Slashdot Log In
Microsoft Releases Critical IE Patch
Posted by
CmdrTaco
on Wed Apr 12, 2006 10:38 AM
from the but-i-thought-all-patches-were-critical dept.
from the but-i-thought-all-patches-were-critical dept.
Laura Brown writes "Microsoft has released its security software patches for April. The most anticipated is the MS06-013 patch, which fixes several IE bugs, including the "create TextRange ()" vulnerability. Hackers had been exploiting this problem by installing unauthorized software on PCs.
"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
The Exploit (Score:5, Informative)
And here's Microsoft's acknowledgement [microsoft.com] of the exploit (dated 03.23.2006).
And here's an "expert" saying that releasing the above exploit is irresponsible [sys-con.com] (dated 03.24.2006).
It is now 04.12.2006 and a patch is out to correct it.
*checks his watch*
Not bad, but your response time could use some imporvement.
Re:The Exploit (Score:3, Informative)
Schedule Over Security? (Score:5, Interesting)
The following excerpt is alarming [washingtonpost.com]: I wasn't aware a cycle constituted 135 days. That's interesting.
I'm surprised to discover that a business to which I have paid loads of money values a schedule over my security. I shall take note of that.
Parent
Re:Schedule Over Security? (Score:5, Interesting)
No, MS doesn't always release patches as quickly as they could, but in this particular case it certainly looks as though they got it out at the earliest opportunity, where this is defined as "as quickly as the largest proportion of their customer base allows them to".
I'm surprised to discover that a business to which I have paid loads of money values a schedule over my security.
Blame MS for bowing to pressure from their customers; blame the corporations for bringing that pressure to bear in the first place.
Parent
Re:Schedule Over Security? (Score:5, Interesting)
Parent
Re:Schedule Over Security? (Score:2, Informative)
Regardless they will and do relevant testing, takes days to weeks depending on scope of change its effects... sometimes the effects ripple out to third-parties which can further delay deployment.
I generally don't like Windows the product or many of MS current and prio
Re:Schedule Over Security? (Score:4, Insightful)
There is still no legitemate reason for them not to make a patch available as soon as they finish it. They can include the patch into their scheduled cycle, but they can also then cater to the early adopters, and those who don't want vulnerable systems laying around.
Parent
Re:Schedule Over Security? (Score:5, Insightful)
many exploits are made by examining the patch, so in most cases, it's better if everyone gets the patch at the same time (crackers and legitimate users) rather than the crackers getting it ahead of business users.
Parent
Re:Schedule Over Security? (Score:2, Insightful)
Re:Schedule Over Security? (Score:2, Interesting)
Re:Schedule Over Security? (Score:4, Interesting)
If there is already an exploit in the wild (with freely available source code) I really don't see how releasing a patch earlier for home users makes it *easier* to exploit.
It's just a poor excuse for being slow to patch.
Parent
Re:Schedule Over Security? (Score:4, Informative)
There, fixed that for you.
Parent
Re:Schedule Over Security? (Score:4, Insightful)
There are probably a few issues to consider here. Whether a corporate wants a scheduled regular service you can sure as hell bet they want the option to receive critical patches as soon as humanly possible. They'll wait for the other things, but critical patches should be available out of band. Secondly, there would be nothing to stop MS releasing the hotfix in the meantime via Windows Update since most corporates don't use it anyway.
I think its extremely poor that MS takes so long to fix such an obvious problem. It's more reason if any were needed that a closed source product is no guarantee that it will be any more secure or better supported than an open source one.
Parent
Re:Schedule Over Security? (Score:4, Insightful)
Those customers have specifically demanded that patches be released on a regular schedule, to ease their own testing and rollout procedures.
Why, are those customers forced to install it as soon as Microsoft releases it? If they wanted to install it later, they are unable to do so? What's stopping them from waiting? That would not only give them the choice, but give them longer to test the patches first. Yeah I can just picture those alleged customers now: "Hey Microsoft, please give us less choice and greater delays, in fact we demand you do so"
Stop the FUD, thanks.
