[Merged] Microsoft Security Updates

[Alan Waddington]

Originally Posted by Matth

All bugs are not created equal, either, nor do they have equal effect - critical code should be subject to much greater testing and review than areas where a "bug" may be more noticeable (eg. a menu option missing/malfunctioning) but less crucial in the wider scale of things - Microsoft do not seem to be very proactive in searching for vulnerablities, or the initial quality of code left a lot to be desired.

I agree. Also the software architecture is key to reducing the number of security related bugs. Microsoft's problem, particularly with IE is that it starts from the premise that it's code is trusted and therefore has full access to everything & then has to provide security at every interface. A more sensible approach is to have the operating system kernel provide a finer degree of rights access to individual non-kernel OS modules. This would make buffer overruns less of a security issue (except in the kernel itself) In this regard NT 3.51 was better than NT4. The problem was that all this extra OS based security slowed the computer down too much, so in NT4, the graphics drivers were elevated to have full hardware access. This specific case is an example of the more general problem throughout windows.

I believe that the next step MS will be taking will be to remove write access to pages that are supposed to only contain program code. This should help a bit.

[Tricky]

Originally Posted by Tricky

Oops they did it again! 26-07-2004 fix

Will be delayed!!! by approx two weeks! Cross everything!

[Stuart]

Originally Posted by Alan Waddington

I believe that the next step MS will be taking will be to remove write access to pages that are supposed to only contain program code. This should help a bit.

Support is built into XP SP2. It's called "Data Execution Protection". It works better if your CPU supports it (although I believe that only the Athlon 64 bit processors provide this support at the moment), but it should hopefully be quit effective.

[Tricky]

Originally Posted by Tricky

Will be delayed!!! by approx two weeks! Cross everything!

Actual text:

The security update slated for release on MONDAY 26 JULY 2004 has been
delayed. This security update should be ready for release within the
next two weeks as soon as testing and quality review is complete. We
will release the update as soon as we are fully confident that we are
providing a quality release with detailed prescriptive guidance to help
customers effectively manage and deploy the update.

[Tricky]

Strike 2

On Friday 30 JULY 2004 the Microsoft Security Response Center is
planning to release: One Microsoft Security Bulletin affecting Microsoft Windows. The greatest maximum severity rating for this security update is Critical. This security update will require a restart.

Enjoy!

[Tricky]

On 10 August 2004 the Microsoft Security Response Center is planning to release: One Microsoft Security Bulletin affecting Microsoft Exchange. The greatest maximum severity rating for this security update is Moderate. This security update will not require a restart.

A calm month then!

[Tricky]

On 14 September 2004 the Microsoft Security Response Center is planning to release:

- One Microsoft Security Bulletin affecting Microsoft Windows, Microsoft Office, Microsoft Home, Microsoft Visual Studio, and Microsoft .NET Framework. The greatest maximum severity rating for this security update is Critical. This security update may require a restart.

- One Microsoft Security Bulletin affecting Microsoft Office. The greatest maximum severity rating for this security update is Important. This security update does not require a restart.

Although we do not anticipate any changes, the number of bulletins, products affected, restart information and severities are subject to change until released.

[Paul K]

Originally Posted by Tricky

On 14 September 2004 the Microsoft Security Response Center is planning to release:

- One Microsoft Security Bulletin affecting Microsoft Windows, Microsoft Office, Microsoft Home, Microsoft Visual Studio, and Microsoft .NET Framework. The greatest maximum severity rating for this security update is Critical. This security update may require a restart.

- One Microsoft Security Bulletin affecting Microsoft Office. The greatest maximum severity rating for this security update is Important. This security update does not require a restart.

Although we do not anticipate any changes, the number of bulletins, products affected, restart information and severities are subject to change until released.

Those updates are now out,
this one is listed as critical
https://www.microsoft.com/security/b...0409_jpeg.mspx and affects users of windows XP who are not patched to SP2 and the following

* Windows XP
* Windows XP Service Pack 1 (SP1)
* Windows Server 2003
* Internet Explorer 6 SP1
* Office XP SP3
Note Office XP SP3 includes Word 2002, Excel 2002, Outlook 2002, PowerPoint 2002, FrontPage 2002, and Publisher 2002.
* Office 2003
Note Office 2003 includes Word 2003, Excel 2003, Outlook 2003, PowerPoint 2003, FrontPage 2003, Publisher 2003, InfoPath 2003, and OneNote 2003.
* Digital Image Pro 7.0
* Digital Image Pro 9
* Digital Image Suite 9
* Greetings 2002
* Picture It! 2002 (all versions)
* Picture It! 7.0 (all versions)
* Picture It! 9 (all versions, including Picture It! Library)
* Producer for PowerPoint (all versions)
* Project 2002 SP1 (all versions)
* Project 2003 (all versions)
* Visio 2002 SP2 (all versions)
* Visio 2003 (all versions)
* Visual Studio .NET 2002
Note Visual Studio .NET 2002 includes Visual Basic .NET Standard 2002, Visual C# .NET Standard 2002, and Visual C++ .NET Standard 2002.
* Visual Studio .NET 2003
Note Visual Studio .NET 2003 includes Visual Basic .NET Standard 2003, Visual C# .NET Standard 2003, Visual C++ .NET Standard 2003, and Visual J# .NET Standard 2003.
* .NET Framework 1.0 SP2
* .NET Framework 1.0 SDK SP2
* .NET Framework 1.1
* Platform SDK Redistributable: GDI+

There is also an update for users of MS Office 2000 and upwards
https://www.microsoft.com/security/b...converter.mspx
which is listed as an important update.

[jamesclarke555]

...Oh great, another buffer overflow security hole, this time with virus infected .jpeg files

http://www.theregister.co.uk/2004/09...dows_jpeg_bug/

[nffc]

And I already have the update, in fact within 2 mins of getting the email last night.

BBC report here on the latest vulnerability in M$ products. Our corporate IT guys here are on the ball though, the patch ran as I logged in this morning,

http://news.bbc.co.uk/1/hi/technology/3661678.stm

I don't know what's funnier, that M$ has been caught out again, that the BBC used a photo of Avril Lavigne to illustrate the fact that JPEGS can put viruses on your PC or that the image alt caption for Avril was 'Pop singer' ...

[gazzae]

In 1994 this was actually a april fools joke, and now in 2004 it is reality!

http://www.2meta.com/april-fools/1994/JPEG-Virus.html

[Gareth]

yikes!

[Aragorn]

Originally Posted by Chris T

<Snip>

Chris,

While commenting about vulnerable browsers, looking at your sig I hope you've taken notice of http://www.theregister.co.uk/2004/09...zilla_patches/ - a whole load of vulns in Firefox and mozilla .
BTW, I'm not knocking Firefox - I use it myself for browsing anything outside the company firewall - safer and quicker than IE (sure I'll be flamed about that statement !)

Steve.

[SMHarman]

I guess the picture will just be a blue screen, nobody will ever know the difference