MS Monthly Patch Omits Word Zero-Days 80
bungee jumper writes "Microsoft released four bulletins with patches for 10 vulnerabilities but there are no fixes for known MS Word zero-day flaws that are under active attack, eWeek.com reports. The January batch covers critical bugs in Excel, Outlook, and Windows. The first confirmed Windows Vista flaw, a denial-of-service issue that was publicly released on an underground hacker site in Russia, also remains unpatched." eWeek notes that Microsoft originally scheduled eight bulletins for release, but pulled four last Friday without explanation.
Ummmm... (Score:5, Insightful)
Damn them for not releasing patches that make a more unstable system! Damn them I say!
Re: (Score:3, Funny)
Not much of an excuse, considering that most Microsoft software causes more harm than good, yet they release it.
*ducks*
Re: (Score:3, Insightful)
Sit back, relax, and wait for the Insightful rather than the Redundant moderation points to start rolling in on your comment.
Re:Ummmm... (Score:5, Funny)
Sorry for the qui pro quack, I actually meant that Microsoft software is likely to have been conceived and released by ducks.
Re: (Score:2)
Conceived by ducks ? (Score:2)
Re: (Score:2)
Re: (Score:3, Funny)
I actually meant that Microsoft software is likely to have been conceived and released by ducks.
Not ducks - Canadian Geese. Have you seen the way they shit?
Re: (Score:2)
You haven't experienced MS vs. others' stacks (be it Mac, Linux, or even mature Amiga OS) long enough to realize it.
I agree with your criticism, though: due to the absence of "Obvious", stating that MS software ain't that good is probably "Redundant".
is called mod trolling .. (Score:2)
It's called mod trolling where a good comment gets modded down while an obvious attempt at astroturfing gets modded up. You see the same thing happening over on DIGG.
was: Score 5, Insightful? (Score:-1, Offtopic)
I like that solution. (Score:5, Funny)
Well, that's because there aren't any zero-day flaws. Microsoft changed the name to ">1 day flaws", thereby solving the problem forever.
stupid drinking all afternoon (Score:1)
Re:I like that solution. (Score:4, Insightful)
How dare we accuse MS of being anything but anti-monopolizing and doing good? That's their way of keeping the competition in business!
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Oh no, they found our backdoor... (Score:1, Funny)
As long as... (Score:2, Funny)
It's OK, as long as they have the patch of the patch of the bug formerly known as Prince.
Local elevation of privilege (Score:5, Informative)
Re: (Score:2, Funny)
Absolutely. Considering that all the anti-user media playback programs are running under SYSTEM-like permissions, any sort of elevations breaks DRM.
Not patching broken DRM means the media ogres get really mad.
Re: (Score:3, Informative)
The submitter read the article, and then directly lifted that line right out of it. Is the submitter an idiot for confusing local privilege escalation with DoS? No, because he wasn't the one who made that claim. Is the article author an idiot for making that statement? Definitely. Is the submitter an idiot for directly quoting the article without attributing
Re: (Score:2, Insightful)
Re: (Score:2)
On the contrary, keeping in mind that Vista includes DRM I think it's very good that Vista security is at the usual Microsoft level. It may chain the user, but the chains are made from recycled tin cans, the links are hollow to save material, and the lock pops open when anyone looks at it funny :).
I guess the one thing that can
Damn... (Score:4, Funny)
Damn you Microsoft!
Re: (Score:2)
Re: (Score:1)
Darn? (Score:3, Insightful)
Also consider e-mailing the
Disclaimer:
I am getting two MS Updates today--one for IE7, and the usual malware "stinger." I don't actually use IE--I updated it for security...
This has actually been a better month for MS update-downloads than
Re: (Score:2)
Skewed statistics (Score:5, Insightful)
Re: (Score:1)
Re: (Score:2, Informative)
Microsoft is so large... (Score:2, Interesting)
Re: (Score:1)
Default application (Score:5, Informative)
What the hell does "Zero-day" mean, anyway? (Score:2, Insightful)
Re: (Score:1)
My translation may be a garbled mess as well.
