Microsoft issued three security patches yesterday, once again coming through on its fall 2003 promise to give its customers regularly scheduled security updates rather than randomly releasing patches as they're finished. The patches apply to Microsoft Exchange Server 2003 and Microsoft Internet Security and Acceleration (ISA) Server 2000, as well as Windows, but only the ISA Server 2000 patch is rated critical. In addition, the company has reissued a security patch for various Windows versions; Microsoft describes this patch as "important." "Microsoft is committed to helping customers keep their information safe, and releasing security bulletins on a regular schedule makes security response more predictable and easier to manage," a company spokesman reported yesterday. The new patches include: - ISA Server 2000 (critical)--fixes a vulnerability that could let malicious code run on a user's system - Exchange 2003 (moderate)--fixes a vulnerability that could let a Microsoft Outlook Web Access (OWA) user randomly access another user's mailbox - Windows (important)--fixes a vulnerability that could let code run arbitrarily on a user's Windows Server 2003, Windows XP, or Windows 2000 system - Windows (important, reissue)--corrects a flaw in the Arabic, Hebrew, and Thai versions of the original patch, which addressed a buffer-overrun problem, and applies to various Windows 2003, XP, Win2K, and Windows NT 4.0 systems in the language versions listed
Microsoft didn't issue a patch for a newly discovered Microsoft Internet Explorer (IE) vulnerability called "phish" that an intruder could exploit to fool users into providing credit card numbers and other personal information. However, Microsoft has reserved the right to issue critical security patches at any time, and certainly this type of vulnerability would fall into that category. Microsoft says it's still working on a fix. In the meantime, you can use Automatic Updates or Windows Update to get any relevant patches or download any recent security updates from the Microsoft Web site.
End of Article
"Microsoft issued three security patches Tuesday, once again coming through on its fall 2003 promise to provide its customers with regularly scheduled security updates, rather than randomly releasing them as they were completed, as it had done in the past."
So we are to wait at Microsoft's beck and call for our vulnerabilities to be fixed? This is not a good thing....
Aaron January 14, 2004
You must be a registered user or online subscriber to comment on this article. Please log on before posting a comment. Are you a new visitor?
Register now
An often irreverent look at some of the week's other news, including some more Windows 7 sales momentum, some Sophos stupidity, Microsoft's cloud computing self-loathing, more whining from the browser makers, Zoho's "Fake Office," and much, much more ...
Let Your Users Reset Their Own Passwords: Free Download Try a 30 day free trial of Desktop Authority Password Self-Service – it provides an easy-to-use, robust system for allowing users to reset their own forgotten passwords or locked accounts.
Get Windows IT Pro & Mark Minasi’s Favorite Power Tools Guide Order Windows IT Pro now and get "More of Mark Minasi's Favorite Power Tools"--a in-depth guide to the most useful Windows commands --FREE with your paid order! Subscribe today, and save 58% off the cover price!
Deep Dive into VMware vSphere, eLearning Series Join John Savill to explore the major functionality capabilities of the vSphere virtualization platform, including identification of the changes from ESX 3.5.
Register
So we are to wait at Microsoft's beck and call for our vulnerabilities to be fixed? This is not a good thing....
Aaron January 14, 2004