Windows IT Pro is the leading independent community for IT professionals deploying Microsoft Windows server and client applications and technologies.
  
  
  Advanced Search 


December 11, 2003

Patch Delivery Snafu Snares No-Patch December

RSS
Subscribe to Windows IT Pro | See More Security Articles Here | Reprints | Or get the Monthly Online Pass—only $5.95 a month!

   The mysterious delivery of a critical security patch this week, the same week in which Microsoft announced it wouldn't deliver any critical-security-patch bundles, had the company scrambling yesterday to find out what happened: A glitch in the company's Windows Update patch-delivery mechanism was responsible for the delivery of the erroneous patch, which fixes a problem with the Microsoft FrontPage Server Extensions, a software add-on for Microsoft's Web server software. The company issued a Microsoft Knowledge Base article describing the patch more than a month ago, although it didn't publish the patch to Windows XP users until this week. Microsoft says it should have published the patch and Knowledge Base article simultaneously and for all affected systems.
   The FrontPage Server Extensions fix is critical only for XP and Windows 2000 systems that have Windows SharePoint Services (WSS) 2003 installed, and Microsoft apparently distributed the patch to Win2K users on November 11. The patch is rated "moderate" for most XP systems (i.e., XP systems without FrontPage Server Extensions installed, which is most of them).
   In related news, a new Microsoft Internet Explorer (IE) 6.0 vulnerability that researchers recently discovered could potentially put users' data at risk. According to a security bulletin released earlier this week by the Danish security company Secunia, this newly discovered IE 6.0 vulnerability could let intruders spoof Web sites by loading a different page when users enter a genuine URL in IE's address bar. If the vulnerability is compromised correctly, attackers could emulate an e-commerce site such as Amazon.com or eBay and cause users to inadvertently enter sensitive information. Microsoft says it's "aggressively investigating the public reports" about this vulnerability and, if warranted, might issue a patch outside of its regular monthly patch packages. The next set of patch packages is due in the second week of January.

End of Article



Reader Comments
50 billion in the bank. Keep reminding yourself of that...50 FREAKIN' BILLION in the bank, and they can't even figure out how to deliver a critical security patch.

And now, boys and girls, just in time for the holiday shopping season: compromised security on e-commerce sites! Whopeeee!

Someone please explain to me why anyone continues to use this company's products. Seriously.

Wendy Rebecca December 11, 2003


Paul

Perhaps you should read the security bulletin before posting a garbled account of what happened yesterday. Briefly, an error in Windows Update caused it to offer a November patch to XP users who, in fact, did not need it. There was no new patch, and XP users without FPSE installed are at no risk, not moderate risk. It would have been easy to check the facts. As for the IE rumor, it has been circulating for weeks. Bottom line: just another minor IE bug, if that.

Larry December 11, 2003


The left hand doesn't know what the right hand is doing....

And to think, people still actively seek to install this OS, all from a so-called "trusted computing" company.... oh dear....

kingm@excite.com December 11, 2003


microsoft's plan to only issue updates once a month so that net admins wouldn't be so swamped is complete, total, utter BS. i'm sure the change was motivated purely by a money-making scheme...as most things are.

adam_c December 11, 2003


Strange problem, but it hasn't affected me. I think the monthly update system is great. At least I can plan for a schedule time for updating systems. There are also conference calls to explain the issues. The old weekly updates were a headache.

J McNamera December 12, 2003


You must be a registered user or online subscriber to comment on this article. Please log on before posting a comment. Are you a new visitor? Register now




Top Viewed ArticlesView all articles
Command Prompt Tricks

One reader shares his tip for setting up the command prompt to reflect a remote path. ...

WinInfo Short Takes: Week of November 9, 2009

An often irreverent look at some of the week's other news, including some more Windows 7 sales momentum, some Sophos stupidity, Microsoft's cloud computing self-loathing, more whining from the browser makers, Zoho's "Fake Office," and much, much more ...

Understanding File-Size Limits on NTFS and FAT

A general confusion about files sizes on FAT seems to stem from FAT32's file-size limit of 4GB and partition-size limit of 2TB. ...


Security Whitepapers Reducing the Costs and Risks of Branch Office Data Protection

Solving Desktop Management Challenges in Healthcare

Solving Desktop Management Challenges in Education

Related Events Introduction to Identity Lifecycle Manager "2"

SQL Server Security: How to Secure, Monitor & Audit Your Databases

Protecting Mobile Users' Data

Check out our list of Free Email Newsletters!

Security eBooks Spam Fighting and Email Security for the 21st Century

Understanding and Leveraging Code Signing Technologies

A Guide to Windows Certification and Public Keys

Related Security Resources Introducing Left-Brain.com, the online IT bookstore
Looking for books, CDs, toolkits, eBooks? Prime your mind at Left-Brain.com

Discover Windows IT Pro eLearning Series!
Clear & detailed technical information and helpful how-to's, all in our trademark no-nonsense format


Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro DevProConnections IT Job Hound
Left-Brain.com Technology Resource Directory asp.netPRO ITTV Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 © 2009 Penton Media, Inc. Terms of Use | Privacy Statement