Parent
Re:The Exploit (Score:5, Insightful)
Not bad, but your response time could use some imporvement.
From TFA: Microsoft Corp. has released its security software patches for April...
Microsoft has adopted the policy of "no patch before its time." These patches must be left on the vine, to ripen in the sun, until they are full of succulent flavor that brings out the best in an OS... sorry... anyway, it didn't matter how important the exploit was or that it was compromising machines left and right and letting the botnetters have a field day, Microsoft was in no rush. And you have to admit, that 3 weeks is not bad compared to some exploits which seem to be out there for months before anything is done. Now if Oracle could get their patch time down to three weeks...
Parent
Re:The Exploit (Score:4, Interesting)
This makes things easier on the marketing people who don't have to deal with complaints about security patches coming out far too often, but it also means that customers can be exposed to serious (effectively 'zero-day')exploits for up to a month at a time before MS's monthly release kicks in.
In time, we're going to see hackers 'releasing' their exploits on the Wednesday after patch-day to maximize how many machines they can exploit before the next MS 'patch day'.` It's a stupid way of 'serving your customer'.
Parent
Re:The Exploit (Score:3, Insightful)
Re:The Exploit (Score:2, Insightful)
And yet Mozilla/Firefox keeps security bugs off of the public bugs list until they are fixed, so you don't know how long Mozilla devs know about security bugs before fixing them either.
Re:The Exploit (Score:3, Interesting)
ActiveX, Java and Flash controls may be impacted (Score:5, Informative)
This won't affect IE6 on Windows 2000, and it's worth noting that things like Flash will work just fine in Firefox, Mozilla or Opera on Windows too.
Re:ActiveX, Java and Flash controls may be impacte (Score:2, Funny)
>
>This won't affect IE6 on Windows 2000, and it's worth noting that things like Flash will work just fine in Firefox, Mozilla or Opera on Windows too.
So for the
Re:ActiveX, Java and Flash controls may be impacte (Score:5, Informative)
Amusingly, this behavior can be disabled with either a patch or a registry change. [microsoft.com]
Parent
Dammed if they do, dammed if they do not.. (Score:5, Insightful)
If they don't update their products people will comment on how much they suck.
If they do update them people will claim instability due to the number of patches.
It's a matter of perception. Some people see ongoing updates as true support. Others simply hate anything Microsoft.
You decide.
Re:Dammed if they do, dammed if they do not.. (Score:2)
So how is it that programmers working for free developing a product for free can patch fatser than a multimillion dollar company with hundreds of highly paid developers?
That's the ongoing question.
open source projects of equivalant size? (Score:2)
1st, what OSP is on par for raw bytes & complexity... to the windows OS?
2nd- which of that subset get's patches in 24 hours
3rd- how often do these "right out the door" patches cause loss of functionality, for a subset of users, as (my line one above) every system configuration possibility was considered in the patch, that is still just works?
it's kinda herculean if you th
Re:Dammed if they do, dammed if they do not.. (Score:3, Insightful)
Legally, neither is Microsoft. Read your EULA.
And in most cases nothing else interacts with or depends on his / their code?
Yeah, nothing interacts with or depends on sendmail, or glibc, or the Linux kernel...
The Bob Damn them. (Score:2, Interesting)
If they do update them people will claim instability due to the number of patches.
It's a matter of perception. Some people see ongoing updates as true support. Others simply hate anything Microsoft.
You decide.
I hate the fact I have to purchase anti-viral software even though I exercise great care in what I download, install, execute, etc.
I hate the fact that I have to download patches frequently, which are massive files a
Re:The Bob Damn them. (Score:4, Insightful)
I hate the fact that I have to download patches frequently, which are massive files and I'm still on a dial-up so they can take hours."
