Microsoft Urges Users to Update 5 New Security Holes

Reuters | October 16, 2003 | Reed Stevenson

[HAL9000]

SEATTLE (Reuters) - Microsoft Corp. on Wednesday announced five new "critical" flaws in its software and provided patches to fix them in order to prevent hackers from gaining access to personal computers by deploying a malicious program similar to the devastating Blaster worm.

The announcement, part of a new initiative by the company to notify computer users of patches on a more regular basis, applies to a wide range of Microsoft software, including its Exchange e-mail server, Windows operating system, instant messaging service and multimedia software for Web browsers.

Stephen Toulouse, a security program manager, urged companies and individuals using the products, which are detailed on its Web site at http://www.microsoft.com/security, to apply the patches in order to correct flaws in the software.

"We're trying to move from patch development to patch deployment," Toulouse said, part of a strategy to get customers to update Microsoft more frequently.

The plan to improve the software patch system was announced by Chief Executive Steve Ballmer last week as part of Microsoft's ongoing Trustworthy Computing initiative to make its software more secure and reliable, which was launched in early 2002.

The world's largest software company said it recognized the difficulty the multiple patches posed for companies trying to apply them.

"Because so many critical patches were issued today, companies will face a difficult challenge trying to quickly identify the necessary patches, test systems and roll out patches to all servers and workstations," Microsoft said in a statement.

Microsoft made the announcement with Shavlik Technologies, a security software and services firm, which helps companies apply the software patches.

John Parker, a senior product manager at security company Network Associates Inc., said the number of patches was not out of the ordinary, given the number of critical patches that Microsoft has announced so far this year, which have averaged about four or five a month.

"But they are very serious," said Parker, adding that a compromised computer could be used by attackers to run malicious programs and launch attacks on other computers.

Microsoft announced a total of seven software flaws and patches on Wednesday, of which five were given the company's most urgent security rating of "critical."

[zx2dragon]

MS ping

[goldstategop]

I downloaded and installed all 5 patches a half hour ago. No problems here.

[GeronL]

oh grate, like I don't have enough programs running at the same time

[flashbunny]

I just had to 'upgrade', if you can call it that, to XP pro due to software requirements of work software. I'm not looking forward to the endless series of patches just to keep my PC safe.

At least I don't use outlook...I don't think I could keep up with it all if I had to use that piece of garbage.

[GeronL]

darn it, launching Windows update

[goldstategop]

Its takes a few minutes to reboot. As if that's a major drag on any one. And for all of its flaws, Windows XP has been rock solid from the day I installed it.

[GeronL]

OK, PB whats with all these updates and patches? Couldn't they make them into a single patch?

[GeronL]

I have had this computer a month and its been great so far, my first CD burner and all that

[Jorge]

...here we go again.

[goldstategop]

Flaws aren't uncovered overnight. Let's face it, human nature being what it is, anything people do will get somewhat screwed up. The amazing thing is not that people make mistakes but how the world keeps running in spite of the fact they do.

[toupsie]

Yes today was a pain in the rump at work because of Microsoft. At least my Xserves have been humming along without the weekly patches that Microsoft forces on us. I can't believe how many patches I have had to apply to our Windows 2003 Enterprise Server Active Directory servers this year. Microsoft gave us the whole dog and pony show how secure Win2k3 was going to be. So full of holes, it makes swiss cheese jealous.

[GeronL]

Windows Updates said I need 11 updates, some critical... hhhhmmm.. I guess I could put it off a few hours??

[toupsie]

It is a major drag if you need high availability and continuous uptime.

[goldstategop]

You need to install the critical updates immediately. The rest you can install at your convenience later.

[goldstategop]

If patching Windows isn't your cup of tea, switch to Linux.

[cake_crumb]

HOPEFULLY, the updates will WORK.

[Cicero]

I think XP Pro is great. It's as stable as Win2K but has a better look & feel, IMHO.

[kylaka]

I use both W2K and XPpro on the same desktop system. XP has better file management, and W2K has better disk management, and recovery of disk errors. You'd have to work with a large number of files to notice the difference though.

[LenS]

I'm still using Windows 98 and when I popped by the MS Update site, they had nothing for me. Strange, but having an older OS seems to be beneficial when it comes to avoiding the attention of hackers (one reason Apple gets less attacks).