Language Selection

English French German Italian Portuguese Spanish

Faulty M$ Update Rekindles Patch Quality Concerns

Filed under
Microsoft

For Microsoft, delivering high-quality security patches in a timely manner has always been a lose-lose predicament.

If patches for major software vulnerabilities take too long, customers are at the mercy of zero-day threats. When patches are rushed out without proper quality assurance testing, they invariably become a system administrator's worst nightmare.

Earlier this week, when Microsoft Corp. announced plans to re-release a "critical" bulletin because of patch quality problems, the move triggered a new round of eye-rolling among security research pros.

The bulletin, MS05-019, first released in April, contains patches that have caused major connectivity problems for network administrators.

The connectivity errors range from the inability of Exchange servers to talk to their domain controllers; failure of domain controller replication across WAN (wide area network) links; and inability to connect to terminal servers or to file share access.

Microsoft also acknowledged that networking programs that send TCP packets or UDP packets over raw IP sockets "may stop working" after the security update is applied on a computer running Windows XP SP1 (Service Pack 1).

A knowledge base article has been posted to highlight the problems, and hotfixes have been offered to provide temporary respite, but despite Microsoft's insistence that the problems affect only a small number of customers, security experts said the re-release of a high-severity bulletin points to a weakness in Microsoft's patch creation process.

"A hotfix for a patch? I hope it works properly, or what's next? A hotmend for the hotfix for the patch?" asked Corey Nachreiner, a network security analyst at WatchGuard Technologies Inc.

In an interview with Ziff Davis Internet News, Nachreiner said some of his company's clients have complained that the patches have broken VPN connections, a problem he described as "a big deal" for the SMB (small and medium-sized business) market segment.

Because the patch is rated critical by Microsoft, Nachreiner said he cannot recommend uninstalling the patch.

"It means that a lot of customers are scrambling to get hotfixes to keep their systems connected."

Officials at Microsoft insisted the company is doing "far more for this one than necessary" to help ensure every customer has the most recent changes to the update.

Full Story.

More in Tux Machines

Fedora: Anaconda Improvements, Greenboot, Fedora Scientific Vagrant Boxes and Abhishek

  • Anaconda improvements in Fedora 28
    Fedora 28 was released last month, and the major update brought with it a raft of new features for the Fedora Installer (Anaconda). Like Fedora, Anaconda is a dynamic software project with new features and updates every release. Some changes are user visible, while others happen under the hood — making Anaconda more robust and prepared for future improvements.
  • Lorbus: Introducing: greenboot
    Not too long ago, I applied to Google Summer of Code for the student scholarship position together with a Fedora project ideated by Peter Robinson, who is the principal IoT architect at Red Hat, named Fedora IoT: Atomic Host Upgrade Daemon. As you may be guessing by now, I was very fortunate and the proposal was accepted! The coding phase started on the 14th of May and in this blog post I’ll try to give a little insight into my first month working on the project.
  • Pre-release Fedora Scientific Vagrant Boxes
    I am very excited to share that sometime back the Fedora project gave the go ahead on my idea of making Fedora Scientific available as Vagrant boxes starting with Fedora 29. This basically means (I think) that using Fedora Scientific in a virtual machine is even easier.
  • [Week 5] GSoC Status Report for Fedora App: Abhishek

Red Hat News

  • An Open Source Load Balancer for OpenShift
    A highly-available deployment of OpenShift needs at least two load balancers: One to load balance the control plane (the master API endpoints) and one for the data plane (the application routers). In most on-premise deployments, we use appliance-based load balancers (such as F5 or Netscaler).
  • Red Hat Beefs Up Platform as a Service Suite
    Red Hat has begun shipping Red Hat Fuse 7, the next major release of its distributed, cloud-native integration solution, and introduced a new fully hosted low-code integration platform as a service (iPaaS) offering, Fuse Online. With Fuse 7, the vendor says expanding its integration capabilities natively to Red Hat OpenShift Container Platform, an enterprise Kubernetes platform. Fuse gives customers a unified solution for creating, extending and deploying containerized integration services across hybrid cloud environments.
  • Red Hat ‘Fuses’ Low Code Development and Data Integration
    Red Hat, a provider of open source solutions, has announced Red Hat Fuse 7, the next major release of its distributed, cloud-native integration solution, and introduced a new fully hosted low-code integration platform as a service offering, Fuse Online. With Fuse 7, Red Hat is expanding its integration capabilities natively to Red Hat OpenShift Container Platform, a comprehensive enterprise Kubernetes platform. Fuse gives customers a unified solution for creating, extending and deploying containerized integration services across hybrid cloud environments.
  • The GPL cooperation commitment and Red Hat projects
    As of today, all new Red Hat-initiated open source projects that opt to use GPLv2 or LGPLv2.1 will be expected to supplement the license with the cure commitment language of GPLv3. The cure language will live in a file in the project source tree and will function as an additional permission extended to users from the start. This is the latest development in an ongoing initiative within the open source community to promote predictability and stability in enforcement of GPL-family licenses. The “automatic termination” provision in GPLv2 and LGPLv2.x is often interpreted as terminating the license upon noncompliance without a grace period or other opportunity to correct the error in compliance. When the Free Software Foundation released GPLv2 in 1991, it held nearly all GPL-licensed copyrights, in part a consequence of the copyright assignment policy then in place for GNU project contributions. Long after the Linux kernel and many other non-GNU projects began to adopt the GPL and LGPL, the FSF was still the only copyright holder regularly engaged in license enforcement. Under those conditions, the automatic termination feature of GPLv2 section 4 may have seemed an appropriate means of encouraging license compliance.
  • Monness Believes Red Hat (NYSE: RHT) Still Has Room to Grow
  • Comparing Red Hat (RHT) & Autoweb (AUTO)
  • As Red Hat (RHT) Share Value Rose, Calamos Advisors Upped Its Position by $300,831; Chilton Capital Management Increases Stake in Equinix (EQIX)
  • Blair William & Co. IL Buys 23,279 Shares of Red Hat Inc (RHT)

Total War: WARHAMMER

Red Hat changes its open-source licensing rules

From outside programming circles, software licensing may not seem important. In open-source, though, licensing is all important. So, when leading Linux company Red Hat announces that -- from here on out -- all new Red Hat-initiated open-source projects that use the GNU General Public License(GPLv2) or GNU Lesser General Public License (LGPL)v2.1 licenses will be expected to supplement the license with GPL version 3 (GPLv3)'s cure commitment language, it's a big deal. Read more