News
News
8/16/2006
03:11 PM
Connect Directly
RSS
E-Mail
50%
50%

Microsoft Issues First Patches For Vista

Microsoft confirmed that two of last week's 12 security bulletins were for Vista and posted instructions for downloading security updates for the new Windows.

Microsoft confirmed Tuesday that two of the 12 security bulletins issued last week affect Windows Vista Beta 2, the widely-used preview, and posted download instructions for the first security updates to its next-generation operating system.

"We are committed to releas[ing] Windows Vista updates for all MSRC [Microsoft Security Response Center] critical class issues that may arise during the beta testing period," wrote Alex Heaton, product manager for the Windows Vista security team, on the group's blog.

Out of the dozen bulletins released Aug. 8, two -- MS06-042 and MS06-051 -- impact Vista Beta 2. "Of the seven critical Windows updates released in August, only 2 also affect Windows Vista Beta 2 or later," said Heaton.

MS06-042 is a cumulative security update for Internet Explorer that included patches for 8 different vulnerabilities; MS06-051 detailed a fix for a flaw in the Windows kernel that might let attackers hijack PCs by drawing users to malicious Web sites.

Neither bulletin, however, yet offers details on Vista Beta 2, nor even mention the operating system as among those impacted. The only explanation came from Heaton. "Microsoft does not include information about beta products in formal security bulletins." The company did not immediately respond to follow-up queries about how it released the Vista vulnerabilities' patches and why it chose to deliver them sans details.

The download sites for the updates -- this link is for the IE 7 fix, this site for the kernel patch -- also lack the information normally posted by Microsoft in its security bulletins' FAQs.

"We really should have been told about these Vista vulnerabilities last week," said Michael Cherry, an analyst at Redmond, Wash.-based Directions on Microsoft. "Microsoft should have told us then that Vista needed to be patched, too."

Vista is in beta, Cherry acknowledged. "On one hand, it's not a supported release and people are supposed to take the appropriate cautions, and not put it into a production environment. But you can't test it that way. And this is a very wide beta."

More worrisome, said Cherry, is that Vista, even in beta, faces a much different security landscape than the last-released desktop client OS, 2001's Windows XP. "Then, if you put a beta on a machine, someone might get to it and, say, deface a Web site," Cherry said. "Minor stuff. But now it's just as likely that they'll try to turn these Vista machines into zombies.

"The [security] environment has changed. I'm very nervous about using Vista Beta 2 like this because the [security] situation's changed."

Microsoft's Heaton, meanwhile, told Vista Beta 2 users that update support will end as soon as the preview's successor -- to be dubbed Release Candidate 1, or RC1 -- appears. "Updates will no longer be released for Windows Vista Beta 2 after RC1 has been released, and updates for pre-release versions will not be released after Windows Vista has released to manufacturing."

Whatever information Microsoft decides to provide on future security vulnerabilities within Vista will be posted to the support document tagged as "921583" and available here. In that document, Microsoft recommended users apply the updates "immediately."

Comment  | 
Print  | 
More Insights
The Business of Going Digital
The Business of Going Digital
Digital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest - July 22, 2014
Sophisticated attacks demand real-time risk management and continuous monitoring. Here's how federal agencies are meeting that challenge.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.