Perspective: Microsoft security--no more second chances?

fyire · Aug 11, 2006

As if Homeland Security Secretary Michael Chertoff didn't have enough on his plate.

Not only has he had to deal with Katrina and Osama. Now he's also got to whip Steve Ballmer and the crew at Microsoft into shape. If past is prologue, that last task may be the most daunting of all.

In a remarkable declaration earlier this week, the Department of Homeland Security--a bureaucracy set up to deal with stuff that generally falls under the category of national emergency--called on all users of Windows software to install a new security patch issued by Microsoft.

This wasn't your garden variety flaw. The fear in Washington was a repeat of something like the chaos caused by the MSBlast worm in 2003.

By now, Chertoff's people must be thoroughly frustrated that Microsoft still turns out poorly designed products. What with terror plots being uncovered overseas and threats of airline bombings, cybersecurity obviously is not the top headline this week.

But the threat of a network meltdown has not disappeared--especially when flaws so regularly turn up in Windows, the computer operating system most people in this country use.

The Microsoft monoculture is a fact of life in government and corporate circles. And that comes at a price in the coin of vulnerable computer security.

Microsoft contends that the situation is improving and that it's doing the maximum to make sure that Windows and the other software products it sells go out the door with as few problems as possible.

Each month, the company issues a security update in which it patches problems. And every Microsoft spokesman within earshot can be counted on to solemnly pledge the company's maximum effort.

It's a familiar refrain.

Ever since Bill Gates announced Microsoft's Trustworthy Computing initiative four and a half years ago, the company says it has reshuffled its development priorities. Cool new features were to take a backseat to improved security and privacy.

Yet the problem lingers. In the last three years, Microsoft has issued an increasing number of yearly security bulletins, in which several patches get put online to fix problems in existing applications. The company sees this as evidence that it's on top of things, not an indictment of managerial incompetence.

If you want to find someone to blame, Gates says, point a finger at the "malicious people" out there looking to "take advantage of whatever things there are."

What did you expect him to say? That it's Microsoft's fault? That would be too hot to handle. Gates and the rest of the brass stick closely to the script but clearly know that Microsoft can't keep turning out finished products that are as porous as Swiss cheese.

Defenders will argue that it's unfair to demand perfection from Microsoft; that software is an imperfect art. And besides, they add, is the Mac operating system or Linux bulletproof? Clearly, the answer is no. But the number of security holes turning up in either operating system is a fraction of what turns up in the Windows world.

The oddest part is how we've become so accustomed to the status quo when "Patch Tuesday" rolls around. Another few holes get closed with a magic Microsoft download, and we're safe (unless the bad guys first found a way to burrow into our systems).

Here's something to consider: If bridge builders or airplane designers applied the same standards to their labors, do you believe that the public would so easily forgive the regularity with which bridges would collapse and airliners fall out of the sky?
Click to expand...

From: http://news.com.com/2010-1002_3-6104512.html?part=rss&tag=6104512&subj=news

Adrian Wong · Aug 12, 2006

ROTFL!! More patches? What's new? Hehehe...

fyire · Aug 16, 2006

And More Patches yet again

Microsoft patch can cause IE trouble

Microsoft's security update from Aug. 8 to Internet Explorer is causing browser trouble for some systems.

After people apply the MS06-042 update, rated "critical" by Microsoft, IE may crash when certain Web sites are viewed, the company said in a notice on its customer support Web site. The problem affects IE 6 with Service Pack 1 on Windows XP and Windows 2000 systems, it said.

"Microsoft has identified an issue with the security update MS06-042," the company said in a statement Tuesday. It plans to re-release the bulletin and patch on Aug. 22 for all affected users.

The problem occurs when IE users view Web sites that use version 1.1 of HTTP alongside compression, according to Microsoft's notice. HTTP, or hypertext transfer protocol, is the standard protocol used to browse Web sites.

IE users on security mailing lists have reported browser crashes when using PeopleSoft applications that have Web-based interfaces. Others report running into problems when using other applications, including Microsoft's own customer relationship management, or CRM, tools.

"We are running PeopleSoft for administration systems, and our Windows 2000 SP4 and Windows XP SP1 running Internet Explorer 6.0 SP1 crash when they got into the PeopleSoft pages," Fred Dunn, a systems administrator at the University of Texas Health Science Center at San Antonio, said in an e-mail interview.

Dunn called Microsoft's product support service, which recommended disabling the use of HTTP 1.1 in IE's advanced settings menu. However, that's not a change that's easily done on all PCs in the university, Dunn said. "Our only workaround was to get the PeopleSoft programmers to turn off compression...which slows down the response," he said.

