News Analysis: The software maker admits to withholding details on security vulnerabilities to protect customers from bad guys, but critics say that policy increases the risk for everyone.
Microsoft has ‘fessed up to hiding details on software vulnerabilities that are discovered internally, insisting that full disclosure of every security-related product change only serves to aid attackers.
APRIL 19, 2006 (IDG NEWS SERVICE) - Microsoft Corp. released the first service pack for SQL Server 2005 today, fixing dozens of bugs and paving the way for more businesses to upgrade to its latest database software.
The update comes about five months after the release of SQL Server 2005, which Microsoft engineered to be more competitive with products from database leaders Oracle Corp. and IBM.
A critical Windows patch released last week is tripping up third party applications thereby causing interference to the smooth running of Microsoft’s operating system. The MS06-015 update is designed to fix a serious security flaw in Windows Explorer but in doing so it can interfere with HP’s Share-to-Web software which ships with digital cameras, scanners and some HP CD-and DVD drives.
Microsoft this weekend released a support document outlining lockup and unresponsive software problems that an April 11 security fix causes, but the only workaround involves editing Windows’ registry, a chore usually left to advanced users.
Initial reports Friday of crashes and lockups caused by the MS06-015 security bulletin ranged from lockups of third-party software to Internet Explorer going dead.
Microsoft offered some advance notification Thursday that it would unveil five security bulletins on Tuesday, April 11, among them a fix for the Internet Explorer vulnerability that has been exploited for weeks.
Four of the five will affect Windows, and at least one will be tagged “critical,” Microsoft’s highest-level warning. The fifth will resolve an issue in Microsoft Office that the Redmond, Wash. developer has judged as a “moderate” problem.
Microsoft argues that’s the approach customers want and expect, but some security experts complained that the software company’s traditional method, which could take days or weeks, wouldn’t help people fast enough.
What’s New:
Notes:
As part of its monthly patch cycle, Microsoft on Tuesday released fixes for six security holes in Office and one flaw in Windows.
Five of the six vulnerabilities in Office are specific to Excel. The most serious flaws could allow an attacker to gain control over a vulnerable PC running the spreadsheet program, Microsoft said in Security Bulletin MS06-012. In all cases, the miscreant would have to persuade the user to open a malformed Excel file, the software maker said.
Update for Windows XP (KB904942)
Install this update to resolve HTTP authentication issues in Windows-based systems that do not appear until Microsoft Internet Explorer 7 is installed. After you install this item, you may have to
restart your computer.
File Name: WindowsXP-KB904942-v2-x86-ENU.exe
Version: 904942
Knowledge Base (KB) Articles: KB904942
Date Published: 2/27/2006
Language: English
Download Size: 503 KB
Estimated Download Time: 2 min 56K
File Name: WindowsXP-KB913538-x86-ENU.exe
Version: 913538
Knowledge Base (KB) Articles: KB913538
Date Published: 2/21/2006
Language: English
Download Size: 657 KB
Estimated Download Time: 2 min 56K
Install this update to prevent Windows Management Instrumentation
enumerations from being canceled before the client computer can finish
using the enumerations. After you install this item, you may have to
restart your computer.
