20 new Windows security vulnerabilities

Time to patch!

[encyclo]

OK, here we go: 20 vulnerabilities, 8 critical, affecting Windows 98 to Windows Server 2003, IIS, IE, Outlook Express, Outlook, Exchange, Help, Netmeeting, LDAP, ASN.1 and Clippy. Actually, Clippy is safe, but the rest are not!

WindowsUpdate is desperately slow this morning, which at least means that people are learning to patch fast.

[us-cert.gov...]

Sorry if this has already been posted, I couldn't find it...

Happy patching!

[HelenDev]

I'm getting tired of this.

If I use windows but not ie or outlook, need I worry less about implementing all these security patches? Or would that be naive?

[encyclo]

I mentioned ASN.1, which is not at all well-known, but is a standard library for large parts of Windows - part of the fundamental architecture on which Windows is built. So, even if you don't use either IE or Outlook Express, you still need to patch. Worms such as MSBlast have shown that you can get infected just by being connected to the internet, without any other intervention on your part.

[ogletree]

If you use file explorer or My Computer or browse your files at all you are using IE.

[andy_boyd]

Hopefully the patches don't cause any ancilliary problems.

I'm going to wait and see, just in case they introduce bugs. You never know :(

[hazardtomyself]

>>WindowsUpdate is desperately slow this morning<<

Agree. I gave up because it took way too much time.

>>I'm going to wait and see, just in case they introduce bugs. You never know :( <<

Maybe I'm lucky I gave up.
Is it generally accepted by industry experts to download the updates right away?

I think I remember some here at WW reporting serious problems with the last update or the one before that.

Should we wait a day or a week before downloading the updates?

[dwilson]

Is it generally accepted by industry experts to download the updates right away?

That depends on the severity of the vulnerability and the exposure of the system.

Ideally, you would install right away on some test systems & verify that nothing adverse occured. You would then deploy to the production systems.

Most of us don't have the luxury of running a complete test network, however.

[HelenDev]

Worms such as MSBlast have shown that you can get infected just by being connected to the internet, without any other intervention on your part

If you use file explorer or My Computer or browse your files at all you are using IE

Darn it! I was hoping not to bother. I must confess I have not always got around to patching in the past, should I be worried? If I patch now will it patch my 'old' holes?

Perhaps I should lock my PC away in a cupboard, far, far away from the internet...

[jimshu79]

I was able to download the updates on 3 pc's yesterday April 14th at about 5pm...

Whenever new updates come out, I wait at least 24-48 hours because people have the "automatic update" on their machines slamming the servers...

[cyberfyber]

Hmmmmm,

so then would I be correct in saying that all these Hotfixes I've downloaded since 2 years ago, now make up over a coupla extra gigs on my PC? (or more?)

[Tropical Island]

We accessed the download site this morning at 5.30 AM EDT and downloaded and installed the 4 patches for our XP machine with no problem.

As we have a second computer we saved the patches to our hard drive and will now burn a cd and install them on the other. These sound like important patches. Don't want to be caught with another "blaster" problem again.

I have read that if you have a properly configured firewall these problems will not affect you. Don't take this comment as definative.