Jump to content
The Inquirer-Home

Microsoft dumps a load of patches

Big Patch Tuesday
Wednesday, 14 October 2009, 10:09

MICROSOFT RELEASED the October 2009 edition of its monthly security update yesterday.

The latest "patch Tuesday" offering from Redmond consists of 13 separate bulletins which address a total of 34 security flaws in various components of Windows, Internet Explorer and Office.

Of the 13 bulletins, eight have been given a security rating of 'critical,' Microsoft's highest alert level. The remain five bulletins have been rated at an 'important' risk level.

The eight critical bulletins include fixes for components in Server Message Block, Windows Media Player and Runtime as well as software for Internet Explorer, Active Template Library, .NET and GDI Library. All eight of the bulletins fix flaws which, if targeted, could allow an attacker to remotely execute code on a targeted system.

The five important bulletins include two fixes for remote code execution flaws as well as a pair of patches for denial of service vulnerabilities, a spoofing flaw and an elevation of privilege vulnerability.

The update also includes four updates for Windows 7, three rated as important and one rated as critical. The company plans to formally release Windows 7 later this month.

The company said that the update will also contain a re-issue for a previously-patched flaw in the XML Core Services component of Windows to expand the coverage of the patch.

Users can download the security update through the Microsoft Update application or from the company's download site. µ

Share this:

Comments
If it ain't broke don't fix it.

Updates sometimes cause more trouble than they are worth. I'll take my chances with the security flaws. Five years and still running smooth with no updates, no viruses either.

posted by : Tom, 14 October 2009 Complain about this comment
You don't need updates if you know what you're doing

In all the years i've been running Win XP, ive never installed any update patches apart from service packs 1, 2 and 3 and the patch for conficker.

I can't remember ever getting a virus, trojan, worn, etc...

But then I know what i'm doing when i'm online - I use Firefox with NoScript and FlashBlock add-ons, have NOD32 and SpyBot S&D installed and up to date. Also use Foxit PDF Reader instead of Adobe Acrobat for PDFs.

I suspect the vast majority of systems with viruses are owned by stupid gullable noobs with no clue what so ever

posted by : Simon, 14 October 2009 Complain about this comment
analyst

Hey Simon, Service Packs contain consolidated update patches :P

burn!

posted by : Jon, 14 October 2009 Complain about this comment
@ Malware Dick

Have you tried poultice?

I never had a malware, virus, trojan worm, update, service pack, or flu shot.

If one poultice doesn't do the trick, have another, and another, and you get the idea.

posted by : Dr. Fill, 14 October 2009 Complain about this comment
Conspiracy Theory

Who knows what these "updates" are, they could well be just seeing what software we have loaded - whats hot.

It's in M$'s interest to have us at their site each month - thats good marketing.

Other updates may well just be making more things insecure, so that we have to return to get it fixed.

posted by : RogerP, 15 October 2009 Complain about this comment
@ Simon

There's definitely a "damn if you do and damn if you don't" involved here.
There's been a number of instances where a security patch has caused problems to one or more applications, but there are also plenty of examples of malware like Blaster and Conficker infecting computers merely because those computers were connected to a network. Hospitals here in Sweden have had X-ray machines and other computer controlled devices fail because of that, and those most definitely don't run IE or other normally targeted applications, but just insufficiently patched OSs and AV.

posted by : Olle P, 15 October 2009 Complain about this comment
Hole-shuffling lottery

After watching Microsoft fruitlessly patching and re-patching all versions of Windows for over 25 years (and now see that the supposed 'golden-child' Windows 7 is following suit), I have developed a General Theory about Microsoft operating system security:

1) All Microsoft operating systems are designed with some significant minimum quantity of security holes which can never be closed.

2) These holes are experimentally discovered in the closed-source binary code by hackers. The hackers then have many a field day, creating botnets and viruses (that can also skip the following step 3), taking over people's computers and ripping off their bank account balances, personal identity and files.

3) Microsoft eventually responds by using some random-number generator (perhaps ball-machines similar to those used in many lotteries) to designate new coordinates to move these unpatchable holes to. Microsoft then issues these relocation "patches" each month on "patch Tuesday".

4) A host of "computer nerd" businesses then feed of the huge number of scraps that are left over (of peoples computers that cannot be "rescued" by Microsoft's "better late than never" patch cycle).

5) Branch back to step 2, and the cycle continues ad-infinitum (and apparently applies to all Microsoft OS's, past, present, and assumedly, future).

Hopefully, my airing this "theory" will not result in any law suits or other forms of corporate-bullyhood from Ballmer and Co. The only way to break this cycle that I can see is to jump off the Microsoft foodchain and run something secure (and free) on your computer, like Linux.

posted by : Linux is your lucky number, 15 October 2009 Complain about this comment
Advertisement
Subscribe to the INQ Newsletter
Sign-up for the INQBot weekly newsletter
Click here to sign up Existing user
Advertisement
INQ Poll

Christmas computer sales

Will you be buying a new computer this Christmas?