Printable View
http://www.microsoft.com/technet/sec.../MS04-011.mspx
Security update for Windows (835732) - Critical
http://www.microsoft.com/technet/sec.../MS04-012.mspx
Cumulative Update for RPC/DCOM (828741)- Critical
http://www.microsoft.com/technet/sec.../MS04-013.mspx
Cumulative Security updat for Outlook Express (837009) - Critical
http://www.microsoft.com/technet/sec.../MS04-014.mspx
Vulnerability in MS Jet Database Engin could allow code execution (837001)- Important
Microsoft is still updating these links. They are currently very unstable.
Ms is addressing 20 vulneribilitie with 4 seperate patches.
MS04-11 address 14 vulnerabilities
CAN-2003-0533
CAN-2003-0663
CAN-2003-0719
CAN-2003-0806
CAN-2003-0906
CAN-2003-0907
CAN-2003-0908
CAN-2003-0909
CAN-2003-0910
CAN-2004-0117
CAN-2004-0118
CAN-2004-0119
CAN-2004-0120
CAN-2004-0123
MS04-12 address 4 vulnerabilities
CAN-2003-0813
CAN-2004-0116
CAN-2003-0807
CAN-2004-0124
MS04-13 address 1 vulnerability
CAN-2004-0380
MS04-14 address 1 vulnerability
CAN-2004-0197
Add some old bulletin re-release.
http://www.microsoft.com/technet/sec.../MS00-082.mspx
Reason for re-release: Bulletin updated to advise of the availability of an update for Exchange Server 5.0. Originally posted: October 31, 2000
Updated: April 13, 2004
Version: 2.0
http://www.microsoft.com/technet/sec.../MS01-041.mspx
Reason for re-release: Bulletin updated to advise of the availability of an update for Exchange Server 5.0. Originally posted: July 26, 2001
Updated: April 13, 2004
Version: 2.0
http://www.microsoft.com/technet/sec.../MS02-011.mspx
Bulletin updated to advise of the availability of an update for Windows NT Server 4.0 and to advise Exchange Server 5.0 customers on how to better protect themselves. Originally posted: February 27, 2002
Updated: April 13, 2004
Version Number: 2.0
http://www.microsoft.com/technet/sec.../MS03-046.mspx
Reason for re-release: Bulletin updated to advise of the availability of an update for Exchange Server 5.0.
Issued: October 15, 2003
Updated: April 13, 2004
Version Number: 2.0
I have had a chance to review these patches in much more detail now. I want to let you all know that Microsoft’s rating of these are right on the mark! These are critical! Most of the vulnerabilities addressed in these patches will allow the attacker FULL access to your computers. We are talking about holes big enough to drive a semi through.
The other thing to be aware of..... The MS04-011 patch covers a wide range of vulnerabilities:
LSASS
LDAP
PCT
WinLogon
Metafiles
Help and Support Center
Utility Manager
Windows Management
Local Descriptor Tables
H.323
Virtual DOS machine
SSP
SSL
ASN.1
I applaud MS's attempt to reduce the number of patches, but it seems to me like including this many fixes in a single patch is just asking for trouble. What if a single fix in this patch breaks something you need. Then you have to uninstall the whole patch. I think they should at least make these readily available as separate patches to mitigate the possible problem that could occur.
One of them is also covering RPC/DCOM...looks like MS didn't fixz it last time around...happy patching day.
Yet again they've failed to fix the local zone and CHM bugs that spammers and virii take advantage of. These flaws are at least 4 months old, are being exploited in the wild, and have remained unpatched for far too long. When will they realise withholding patches isn't in the interest of security, and doesn't exactly inspire confidence in their 'trustworty computing' strategy.
I think I'll stick to Gentoo, at least I know things will be fixed in a timely fashion :)
Around here we call the second Tuesday of each month "BLACK TUESDAY" in honor of MS monthly patch day.
Not trying to start a pi$$ing match.But surely your not talking about Linux bugs? Average Linux bugs live 1.8 years, some 7. the PDF can be found here. Just do a search for An empirical study of operating systems errorsQuote:
Originally posted here by Beryllium9
Yet again they've failed to fix the local zone and CHM bugs that spammers and virii take advantage of. These flaws are at least 4 months old, are being exploited in the wild, and have remained unpatched for far too long. When will they realise withholding patches isn't in the interest of security, and doesn't exactly inspire confidence in their 'trustworty computing' strategy.