Actually, you don't. Because you don't "have to" run Windows. Seriously. I'm not trying to be a prick, but to emphasize that somewhere along the line, the user (you) is choosing to run Windows, so you are choosing to take on all these burdens in the process. You can rid yourself of them simply by choosing any of the other growingly-popular OSes out there. Yes it'd be work. Yes the transition might incurr costs. Yes you might have to switch apps, convert data, retrain. But you are choosing to do it or not do it, regardless. You can choose the one-time painful conversion, or choose to remain in the eternal servitude to the pains of your status quo.
Your choice.
Parent
How much longer is this going to be NEWS? (Score:3, Interesting)
Re:How much longer is this going to be NEWS? (Score:5, Insightful)
Because Slashdorks like ourselves keep reading them and posting comments. You can bet if people stopped reading & commenting, the editors would stop posting these stories.
Parent
Re:Dammed if they do, dammed if they do not.. (Score:2)
No, it's a matter of quality. If the product had been built properly in the first place this vicious cycle would never have been born. However, it was not built that way. You pay now or you pay later - but you do pay, and later always costs more.
Third - Party Patches (Score:2, Insightful)
I've been recommending them to anyone that was worried about the vulnerabilies - I wish Microsoft would support them, it's very difficult to convince people that the fact that Microsoft doesn't recommend them is because it's bad PR to be seen having to be helped out, and not that the code is full of viruses that destroy your PC.
Ah well, I only use Windows for gaming anyway.
gmail invite (Score:2)
Meanwhile... (Score:2, Funny)
Re:Meanwhile... (Score:4, Insightful)
Seriously though, if it is using 1.5gb of memory, you probably have it to spare, otherwise it wouldn't be using it. If this is still unacceptable, you can TURN IT OFF! [mozillazine.org]
Parent
Re:Meanwhile... (Score:2)
Why can't we all have portage (Score:3, Interesting)
A fix was released long ago (Score:5, Funny)
OK, OK, so I wanted to be different from those "get Firefox" jokes!
Name change proposal (Score:5, Funny)
Shcheduled updates seem counter-intuitive (Score:4, Insightful)
What I don't get is why everone else in the world has to have their system unprotected for an extra couple of weeks. Why can't MS release the patches when they are "stable" and let the IT departments schedule their own updates as frequently or infrequently as they see fit? And further, is scheduling really *that* much more important than security for large companies?
Re:Shcheduled updates seem counter-intuitive (Score:2)
I don't think there's logic to it; as you point out, the patches should come out when they're ready. If IT departments want a monthly schedule for patches, they should set one themselves. Why do they have to have Microsoft do it? Nobody's forcing them to install patches right away.
Re:Shcheduled updates seem counter-intuitive (Score:2)
Re:Shcheduled updates seem counter-intuitive (Score:2)
http://www.microsoft.com/windowsserversystem/updat eservices/default.mspx [microsoft.com]
This way everyone gets what they want. Home users can be protected immediately, for corporate users using WSUS, they get to maintain their status quo. This would even be better for some corporate users who would like to patch quicker.
The article's titles doesn't do it justice (Score:4, Informative)
Source (Score:2, Informative)
I don't get it (Score:2)
Re:I DLed them this AM. A question... (Score:5, Insightful)
Parent
Re:I DLed them this AM. A question... (Score:3, Informative)
Re:I DLed them this AM. A question... (Score:2)
Essentially almost any Windows app that displays HTML and isn't either Firefox, Mozilla, Opera or Thunderbird is most likely using mshtml.dll and so is likely to be vulnerable to the exploit.
Bottom line is that any Windows user should download and apply every IE update whether they use IE or not, as simply not using IE does not guarantee safety.
Re:Why? (Score:3, Insightful)
Unfortunately, it's because of corporate inertia. Take my company, for example. I'm the IT department (no, that's not a typo) for a small Canadian company that is owned by a large European company. I've removed the big 'e' from everyone's desktop, installed Firefox, and told everyone to use it.
Unfortunately, we have a couple of applications we can only use through a centrally-administered terminal server environment. That environment includes IE. And of cours