Microsoft Admits Vista Update Glitch
296056
A patch to prepare for first service pack went to users of editions that didn't need the update.
286571
Microsoft has fixed a problem with Windows Mobile Device Center that made it difficult for Windows Mobile devices to sync with Vista.
411910
(InfoWorld) - Microsoft has released its monthly set of security patches , fixing problems in Windows, Internet Explorer and in the SSL (Secure Sockets Layer) software used for secure Web browsing. In total, Microsoft released six sets of patches, called updates, fixing 15 flaws in its products. Four of these updates are rated critical and administrators should patch them as soon as possible, security experts said Tuesday. Many of the flaws that Microsoft patched on Tuesday can be exploited via the Web. In particular the MS07-033 update, which fixes bugs in Internet Explorer and MS07-031 , which addresses a critical flaw in the SSL libraries used by Windows. The SSL flaw is particularly interesting because it affects users who are visiting supposedly trustworthy Web sites, and because it could also affect non-Microsoft browsers like Firefox and Opera, said Amol Sarwate, manager of Qualys, Inc.'s vulnerability research lab. "It will affect all the browsers that call the libraries that are in the Windows operating system," he said. Although Microsoft warned that this flaw could be used by attackers to run unauthorized software on the victim's computer, this would be hard to do. "Attempts to exploit this vulnerability would most likely result in the Internet Web browser or application exiting," Microsoft wrote in its MS07-031 bulletin. "The system would not be able to connect to Web sites or resources using SSL ... until a restart of the system." The two other critical updates are MS07-035 , which fixes a bug in the core Windows operating system's Win32 API (application programming interface), and MS07-034 , which fixes bugs in Outlook Express and Windows Mail. Because MS07-035 could be exploited via the Web, it should also be patched as soon as possible, Sarwate said. The other updates released Tuesday fix less-critical flaws in Windows Vista and Microsoft's Visio drawing software. The Vista update is noteworthy because it marks the first time that Microsoft has patched a flaw that was introduced in the Vista operating system, Sarwate said. Previous Vista patches have repaired "legacy" code that was written for earlier versions of Windows, and then reused in Vista. But the MS07-032 update applies to Vista only. This flaw, rated "moderate" by Microsoft, could allow an attacker to gain unauthorized access to information such as administrative passwords stored within Windows.
273075
Microsoft confirmed Thursday that its invite-only group of about 15,000 testers has had the final version of Windows Vista Service Pack 1 (SP1) for the past two weeks.Other Vista users, however, will have to wait until March to obtain a legal copy of the release-to-manufacturing (RTM) version of Vista SP1, the company reiterated.According to a Microsoft spokeswoman, the build designated Vista SP1 RC Refresh 2, which was seeded to testers on Jan. 24, is identical to&#160;the code that company developers shipped&#160;out the door on Monday as RTM.&quot;In final stages of a product, Microsoft likes to get as much validation as possible before releasing,&quot; the spokeswoman said in an e-mail. &quot;The release candidate ended up being a high enough quality to be approved to release to manufacturing.&quot;The shift in nomenclature, but not bits, is common. Eventually, a vendor must approve a build as &quot;gold code,&quot; at which point that edition becomes the shipping version. Last November, for example, Apple Inc. issued a test build of Mac OS X 10.5.1 to developers one day, then called it good to go and posted it for download the next.However, users who weren&#39;t part of the SP1 testing group must wait until March to get their hands on the update, the spokeswoman repeated today. In five to six weeks -- mid-March according to Microsoft -- the service pack will be offered via Windows Update as a 65MB optional update and posted to Download Center as a 450MB stand-alone installer that supports five languages. A month later, in mid-April, Windows Update will automatically download and install SP1 on Vista-equipped PCs whose users have set Automatic Updates to do hands-off updating.Subscribers to the Microsoft Developer Network (MSDN) and TechNet will get a slight jump on the general public. &quot;In early March, MSDN and TechNet subscribers will be able to get the &#39;Windows Vista with SP1&#39; full DVD,&quot; the same spokeswoman said in another e-mail. The updated operating system will be offered to MSDN and TechNet subscribers through their respective download centers.Microsoft is holding SP1 so that it can identify device drivers that won&#39;t reinstall -- as they must -- during the service pack update process. On Monday morning, Mike Nash, vice president of Windows product management, said that while SP1 had met the RTM criteria, it would not be available for several weeks because of the&#160;driver problems.That generated a firestorm of criticism from users, who vented by posting over 200 comments to Nash&#39;s announcement, calling the decision &quot;stupid&quot; and &quot;one of the all-time worst moves&quot; by Microsoft.Judging by the tone of nearly 120 comments left on Microsoft&#39;s official TechNet blog, IT professionals and developers are even angrier. The subscribers called the withholding of SP1 &quot;boneheaded&quot; and a &quot;slap in the face,&quot; or dubbed it &quot;the Vista SP1 RTM Debacle.&quot; Others questioned the value of their TechNet subscriptions, admitted that they had had to download a pirated copy using BitTorrent so that they could start testing, and said they would postpone Vista deployments for months because of the delay.Several wondered why reviewers in the press had the finished bits before they did.But a commenter identified only as Joe put it most succinctly: &quot;This is the lamest decision since Microsoft Bob. I get this the same time as my mom?&quot;The backlash may have gotten through to Microsoft. On Monday night, Kathy Dixon, the TechNet Plus team member who normally writes the blog, said that she was looking into the possibility of moving up the availability date of SP1. But as of Thursday night, she had no solution for users. &quot;I have escalated this and am continuing to push internally for a solution ASAP,&quot; Dixon wrote around 8 p.m. EST. &quot;Please hang in there, I should have something more specific soon.&quot;Computerworld is an InfoWorld affiliate.
