News

Some Microsoft Security Updates Aren't Reaching Users

November 9, 2005

Users of Microsoft (profile, products, articles) Corp.'s Software Update Services (SUS) will have to wait a little longer to obtain Microsoft's latest security patch, the software vendor said Wednesday. Microsoft issued a patch fixing three critical graphics bugs in the Windows operating system Tuesday, but the company has been unable to deliver the software to users of its SUS corporate update service, Microsoft said Wednesday.

Microsoft Program Manager Bobbie Harder acknowledged the problem Tuesday in a post to a SUS discussion forum written shortly after Microsoft issued the November security patch. Harder said that the SUS update would be available by approximately 5 p.m. Pacific Time Tuesday. SUS is a service designed to deliver patches for Microsoft products. It is similar to the widely used Microsoft Windows Update, but is designed for use within a corporate firewall. But by Wednesday, the software was still unavailable. Microsoft's other patch deployment tools, including Windows Server Update Services (WSUS) are unaffected by the delay, Microsoft said.

Microsoft's November security patch fixes a number of problems in the way most versions of Windows render Metafile images. The problems could theoretically be exploited to allow a user to shut down or even gain control of an unpatched system by tricking a user into viewing a maliciously formatted Metafile image.

Windows Metafile is a graphics format used by some CAD (computer-aided design) applications. Files that use this format have either a .wfm or .emf extension.

Microsoft executives declined to comment on the SUS delay or to say when the updates were expected to begin working.

The unexplained delay did not sit well with some Microsoft customers. "Maybe Microsoft is gently encouraging us to upgrade to WSUS by making our systems vulnerable longer if we use SUS," one user wrote in an SUS discussion forum Wednesday.

Source: Infoworld