Microsoft has an updated advisory on the WMF vulnerability

I’ve had three people tell me they’re switching to a Mac this week, it’s not because of WMF necessarily but it’s probably the the straw that broke the camel’s back. That it’s going to be a week for an official patch is a pretty big black mark on Microsoft’s image, what if this exploit had come out immediately after last patch tuesday, would it have been a whole month instead of two weeks?

That’s the The Security Response Center Blog, the actual advisory doesn’t appear to have been updated.

I agree with Bob – this a serious setback to Micrsoft credibility on security and their own resposniveness. My blog catches some of the pundits reactions here . Not a good way to start the New Year in which Microsoft will face serious competitive thrusts from Appletel and Google (!???).

Ah, a write-only-by-MSFT blog. How handy! No easy way to leave a comment nor a way to see what others are going through.

I’m sure MSFT is afraid of the slashdot crowd posting “you sux0rz!” — but MSFT could implement a system to approve comments. That and requiring legit email account (don’t make me sign up for a .NET / passport account that I’ll never use) would be handy.

A re-thinking of the roll-out strategy might be called for. The “second Tuesday of the month” schedule was, I think, set to make it easier for corporate customers to plan updates, but this exploit will primarily affect consumers who are more likely to surf into bad sites or click links in spam emails. It should be made available as soon as it’s ready.

I stuck with Microsoft since 95, this last vulnerability and the Channel 9 interview with the kernel team and their misgivings about the registry….was the last straw for me. With Intel based Macs on the way,2006 will be the year that I will give Apple a serious try.

Jan 10th? Wow, rapid response there. Heh, I do notice you retreating to the ‘there is a fix coming, all I can say’. (I predicted such when you went on a big openness bang). Why if this was an airline passing out religious literature or a Lock Company not blogging, you’d go ballastic.

Just got done fixing (I hope) 2 machines chock full of spyware/malware rot, and both are SP2 fully-patched (P2P free) and loaded to the brim with protections, defs on all were sorta behind, but then these are End User machines, they don’t jump thru a dozen hoops to do such.

The recipe: Antispyware scanners (Lava, SpyBot), Webroot’s Spy Sweeper and Spyblaster (protector), Antivirus (AVG or whatever the End User already has), Anti-trojan(s), An anti-pop-upper that actually works, Peer Guardian 2, Rootkit scanner(s), a specialized Anti-keylogger, Clean up Internet files program(s), an IM protect and encrypt program, Blackice (it’s needed) and now an unoffical patch. Whew, did I miss anything? If you think that list is a tad redundant, I promise you, it is not. Spybot sees stuff Lava or SpySweeper doesn’t, and vice-versa.

Letmee guess, everything will be fixed in Vista? Yeah, something tell me I will have to cook up a new recipe for Vista.

Sure wish Apple had an Enterprise story with real marketshare, telling people to get Macs doesn’t work, not always, and fiddlesticks to the Linux zealots. I like (rather love) Redhat and all, but that won’t pull in the End User, sorry. But irony of ironies, Russell switches just in time for an wake-up call reminder of what he’s been missing.

This is bad. This is very, very, very bad. I’m a loyal, long-time Microsoft customer, and I consider this to be an unacceptably bad response time from the MSRC on making a patch available for what is a serious vulnerability. It’s pretty blatantly obvious that this is a *process* problem, not a technological problem. Microsoft can do better than this. This patch should be released before January 10th, even if it’s only the English version for XP SP2. Administrators and users will grudgingly accept multiple patches in a short amount of time, if necessary, but allowing them to go weeks without a patch while numerous machines get compromised is, quite simply, a poor business decision.

I agree that this is going to be a long week. There are quite a few exploit toolkits out there. What would it take to get Micosoft to release an out of cycle patch if this one doesn’t warrant it? Microsoft should do better than this mess but can they?

Two Microsoft crisis’es, least reducing the pointless rampant speculation over ‘Google Cube’.

Hah. Everyone will be pissed off until the 10th, Apple reveals new products on the 9th.

Should be fun.

Plus nothing like running up a new year and going into CES with this over your head. Anything Gates or Microsoft says will be overshadowed, and then hit with Apple spazz all over media, and now Scoble has flagged up Chinagate, as a new crisis. Man, do they need new Marketing drones or what? And HD-DVD talk? Please. That war is so lost, their arrogance won’t let them see it tho. Amd been monitoring the spolit sites, field day, and gif and jpg as “wmf” hacks anew. Long week indeed.

Christopher: Glad we give you something to talk about. Imagine if we were perfect? Then what would you do?

Christopher…I may be talking to some people about Apple’s enterprise solution. Email me and tell me what you need them to hear.

Well Robert if Microsoft were closer to perfect then we’d have shipping software to talk about rather than who jumped where, or the new P.R. clumsiness, or the latest patch coming out on an arbitrary schedule that benefits Microsoft more than customers…

I just heard from someone on the Windows OneCare beta, apparently it has been updated to protect users from the WMF exploit.

Now, is this how it’s going to be in the future? The paying subscribers to OneCare get ‘protection’ and everyone else gets to wait however long it takes for a patch to be released?

If so, that’s just sleazy, but nothing I haven’t come to expect from Microsoft lately.

Maybe we’ll all just have to start using windows every second Tuesday of the month to get it patched back up, and something else on the other days while we wait for the next patch.

Another HORRIBLE Microsoft response to security:

http://arstechnica.com/news.ars/post/20060103-5891.html

“For consumer products, security updates will be available through the end of the mainstream phase. For Windows XP Home Edition, there will be no security updates after 12/31/06.” Regarding paid support for problems unrelated to security patches, I was told that “Users who want to continue to receive support after the Microsoft assisted and paid support offerings have ended may visit the Retired Product Support Options Web site.”

January 10th?

Take your time.

Imagine if we were perfect? Then what would you do?

Cty? If perfect you’d be God. And if you were God, well I’d hafta worship. But thankfully that’s a hypothetical I never have to worry about, never ever.

PS – John will do…

Has anyone considered to use Hitman Pro (=free). With over eleven external antispyware progams it does everything for you.
It now has “added Hotfix concerning the WMF vulnerability. The hotfix is created by Ilfak Guilfanov. Untill Hitman detects an official patch from Microsoft, this hotfix is automatically installed. To undo this fix simply uncheck the corresponding checkbox on the Protection tab (Hitman Pro Configuration)”.
Look for it at http://www.hotmanpro.com

Sorry, it is http://www.hitmanpro.com of course.

An English manual for Hitman Pro can be found at:
http://xthost.info/hitmanual/

Extract from http://richi.co.uk/blog/2006/01/wmf-security-hole-take-action.html

“…Microsoft’s official position on what it calls ‘third-party patches’ amounts to: ‘It is a best practice to utilize security updates for software vulnerabilities from the original vendor of the software.’

Even Scobe seems to be toeing the party line.

However, as F-Secure points out: ‘Ilfak Guilfanov isn’t just anybody. He’s the main author of IDA (Interactive Disassembler Pro) and is arguably one of the best low-level Windows experts in the world.’

Be careful out there.”

I believe that MS should give money to all the people that can prove proof of purchase for Spyware/Malware removal/detection software that irradicated this problem. MS is just letting its Windows product die a slow and painful PR death by not deploying this fix in a timely manner.