150856
Microsoft confirmed that its soon-to-be-released Vista operation system was designed to cripple pirated copies.
499817
After fielding numerous reports of PCs caught in endless reboot loops (or not rebooting at all), Microsoft has yanked an update designed to prep Vista machines for Service Pack 1.
397575
Early version of first significant Vista update released to testers. Also, near-final "release candidate" version of Windows Server 2008 to be available within 24 hours.
443754
Microsoft acknowledged Tuesday that developers looking to build applications on Windows Vista will need to upgrade to Visual Studio 2005 SP1, highlighting compatibility issues the company is dealing with as the new operating system nears release.
350747
A typo in an official Microsoft e-mail is being blamed for rumors of an imminent Windows Vista service pack.
631605
Microsoft can't stop crowing about new Vista security features. But the system still has holes. Here's how to plug them.
36580
Microsoft said people running a pirated version of its new Windows Vista operating system will be denied access to some features.
324860
Microsoft has released yet another hotfix&#39;to fix a newly discovered problem in its XP Service Pack2 (XP SP2) release.
461237
(InfoWorld) - A Microsoft security executive released data Thursday showing that, six months after shipping Windows Vista, his company has left more publicly disclosed Vista bugs unpatched than it did with Windows XP. In total, Microsoft has patched 12 out of 27 disclosedÂ Vista vulnerabilitiesÂ in the six months after it first shipped last November. During XP's first six months, Microsoft's security team patched 36 out of 39 known bugs. The data was published by Jeff Jones, a Microsoft security strategy director, who said that overall, Vista was doing better than XP. "Windows Vista continues to show a trend of fewer total and fewer high-severity vulnerabilities at the six month mark compared to its predecessor product, Windows XP," he wrote. Jones didn't address the larger number of unpatched vulnerabilities, but he did note most of the unpatched Vista bugs were not critical. Microsoft had left only one high-severity Vista vulnerability unpatched during the period. At the end of XP's first six months, there were two high-severity bugs that were unpatched. Microsoft patched 23 high-severity XP bugs during its first six months, compared with only one high-severity Vista flaw. Jones argued that Vista had a lower number of vulnerabilities than competitive operating system products such as Red Hat Enterprise Linux and Mac OS X. He published the data in an effort to show how Microsoft's software development methodology, called the Security Development Lifecycle (SDL) is yielding dividends. But his method of comparing Windows to Linux and Mac OS X is problematic, according to some. "This is an apples-to-oranges comparison," said HD Moore, one of the hackers behind the popular Metasploit penetration testing toolkit. "If you want a more accurate view, try comparing the number of flaws between Microsoft-developed software and vendor-X-developed software. Most Linux vendors don't actually write the majority of the packages they include," he said via e-mail. "Alternatively, force Microsoft to include all vulnerabilities in common third-party software," he added. "For example, the thousands of exploitable ActiveX controls that... vendors include with a Windows system." According to Randy Abrams, director of technical education with antivirus vendor Eset, it will be more interesting to look at vulnerability statistics once Vista becomes more popular than XP, and the target of more hackers. But Microsoft has stepped up its security practices, he added. "I think their Security Development Lifecycle initiative has improved the quality of the code," he said. Â
671277
Software giant Microsoft confirmed Monday that the first update to its Windows Vista operating system will be available as an official download in mid-March. Windows Vista Service Pack 1 will address various performance and stability issues and improve the desktop OS's hardware support.
360314
Windows XP and Windows Vista systems can be exploited if they haven't been updated with Redmond's first patch of 2008, says security firm.
589724
Microsoft is pointing to a server error that caused a weekend snafu in which legitimate customers were accused of stealing software. Thousands of legit copies of Windows XP and Vista were identified by Microsoft&#39;s Windows Genuine Advantage (WGA) validation system as pirated.
619011
Microsoft apparently has started updating files on PCs running XP and Vista, even when users have disabled the operating systems' automatic update feature.