Re: (Score:1)
Re:What the hell does "Zero-day" mean, anyway? (Score:5, Informative)
"Zero-day" is an exploit classification.
It goes like this. Software has bugs. These bugs can cause security vulnerabilities, which are then published and patches issued to fix the vulnerabilities. Hopefully, all this happens before the black hats can take advantage of -- or exploit -- these vulnerabilities.
An exploit of a vulnerability is the virus, worm, SQL injection, hack attempt, etc. itself. An exploit can be labelled "zero-day" when an in-the-wild exploit has been detected on the same day that the vulnerability was made known to the security industry. Most often, "zero-day" means "we learned there was a vulnerability when we found this exploit". This is rather like finding out the locks on your doors don't work when a thief has already been and gone. Zero-day exploits then will have a maximal timeframe to affect vulnerable systems since no work has been done on fixing the vulnerability (presumably).
The Slammer worm, for example, was an [i]exploit[/i] of MS SQL Server 2000. SQL Server 2000 had a buffer overflow vulerability which was the subject of Slammer. Slammer was not zero-day, however, since this security vulnerability had been known about for many months and MS had already issued patches for it (six months prior to Slammer).
The vast majority of exploits are *not* zero-day, but uninformed reporters for computer news services (like CNet, or anything Ziff Davis owns) are now using "zero-day" as a synonym for "new vulnerability" instead of the proper "new exploit to unknown vulnerability".
Re: (Score:2)
Now that makes sense. Thanks!
Am I the only one (Score:2)
"Ms. Monthly Patch" and thought "She's on the rag again?"
As a literal word? (Score:5, Funny)
They aren't zero day, they're "highly relevant to your enterprise investment"!
Outlook Express flaw? (Score:1, Interesting)
Anyone know what this is about?
Re: (Score:2, Informative)
Re: (Score:1)
Details (Score:3, Informative)
Here's the original:
- Three Microsoft Security Bulletins affecting Microsoft Windows. The
highest Maximum Severity rating for these is Critical. These updates will be
detectable using the Microsoft Baseline Security Analyzer and the Enterprise
Scan Tool. Some of these updates will require a restart.
- One Microsoft Security Bulletins affecting Microsoft Windows and Microsoft
Visual Studio. The highest Maximum Severity rating for this is Important.
These updates will be detectable using the Microsoft Baseline Security
Analyzer and the Enterprise Scan Tool. These updates will require a restart.
- One Microsoft Security Bulletins affecting Microsoft Windows and Microsoft
Office. The highest Maximum Severity rating for this is Important. These
updates will be detectable using the Microsoft Baseline Security Analyzer.
These updates may require a restart.
- Three Microsoft Security Bulletins affecting Microsoft Office. The highest
Maximum Severity rating for these is Critical. These updates will be
detectable using the Microsoft Baseline Security Analyzer. These updates may
require a restart.
In the end there was only one Windows patch - a critical flaw in VML - along with critical patches Outlook and Excel. The only 'important' patch was for Office 2003 but seemed to only affect the Brazilian Portugese version.I was surprised to find, following the TFA, that eWeek [eweek.com] got hold of this last Friday.
What is a zero day flaw (Score:1)
Re: (Score:1)
What happens is that virus writers tend to release things on the zero day because it gives them an advantage against companies like Microsoft. Microsoft doesn't like to acknowledge that zero day exists because it's not widely accepted enough to place on calendars.
Thus, virus writers get an entire day to test their products since Microsoft has to wait untill the 1st day to issue a patch.
Ghasp! (Score:1)
And while I'm at it, my unicorn swallowed my key to the TARDIS, can I borrow yours?
Publicly Underground (Score:2, Funny)
I know why there's only three (Score:2)