation had turned up no evidence the Oct. 9 security fixes had switched settings in Vista's AU (Automatic Updates)."From the customer logs that we received, we found that none of the updates released as part of the October security release have made any changes to users' AU settings," said Nate Clinton in a post to a company blog. "In fact, in the logs we reviewed, AU in all cases was set to 'install updates automatically' prior to the October security release."Vista allows users to turn off AU entirely, tell the operating system to check for but neither download or install any fixes, instruct the mechanism to download files but not install them; or accept all patches without any additional approval.The claims that AU settings had mysteriously reverted to the "install automatically" setting began to trickle into a message forum on the AeroXperience Web site soon after the release last Tuesday of six security updates. Several users said that AU downloaded and installed patches even though they had specifically instructed Vista not to do so.But unlike last month, when a Windows newsletter revealed that Microsoft had updated users' PCs contrary to their instructions, the newest charges were limited to AeroXperience members. No similar reports, for example, were posted to the Windows Update support newsgroup hosted by Microsoft. During September's brouhaha, that newsgroup was thick with messages about the stealth updating.Certain that AU had not run amok and changed its own settings, Clinton fingered users for the altered state of AU. "I want to stress that the Windows Update client does not change AU settings without users' consent. However, AU settings can be set or changed in the following scenarios," he said, and then listed five; all require the user to take action or accept one option from several offered."During the installation of Windows Vista, the user chooses one of the first two recommended options in the 'Out of Box Experience' and elects to get updates automatically from Windows," Clinton said was one possibility. Another: "The user chooses to opt in to Microsoft Update during the installation or the first run experience of another Microsoft application such as Office 2007."Earlier, a Microsoft spokeswoman had been more blunt. "It may be more a case of someone clicking to change their AU settings but not realizing /remembering doing so," she said Tuesday.Users on AeroXperience writing to the forum after Microsoft wrapped up its investigation accepted Clinton's explanation. "The disparity between the Windows Update control panel applet and the OOBE (Out of Box Experience) update settings page (when first running Windows Vista) seems to be what's causing the confusion," said a member identified as Bryant.Computerworld is an InfoWorld affiliate
610820
Though Microsoft Corp.'s new security update package is all about protecting systems from worms, viruses and spyware, it can't do much about what's already on computers - and that could pose a problem.
441173
After kicking off 2008 with just two security updates in January, Microsoft plans to release one of its largest bundles of patches ever next Tuesday.Twelve security updates are set to be released next week, the software vendor said Thursday in a note on its Web site. Seven of these have been given Microsoft&#39;s most serious rating of &quot;critical.&quot; The remaining five are rated &quot;important.&quot;The critical updates are for Microsoft&#39;s Windows operating system, Internet Explorer and the company&#39;s Office software, all of which are frequent targets of hackers. Here&#39;s how they break down: Two of the critical updates are for Windows, and there is one update each for Internet Explorer, Office, Office Publisher, and Microsoft Word. A critical update is also being readied for the VBScript and JScript scripting languages used by Internet Explorer.By exploiting vulnerabilities in these applications, attackers could, in theory, run unauthorized software on a victim&#39;s PC, Microsoft warns.The less-severe updates will be for Windows Vista, Active Directory, and Microsoft Works. Two important updates are also planned for the Internet Information Services Web server software.Microsoft releases its security updates on the second Tuesday of each month, a date known as &quot;Patch Tuesday&quot; in IT circles. Last year it released a total of 69 updates, an average of just under six per month, so next week&#39;s 12 releases are sure to keep IT administrators busy.
587157
Root of recent Windows Updates woes? Microsoft's OneCare security tool changes Automatic Update settings as it installs.
530074
With automatic download of Microsoft's (Nasdaq: MSFT) enormous SP2 security patch to the Windows XP operating system set to begin, the industry still waits to understand its ramifications. Home users that have their preferences set to receive operating-system updates as they are made available by Microsoft may be surprised to learn that some of the software they already run on their systems could be disabled by SP2 or may run very differently.
303561
September&#39;s batch of Microsoft security patches was trimmed Friday, as Microsoft announced that a planned update to its SharePoint collaboration software would not be released this month.
422749
(InfoWorld) - Microsoft will release six groups of security patches next week, including three critical updates for Windows and Excel users. The critical updates will fix bugs in many different versions of Microsoft's products, including the latest versions of Excel, Windows XP, Vista, and Windows Server 2003, Microsoft said Thursday in a note on its Web site. Online criminals have used flaws in Excel and other Microsoft Office products in limited attacks over the past year. Typically, the attacker will e-mail the victim a maliciously encoded Office attachment. If the document is opened, the hacker can then gain access to the victim's computer. Microsoft isn't releasing further details on the flaws it's fixing until Tuesday, but it rates an update critical if it fixes a vulnerability that could be used by a hacker to remotely install unauthorized software on a victim's computer. Three other less-critical updates are also planned for next week's "Patch Tuesday" security fixes. They include "important" updates for Microsoft Publisher 2007 and Windows XP Service Pack 2 as well as a fix for Windows Vista. In descending order of severity, Microsoft rates updates as critical, important, moderate, or low.
302281
InfoWorld - September&#39;s batch of Microsoft security patches was trimmed Friday as Microsoft announced that a planned update to its SharePoint collaboration software would not be released this month.
489791
update To get next version of Windows out on time, company says it will delay some planned features.
715770
MicrosoftÂ has quietly released an update to Windows XP to fix a potentially serious configuration problem in the firewall that ships as part of Windows XP Service Pack 2 (SP2).
616542
(InfoWorld) - Microsoft will release six sets of security patches next Tuesday, four of which will fix critical flaws in the Windows operating system. The software will be released as part of Microsoft's regular monthly security release, known informally as "Patch Tuesday." Microsoft is also planning less critical updates for Visio and Windows Vista, the company said in a note, published Thursday. Microsoft considers an update critical when the flaw could be used by an attacker to remotely run unauthorized software on the victim's machine, theoretically leading to the propagation of an Internet worm. This month, Microsoft has revealed a few more details on the upcoming patches than it has in the past. That's part ofÂ a new plan to help IT administratorsÂ better prepare for Patch Tuesday by letting them know exactly what versions of Microsoft's products will be affected by the updates. Last month, Microsoft released seven groups of patches on Patch Tuesday.
411146
Six high priority updates, in all Microsoft is to issue four critical security fixes for this month's Patch Tuesday. Three of these affect either Windows Vista or Internet Explorer 7, which the software maker holds out as a paragon of its conversion to secure computing. In all, Microsoft will push six high-priority updates this Tuesday, the company announced today.â¦