MS06-042 is an update for IE that addresses eight vulnerabilities in the popular browser. It is one of a dozen security updates that Microsoft released last week on Patch Tuesday.

Patches have caused trouble at times, on occasion prompting Microsoft to fix already released updates. In April, it released a second version of a Windows Explorer update because the original interfered with Hewlett-Packard software and Nvidia drivers. In June, it had to fix a patch that caused network connection trouble for some people.

Microsoft has a temporary fix available for the problems caused by MS06-042. However, this fix is not available for download; people have to call Microsoft's support line.
Click to expand...

From: http://news.com.com/2100-1002_3-6106039.html?part=rss&tag=6106039&subj=news

Chai · Aug 16, 2006

Crap, just installed 040 patch not long ago, not 042???

Adrian Wong · Aug 18, 2006

ROTFL!!! You can bet 043's on the way.

Chai · Aug 18, 2006

Bet? 046 is already out.

Adrian Wong · Aug 18, 2006

Chai said:

Bet? 046 is already out.
Click to expand...

LOL! 050 then!

fyire · Aug 23, 2006

A Patch for a Patch for a Patch

From: http://news.com.com/2100-1002_3-6108490.html?part=rss&tag=6108490&subj=news

IE patch carries security bug

There's more trouble with Microsoft's latest Internet Explorer patch: It introduces a serious new security flaw on some Windows systems.

The vulnerability could let miscreants hijack a Windows PC running IE 6 with Service Pack 1 and the MS06-042 update installed, Microsoft said in a security advisory published on Tuesday. The flaw lies in the way IE handles long Web addresses and could be exploited by luring users to specially crafted Web sites, according to the advisory.

"An attacker who successfully exploited this vulnerability could remotely take complete control of an affected system," Microsoft said in its advisory. "We are not aware of attacks that try to use the reported vulnerability."

Microsoft released the MS06-042 security update on Aug. 8 as part of its monthly patch cycle. The update, deemed "critical" by Microsoft, addresses eight flaws in the ubiquitous browser. It is one of a dozen security updates that Microsoft released this month on Patch Tuesday.

The company planned to release a new version of the MS06-042 update on Tuesday to fix a problem with browser crashes reported by some users after installing the original fix. That crash, it turns out, is the result of a "buffer overrun" flaw introduced by the security update, Microsoft said. The flaw could be exploited by cyberattackers.

Further compounding the troubles with the IE patch, Microsoft postponed the release of the updated fix at the eleventh hour because of an undisclosed problem discovered during testing, Stephen Toulouse, a Microsoft Security Response program manager, wrote on a corporate blog Tuesday.

"Providing the update in its current state would have resulted in customers being unable to deploy the update," Toulouse wrote, adding that the issue was discovered late Monday night.

As a result, users of IE 6.0 with SP1 are vulnerable to cyberattack regardless of their patching status. Microsoft advises users to install the patch and to disable the use of Hypertext Transfer Protocol (HTTP) version 1.1 in the browser.

The security issue does not impact other versions of IE, such as the version in Windows XP with SP2 or on Windows Server 2003, Microsoft said.

This is not the only patch Microsoft issued this month that is causing trouble. On Thursday, the company released a "hotfix" for a fault in security patch MS06-040. The fix addresses the problem of programs failing if they request one gigabyte or more of information on a patched system.

An update to the MS06-042 update is still in the works, but Microsoft could not say when it would be ready.
Click to expand...

Chai · Aug 23, 2006

I don't care now. My company is now running using Windows Update server. No more hassle!

Adrian Wong · Aug 24, 2006

Hehe... The fix to fix the fix.

Log in or Sign up

Perspective: Microsoft security--no more second chances?

fyire Newbie

Adrian Wong Da Boss Staff Member

fyire Newbie

Chai Administrator Staff Member

Adrian Wong Da Boss Staff Member

Chai Administrator Staff Member

Adrian Wong Da Boss Staff Member

fyire Newbie

Chai Administrator Staff Member

Adrian Wong Da Boss Staff Member

Share This Page

Log in or Sign up

Perspective: Microsoft security--no more second chances?

fyire Newbie

Adrian Wong Da Boss Staff Member

fyire Newbie

Chai Administrator Staff Member

Adrian Wong Da Boss Staff Member

Chai Administrator Staff Member

Adrian Wong Da Boss Staff Member

fyire Newbie

Chai Administrator Staff Member

Adrian Wong Da Boss Staff Member

Share This Page

Useful Searches