
how-to block ads
|
 EGeezer Go Bobcats Premium join:2002-08-04 Country!
·Callcentric
·RoadRunner Cable
·AT&T CallVantage
1 edit | ZDNet: Missing Microsoft patch leaves critical vulnerability
I was intrigued by this Microsoft Technet blog entry, which referenced a patch that was not released for quality reasons. However, the poster did not provide any information on what was missing or what measures users could take until the patch was issued. While it's goodness to remove flawed patches, the vulnerabilty information and workarounds(if any) should not also be removed.
said by blog entry :
You may notice that we removed one of the bulletins that we had mentioned in the Advanced Notification Service that we released last week. We did this prior to todays bulletin release because of a last minute quality issue.
The present version here has omitted all references to it. I guess if they feel if they remove references to the vulnerability, it'll go away.. 
A bit of searching yielded this ZDNet blog article which described the missing patch as one to address a critical vulnerability in Windows Media Player (WMP).
said by blog entry :
Lost in the shuffle of this months Patch Tuesday barrage is the fact that a critical vulnerability in the ever-present Windows Media Player (WMP) was not fixed because of a last minute quality issue.
Microsoft originally listed the WMP update in the advance notice for August but, when the patches dropped on Tuesday, it had slipped because of patch-quality concerns.
The explanation from Redmond:
* Microsoft has heard from customers that the quality of updates is very important and, as part of the process at the Microsoft Security Response Center (MSRC), Microsoft tests these updates continuously until they are ready for distribution to customers through our regularly scheduled security bulletin release.
This effectively means that millions of Windows users WMP ships with every version of the desktop operating system are exposed to a critical, code execution vulnerability that will not be fixed for at least another month.
The ZDNET article goes on to enumerate several other unpatched vulnerabilities.
Since the information on the missing patch was removed in the advisory, we as users only know that there's a critical vulnerability in WMP out there that's still unpatched, and have no workaround or precautions to take beyond simply not using WMP.
Any specific information for affected users, including workarounds, is welcome. -- The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis | |
|  daveinpoway Premium join:2006-07-03 Poway, CA | Re: ZDNet: Missing Microsoft patch leaves critical vulnerability I suppose Microsoft could release this patch "out-of-cycle", instead of waiting for September's "Patch Tuesday", but I have no clue as to whether they will do this. | |
|  |  |  |  |  |   Smokey Bear veritas odium parit Premium join:2008-03-15 Annie's Pub
| Re: ZDNet: Missing Microsoft patch leaves critical vulnerability said by EGeezer :Thanks for putting out the word - Spreading the word is part of our job: informing and advising the user. 
and for the attribution! All credits to you, after all you was the one that took my attention to the WMP non-patch issue  -- Smokey's Security Forums »www.smokey-services.eu/forum/ Smokey's Security Weblog »smokeys.wordpress.com/ ASAP Site Member »asap.maddoktor2.com | |
|  SUMware Premium join:2002-05-21
| Those wishing to explore a free and excellent replacement for WMP can look at the VideoLAN - VLC media player.
VideoLAN is a software project, which produces free and open source software for video, released under the GNU General Public License.
VLC media player is a highly portable multimedia player for various audio and video formats (MPEG-1, MPEG-2, MPEG-4, DivX, mp3, ogg, ...) as well as DVDs, VCDs, and various streaming protocols.
It can also be used as a server to stream in unicast or multicast in IPv4 or IPv6 on a high-bandwidth network. It doesn't need any external codec or program to work.
BTW - it doesn't spy on its users. | |
|  |   antdude A Ninja Ant Premium,VIP join:2001-03-25
| Re: ZDNet: Missing Microsoft patch leaves critical vulnerability said by SUMware :Those wishing to explore a free and excellent replacement for WMP can look at the VideoLAN - VLC media player. VideoLAN is a software project, which produces free and open source software for video, released under the GNU General Public License.
VLC media player is a highly portable multimedia player for various audio and video formats (MPEG-1, MPEG-2, MPEG-4, DivX, mp3, ogg, ...) as well as DVDs, VCDs, and various streaming protocols.
It can also be used as a server to stream in unicast or multicast in IPv4 or IPv6 on a high-bandwidth network. It doesn't need any external codec or program to work.BTW - it doesn't spy on its users. Also, Media Player Classic with K-Lite Codecs: »www.codecguide.com/ -- Ant @ »antfarm.ma.cx and »aqfl.net. Please do not IM/e-mail me for technical support. Use the forum! Disclaimer: The views expressed in this posting are mine, and do not necessarily reflect the views of my employer | |
|  |  |  |  |   Cabal Premium join:2007-01-21 Boston, MA 4 edits | Re: ZDNet: Missing Microsoft patch leaves critical vulnerability Edit: Nevermind, not feeding them. | |
|  |  |  |  |  |  |  |  |   Cabal Premium join:2007-01-21 Boston, MA
1 edit | Re: ZDNet: Missing Microsoft patch leaves critical vulnerability said by dadkins :Maybe I'm alone in this, but I would much rather have a patch that works and doesn't break something than have them push one that might be screwed up. Been there before, no thanks! How many of y'all have seen a patch screw something up?  They can keep that patch and FIX IT before I install it and it breaks/loses/kills something. YMMV People aren't asking for a broken patch. People are asking for information on what specifically is vulnerable and how they can protect themselves in the absence of a patch. Microsoft isn't obliging. -- Interested in open source engine management for your Subaru? | |
|  |  |   dadkins Can you do Blu? Premium,MVM join:2003-09-26 Hercules, CA
·Comcast
1 edit | Re: ZDNet: Missing Microsoft patch leaves critical vulnerability said by Cabal :said by dadkins :Maybe I'm alone in this, but I would much rather have a patch that works and doesn't break something than have them push one that might be screwed up. Been there before, no thanks! How many of y'all have seen a patch screw something up?  They can keep that patch and FIX IT before I install it and it breaks/loses/kills something. YMMV People aren't asking for a broken patch. People are asking for information on what specifically is vulnerable and how they can protect themselves in the absence of a patch. Microsoft isn't obliging. Cool! But, since it appears to be a WMP issue/patch, *I'm* not too worried about it. What people should be asking is what else is vulnerable and workarounds for them.
Remember the WMF "thing"? People were peeing themselves over it to the point of applying a patch from a more or less unknown source.
Don't get me wrong, bad is bad. But as I stated, I would rather wait and get the right one and I'm not going to get worked up over a Media Player problem.  I'll uninstall or kill WMP first!
Does anyone have a screenie or copy of that original report? Got a number to the KB?
Thanks!  -- Think outside the Fox... Opera | |
|  |   EGeezer Go Bobcats Premium join:2002-08-04 Country!
·Callcentric
·RoadRunner Cable
·AT&T CallVantage
| said by dadkins :... I would much rather have a patch that works and doesn't break something than have them push one that might be screwed up. Been there before, no thanks! How many of y'all have seen a patch screw something up?  They can keep that patch and FIX IT before I install it and it breaks/loses/kills something. I agree wholeheartedly. As I said in my OP,
said by EGeezer :While it's goodness to remove flawed patches, the vulnerabilty information and workarounds(if any) should not also be removed. I just don't believe that it's goodness to remove the public notice with overview and status and workaround(if any).
On a positive note, this incident did give us a bit of insight on how Microsoft wants to handle its vulnerability notification to affected users. In this case, if there's no patch or the patch needs rework, remove all useful user information on the warning and leave users in the dark. -- The greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding. -- Justice Louis D. Brandeis | |
|  | |  |
|