In a not quite unprecedented move, Microsoft on Wednesday will release a critical security patch outside of its normal monthly schedule. This isn't the first time Microsoft has done this--the last time was in April 2007--but it is an unusual step for the software giant, which has highlighted its carefully-timed security releases as one of many benefits of the Windows platform.
While details of the patch are unavailable, it appears to concern a currently-unknown vulernability that affects several versions of Windows, including Windows 2000, XP, and Server 2003. Microsoft's latest Windows versions, Windows Vista and Server 2008, are also affected, but the vulnerability is rated as less severe on those systems.
Microsoft will ship at 10:00 am PT (1:00 ET) on Wednesday, Microsoft says. Users are advised to manually run Windows Update if they are not automatically prompted to download and install the patch.
You can find out more about this vulnerability on the Microsoft Web site.
http://www.microsoft.com/technet/security/Bulletin/MS08-oct.mspx
Wednesday? Today is Thursday. Patch coming out today? Or did it come out yesterday? Or was the notice coming out yesterday about the patch coming out today? I'm confuzed!
Windows: Unsafe at any speed?
By ROBERT X. CRINGELY,
"Ever have one of those old jalopies you just can't seem to get rid of? It chugs along, but the wheels keep coming off, the transmission's making a disturbing ka-thunka-thunka noise, and there's a viscous oily substance oozing from the crankcase? Yet its creators keep telling you that it just needs a little wax job and everything will be fine. No, I'm not talking about the McCain campaign; I'm talking about Windows and its latest emergency patch, issued Thursday more than two weeks ahead of the usual Patch Tuesday release.
...
"..the list of services that could be affected by this latest hole, is astounding. Most importantly, anything that relies on Server Message Block (SMB) including the Common Internet File System (CIFS), any kind of file or print sharing, remote group policy enforcement, the print spooler, the indexing service, and network logon -- all of these are among the items impacted by a potential hijacking of the Server service. Essentially, anything that need[s] sharing or to be shared goes through the SMB protocol, which is managed by the Server service.
...
"Is it finally time to trade in that old jalopy for something you can rely on? And if so, what would it be?"
http://www.nytimes.com/external/idg/2008/10/24/24idg-Windows-Unsafe.html
Register
