Delayed patch ends Microsoft’s patch-free month early

A glitch in Microsoft Corp.’s Windows Update automated patching service caused a security fix that was released last month to be delivered to computer users on Tuesday, the same day Microsoft proclaimed December would be a patch-free month.

The software patch fixes a serious vulnerability in a set of Web site management tools called FrontPage Server Extensions, which are part of Microsoft’s Windows 2000, Windows XP and Office XP software, according to Microsoft Security Bulletin MS03-051 released Nov. 11. Exploiting the flaw could allow an attacker to gain control over a user’s PC, Microsoft said.

Due to a flaw in the Windows Update system, the patch that was released at the same time as the bulletin wasn’t delivered until now, Microsoft said in a brief statement.

“Microsoft…has corrected an error in Windows Update that prevented MS03-051 from reaching certain Windows XP customers via Windows Update or Automatic Update technologies,” the Redmond, Wash., company said.

Microsoft said it wasn’t aware of any hackers having exploited the vulnerability and encouraged users to install the patch as prompted by the Windows Update service.

Russ Cooper, surgeon general of TruSecure Corp. and moderator of the NTBugtraq security mailing list, said he wished there had been a worm or a high-profile attack that took advantage of this particular flaw.

“Too bad that did not happen because we would lose all the people that work on Windows Update development and instead have people who are capable,” he said. “I have sent out numerous e-mails with the title ‘Windows Update is a dog.’ It is a terrible delivery mechanism.”

Microsoft also notes that this security issue was rated “moderate” for most Windows XP systems, while it was rated “critical” for systems running Windows 2000 and Office XP with SharePoint Team Services 2002 enabled.

In Microsoft’s rating system for security issues, vulnerabilities that could allow a malicious Internet worm to spread without any action required on the part of the user are rated critical. Issues that will not lead to the spread of a worm without any action taken by the user, but could still expose user data or threaten system resources, are rated important. Vulnerabilities that are very complicated to exploit, or hard to exploit because they are blocked by the default settings on a PC are considered moderate threats.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now