[Merged] Microsoft Security Updates

[Tricky]

Early warning that July is going to be a busy month!

On 13 July 2004 the Microsoft Security Response Center is planning to release:
- 7 Microsoft Security Bulletin affecting Microsoft Windows. The greatest maximum severity rating for these security updates is Critical. Some of these security updates will require a restart. At this time no additional information on these bulletins such as details regarding severity or details regarding the vulnerability will be made available until 13 July 2004.

[MetaWraith]

Got news for you,
They are already released. At least this morning I got them in automatic update. Taking a long time to download too.

It's been a long time but there is a critical update for Windows Me.


Incog.

[greencreeper]

Windows ME Just did my mum's laptop and there were a few driver updates. I always worry that the damn thing won't come back up

<goes off to run Windows Update>

[Tricky]

Updates:

One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity of Moderate, MS04-018
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity of Important, MS04-019
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity of Important, MS04-020
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity of Important, MS04-021
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity of Critical, MS04-022
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity of Critical, MS04-023
- One Microsoft Security Bulletin affecting Microsoft Windows with a maximum severity of Important, MS04-024

Summaries for these new bulletins may be found at the following page:
- http://www.microsoft.com/technet/sec.../ms04-jul.mspx

You may also be interested in:

Microsoft has learned of a Trojan program that is downloaded by the Download.Ject malware, also known as Scob, to client machines from infected IIS servers. When a user visits a Web site hosted on an IIS server that is infected with Download.Ject, the Web pages downloaded to the userâ₠¬Ã¢â€žÂ¢s system contain an additional JavaScript program that downloads another Trojan program to the userâ₠¬Ã¢â€žÂ¢s system. This second Trojan is called Backdoor:W32/Berbew, also known as Backdoor-AXJ, Webber, or Padodor. When this second Trojan runs on the userâ₠¬Ã¢â€žÂ¢s machine, it performs several actions, including:

- Monitoring Internet access. When the user visits one of several financial or ISP Web sites, the Trojan captures sensitive informationâââ€Å ¡Ã‚¬Ã¢â‚¬ÂÂÂ�such as log-in names, passwords, and so onââ‚ ¬ÃƒÂ¢Ã¢â€šÂ¬Ã‚ÂÂ�and sends it to a Web server for the Trojanââ‚Ã⠀šÃ‚¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s author to retrieve.
- Installing a proxy server that allows the userâ₠¬Ã¢â€žÂ¢s system to be used as a relay for such actions as sending spam.
- Opening fake dialog boxes that prompt the user to enter confidential information such as ATM card codes, credit card numbers, and so on. This information is then sent to a Web server for the Trojanââ‚Ã⠀šÃ‚¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s author to retrieve.

Microsoft has released a tool to help you remove Backdoor:W32/Berbew Trojan variants from your computer. You can download this tool from the Microsoft Download Center and run it on your computer to remove Backdoor:W32/Berbew.A, Backdoor:W32/Berbew.B, Backdoor:W32/Berbew.C, and Backdoor:W32/Berbew.D, Backdoor:W32/Berbew.E, Backdoor:W32/Berbew.F, Backdoor:W32/Berbew.G and Backdoor:W32/Berbew.H infections.
This tool is discussed in Microsoft Knowledge Base article 873018. This KB can be found here:
http://support.microsoft.com/default.aspx?kbid=873018

[Tricky]

Oops they did it again!

On MONDAY 26 JULY 2004 the Microsoft Security Response Center is planning to release:

- One Microsoft Security Bulletin affecting Microsoft Windows. The greatest maximum severity rating for this security update is Critical. This security update will require a restart. Although we do not anticipate any changes, the number of bulletins, products affected, restart information and severities are subject to change until released. At this time no additional information on these bulletins such as details regarding severity or details regarding the vulnerability will be made available until 26 July 2004.

[poolking]

They've even had to bug fix a bug fix because they messed up.

My Windows 98SE machine has also received critical updates.

I thought Microsoft had stopped supporting W98.

I can't beleive Windows has so many bugs in it, I know I had to download 130mb's worth of updates when I got linux but they were mostly adding things into the software, not many fixing bugs etc

Microsoft need to get there software sorted is all I have to say.

[Stuart]

Originally Posted by Electrolyte

I can't beleive Windows has so many bugs in it, I know I had to download 130mb's worth of updates when I got linux but they were mostly adding things into the software, not many fixing bugs etc

Microsoft need to get there software sorted is all I have to say.

I don't think Windows has any more or fewer bugs than any software. We were taught at Uni that IBM (who have done a lot of work on bug-tracking systems) found that, on average, there was 1 bug for every 1000 lines of code. They tested software written for all operating systems (including Linux).

Another way of looking at it is that somewhere around 95% of the worlds PC's use Windows. This means there are more hackers looking for faults. Of course more bugs will show up.

At least Microsoft are regularly releasing patches.

Originally Posted by scastle

I don't think Windows has any more or fewer bugs than any software. We were taught at Uni that IBM (who have done a lot of work on bug-tracking systems) found that, on average, there was 1 bug for every 1000 lines of code. They tested software written for all operating systems (including Linux).

Yes, but most people *fix* the bugs in Beta Testing instead of *releasing* what is effectively a Beta Test version and letting the users unwittingly find out the problems...!

Originally Posted by scastle

I don't think Windows has any more or fewer bugs than any software. We were taught at Uni that IBM (who have done a lot of work on bug-tracking systems) found that, on average, there was 1 bug for every 1000 lines of code. They tested software written for all operating systems (including Linux).

Another way of looking at it is that somewhere around 95% of the worlds PC's use Windows. This means there are more hackers looking for faults. Of course more bugs will show up.

At least Microsoft are regularly releasing patches.

Averages are very good at disguising the real offenders. If the average is one buggy line per 1,000, then one company may produce one every 500 while another, just one every 1,500. The average is still 1 every 1,000 but one company produces three times as many bugs as the other.

[Stuart]

Originally Posted by Graham

Yes, but most people *fix* the bugs in Beta Testing instead of *releasing* what is effectively a Beta Test version and letting the users unwittingly find out the problems...!

You can beta test software for as long as you like, and as thoroughly. There will still be bugs that slip through the net though (for instance, IIRC, Windows 2000 was in beta testing for over a year)

Originally Posted by Chris T

Averages are very good at disguising the real offenders. If the average is one buggy line per 1,000, then one company may produce one every 500 while another, just one every 1,500. The average is still 1 every 1,000 but one company produces three times as many bugs as the other.

That is true, and being an average it must be taken as such. I was actually trying to make the point that there are bugs in ALL software, and Microsoft do at least correct some of them..

Having said that, I am sure that there are still bugs within Windows, as much as I am sure there are bugs within Mac OS, Solaris, Linux, Free BSD & any other Operating System you care to name.

[Matth]

All bugs are not created equal, either, nor do they have equal effect - critical code should be subject to much greater testing and review than areas where a "bug" may be more noticeable (eg. a menu option missing/malfunctioning) but less crucial in the wider scale of things - Microsoft do not seem to be very proactive in searching for vulnerablities, or the initial quality of code left a lot to be desired.

[greencreeper]

You're forgetting that Microsoft Beta tested Windows for years (Windows 3.1, 95, 98...) before releasing a production version (XP). Okay it's still riddled with bugs and security holes you can drive a bus through but hey - Microsoft made the effort. Surely that counts? And you only have to look at how many customers, I mean Beta testers, Microsoft has to see how dedicated it is to producing quality software.