Windows Bugs Still Not Patched
388740
Two months after hacker HD Moore publicly disclosed 22 bugs, only two have been fixed.
715617
Security vendors are warning of two new malware variants that exploit a recently patched flaw in Windows, but Microsoft says that attacks are not on the rise.
484286
No critical patches for most Windows users Microsoft served comparatively modest fare for its monthly patch release on Tuesday, issuing only four security-related updates, only one of which carried its top severity rating of critical. It plugged a hole in a Windows 2000 component, while the other updates fixed vulnerabilities rated as important in instant messenger programs, Visual Studio .Net and Windows services for Unix found on several different versions of the Windows operating system.â¦
414849
The giant has released a patch so that Windows doesn&#39;t let in hackers when it handles JPEG graphics formats. The flaw means that attackers can create an image file that will automatically run dodgy code, dump
592740
Microsoft issued seven patches on Tuesday as part of its monthly Patch Tuesday cycle, with three updates receiving the dreaded "critical" rating. While Redmond did not issue an update for the newly discovered Word vulnerabilities, the software giant said it is still working on a fix for the two critical flaws that have been the target of numerous hack attacks since last week.
388719
(InfoWorld) - Microsoft Corp. plans to patch its Windows and Visual Studio products next week, but it does not have a fix in the works for aÂ widely publicized flaw in Word, which hackers are reportedly exploiting in targeted attacks. The company's security team is readying five sets of patches for Windows, and will also issue a single critical security update for Visual Studio, Microsoft said in an alert published Thursday. Microsoft rates the most serious of its Windows updates as "critical," meaning an attacker could exploit the underlying flaw to run malware on a victim's PC with no user action, the company said. These security patches are usually released on the second Tuesday of each month, and the company strives to publish a small number of updates in December, because IT operations are often short-staffed during the holiday season. On Tuesday, Microsoft warned of a vulnerability in its Word software that had been reportedly used in online attacks. Security researchers rated this flaw critical, because an attacker could exploit it to run malicious software on a victim's PC. For such an attack to work, however, the victim would first have to be tricked into opening a maliciously encoded Word file. The Word flaw is not scheduled to be patched next Tuesday, said a spokesman for Microsoft's public relations firm. There is, however, one critical Visual Studio flaw that may be addressed in the updates. That bug is in Visual Studio 2005's WMI Object Broker ActiveX object. It was first reported in late October.
257602
In the latest incident of a now-chronic problem that has been bugging Microsoft all year, a recent security patch now causes IE6 to crash in Windows XP...again.
691915
And a further five 'important' patches Microsoft released eleven patches yesterday, with six of them meriting a critical rating.â¦
713300
A stitch in time... Microsoft this week pushed out a patch to resolve a flaw in its patching system.â¦
243487
The debate over who's at fault for a Windows zero-day vulnerability continues, with Microsoft saying it's not responsible for the issue and Mozilla making plans to patch Firefox -- even though it accepts no blame for the flaw either.
220487
An exploit attacking the most recent Windows bug is circulating on Usenet, security experts said Tuesday, that crashes machines, yet another indicator that attackers will chase the vulnerability until they&#39;ve launched mass mailing-style worm-based attacks
227893
Blog: This security update for Windows users piggybacks patches for Apple users.
