Zero-day WMF flaw underscores patch problems

Zero-day WMF flaw underscores patch problems
Robert Lemos, SecurityFocus 2006-01-12

For four days in January, network administrators and security-savvy home users had a choice: Download and install an unofficial open-source fix for the critical flaw in the Windows Meta File (WMF) format or wait an estimated week for an official patch from Microsoft.

Expand all | Post comment

What Microsoft needs to be doing... 2006-01-12
Eric (2 replies)

Re: What Microsoft needs to be doing... 2006-01-13
Matthew Murphy (1 replies)

Re: Re: What Microsoft needs to be doing... 2006-01-13
Eric

Re: What Microsoft needs to be doing... 2006-01-13
Anonymous

Zero-day WMF flaw underscores patch problems 2006-01-12
Penguinisto

Alternative solution 2006-01-13
mxb (2 replies)

The alternative solution to the problem for Microsoft is to release two patches. The first is a ``beta'' patch which has been testing on the main pieces of software (Windows 2000/XP/2003, SQL server etc), newer software which runs on servers and the majority of machines. Due to the less testing involved this patch can then be released quicker. Then, after a little while longer and once all testing is complete, another patch can be released which is guaranteed to work for all machines. Sure, it's not an ideal solution, but the problem is a difficult one for Microsoft who have to cope with a large variety of products.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11368/32954#32954

Re: Alternative solution 2006-01-13
DSMatthews

Re: Alternative solution 2006-01-13
Anonymous

Make'em pay! 2006-01-13
assurbanipal

The Squander of MS Admins && Users 2006-01-13
Anonymous (1 replies)

Re: The Squander of MS Admins && Users 2006-01-16
Anonymous (1 replies)

Re: Re: The Squander of MS Admins && Users 2006-01-17
Penguinisto

Does any one see this 2006-01-13
Anonymous

where come from a zero-day flaw 2006-01-15
lucmars

Patch from Guilfanov was not the only one 2006-01-16
Juha-Matti Laurio

Unofficial fix eliminates GDI32 Escape() functionality in Windows 98SE 2006-01-16
Juha-Matti Laurio