I think I'll stick to Gentoo, at least I know things will be fixed in a timely fashion :)
http://portal.acm.org/results.cfm?co...TOKEN=57621828
http://www.acm.org/
Atleast in Linux I can fix the bugs myself if I'm alerted to their being there. ;-)
just go to your windows update page and get all your updates from there.
Measure twice code once ;)
!mitationRust, I tried to download the pdf, but you have to be a member or have a subscribtion to access it. Was the pdf informative or pretty bland? Are the bugs you are talking about, kernel device driver bugs? Would they be considered critical?
catch originally posted this pdf here.Quote:
Originally posted here by devpon
!mitationRust, I tried to download the pdf, but you have to be a member or have a subscribtion to access it. Was the pdf informative or pretty bland? Are the bugs you are talking about, kernel device driver bugs? Would they be considered critical?
http://www.antionline.com/showthread...ight=catch+PDF
I have a copy on a data CD around here, I'll do some plundering around but like he said it's too big for the site but I'll find a way to post it when I find it. Did you sign up for the site? That site has more intresting PDF's then the NSC site.
!mitationRust, no I haven't signed up yet, but thanks for the extra info.
Hmm, interesting point about Windows update ......
A lot of the fixes it installs are only about 300K or so, but during the installation phase they link to wxpsp2.windowsupdate.com to download the real fix, which is considerably bigger.
I can imagine this causing a lot of confusion out there.
On a dial up connection, this means that the installation phase can appear to hang for at least 30 mins or so. Seen the symptoms at a friends house, who had given up on trying to update his copy of WinXP.
It would be nice if MS gave some warning as to what was going on, like we are now going to download the real 1.5Mb fixes - took 2 hours in his case :mad:
How many of these linux bugs that are up to 1.8 years old have had advisories, and have been actively exploited in the wild? Not all bugs are security issues either, some will be annoyances, others will be more serious. No code is perfect and bugs will never go away no matter who develops the software and regardless of the development model. However, once a vendor is notified of a serious flaw that allows code execution, have been given sufficient time to develop and provide a solution, and the information has been made public, is it not reasonable to expect a patch?
The CHM bug that allows code execution has been known about for ages, and has been public knowledge since december 30. There are no workarounds, and no fixes. With the current patch schedule, it's been ignored or missed 4 times. It's a bit strange that a vulnerability like this has been unpatched for so long when microsoft are trying to convince world+dog they do actually take security seriously. This is the point I was trying to make, and it wasn't just another 'have a go at microsoft for the sake of it' post. There's far too many of them already, mostly for no good reason at all.
Are there any alternative download locations for that PDF file? It does look interesting going by the summary, and I've not got a subscription to that site.
Code has to be perfect or damn near when dealing with nuclear silo's in america. ;)Quote:
Originally posted here by Beryllium9
No code is perfect and bugs will never go away no matter who develops the software and regardless of the development model.
Example:Google XTS-200 systems "those systems are so validated that they never need patching."
Like catch stated, AO is not uploading it,it's too big. However I did go on the record saying that I would find away to upload it.....but you will have to download the PDF to get the full effect of the charts and graphs that are presented in the PDF.
Why is this such a surprise to peaple? They have always managed to package things in thier OS dozens of things which you will most likely never use... but they do this to suit the needs of the some 80% of cyberspace running thier OS. They are with the majority & the majority is lazy and would do anything BUT look through at what they may need to patch up on... vulnerabilities possably months often even years old. They are just to busy to browse up on it all. So once agian they are packing stuff together and sending out these patches all at once to suit the needs of the average fat lard-ass S.O.B. who can hardly breath or get up off the couch... yet alone walk around a few inches except when it comes to food.Quote:
Originally posted here by Draco980172
I applaud MS's attempt to reduce the number of patches, but it seems to me like including this many fixes in a single patch is just asking for trouble. What if a single fix in this patch breaks something you need. Then you have to uninstall the whole patch. I think they should at least make these readily available as separate patches to mitigate the possible problem that could occur.
I ran the april updates ona few computers at work...33% of them wont login correctly after the reboot. They are all running windows 2000 and are cloned dell machines. AFter 2 hours, one logged in and I was able to see the 'system' process eating up 100% cpu usage....not system idle, just 'system'. Ended up re-installing the machines. This has been all over microsoft dev forums...I would advise holding off.....now back to that lsass exploit.......