234083
.NET patch trips up systems Early reports are suggesting problems after users apply one of the six patches issued by Microsoft on Tuesday.â¦
563347
No word on Word fixes, yet Microsoft issued seven patches on Tuesday - one more than expected - as part of its monthly Patch Tuesday update cycle. Three of the updates earn the dreaded rating of critical.â¦
702221
(InfoWorld) - The contentious stealth update that Microsoft delivered to customers this summer blocks 80 patches and fixes from installing after Windows XP is restored using its "repair" feature, researchers said Thursday. Scott Dunn, who first reported the problem in a story posted Thursday morning to the "Windows Secrets" newsletter, said that users who reinstall Windows XP with the repair option cannot retrieve the full set of updates from Windows Update (WU). The problem, he said, has been traced to the so-called "stealth update" to WU which Microsoft has acknowledged sending to users beginning in July. Two weeks ago,Â Dunn broke the story of the background updates,Â which were sent to most non-corporate Windows XP and Vista users. The updates were delivered and installed without prior notification, even when the PC's owner had told the operating system not to download or install updates without notification and permission. The revelation launched a firestorm of protest from users, which in turnÂ prompted Microsoft to defend the practiceÂ as well as say it would think about ways to clarify its update policies. "Two weeks ago we said that the silent update was harmless," said Dunn Thursday. "But now we're saying it is a problem." That problem affects any user who restores Windows XP using the setup CD's "repair" option, sometimes also called an "in-place reinstallation" because it reinstalls the operating system files without disturbing the applications and data already on the disk drive. Because repair is essentially a roll-back to XP's original state, the OS must be updated with all subsequent patches and hotfixes using WU. A system bought soon after Windows XP SP2 was released, for example, would need to download and install about three years' worth of updates. After a repair, XP defaults to the "Automatic" setting for Automatic Updates, which means WU is immediately updated to version 7.0.600.381, the version pushed to PCs by the summer's undercover upgrade, said Dunn. Seven of the DLL (dynamic link library) files that make up 7.0.600.381, however, fail to register themselves with Windows. That, in turn, keeps XP from successfully installing approximately 80 of the most recent patches and fixes. In a normal, non-repair situation, there's no indication of a glitch, since DLLs by the same name have previously been keyed into Windows' registry. "On a repaired copy of XP, however, no such registration has occurred, and failing to register the new DLLs costs Windows Update the ability to install any patches," he said Dunn pointed out workarounds, which included installing an older version of WU over the top of 7.0.600.381. "Windows Secrets" has also posted instructions for creating a batch file that registers the seven DLLs. While the registration failure and the unsuccessful patch installations aren't directly related to the fact that Microsoft didn't disclose the silent WU updates, Dunn sees it as part of a bigger, and disturbing, picture. "It's part of the whole problem with the silent update, and all part of the pattern of Microsoft's sloppiness," he said. "They're keeping us out of the loop. They're not working well with the IT community." If anyone needed proof that stealth updates are a bad idea, Microsoft's defense of the practice notwithstanding, this is it, said Dunn. "IT needs to test updates for this very reason. It's why companies like to download and test updates before they install to the rest of the network," he said. It's not clear how long WU has prevented post-repair updates, but searches through Microsoft's support newsgroups revealed questions about similar behavior as long ago as June. Responses by other users, including some with Most Valued Professional (MVP) designation -- a honorific Microsoft gives to users who make major contributions to the Windows community -- offered advice much like Dunn's. Several of them pointed users to the support document KB916259. The earliest such postings, however, preceded the silent WU update to version 7.0.600.381. When questioned about the discrepancy, Dunn acknowledged the similarities, but in an e-mail said that the two issues were different. He cited several inconsistencies, including an error message called out in the support document that doesn't appear in his test machines. In fact, Microsoft has updated WU twice since late May: the July-August silent update and a visible update rolled out in June. That update was designed to fix aÂ long-standing problem with Automatic UpdatesÂ in which the PCs' CPUs maxed out at 100 percent. Microsoft was not available for comment early Thursday morning. ComputerworldÂ is an InfoWorld affiliate.
705445
A bug that affects the OLE32.DLL library in Windows XP and 2000 could crash the operating system and cause users to lose unsaved data. Microsoft said it is looking into the matter.
411146
Six high priority updates, in all Microsoft is to issue four critical security fixes for this month's Patch Tuesday. Three of these affect either Windows Vista or Internet Explorer 7, which the software maker holds out as a paragon of its conversion to secure computing. In all, Microsoft will push six high-priority updates this Tuesday, the company announced today.â¦