It only affected Windows 2000. So far it has shown a very limited impact -- we're not seeing any widespread impact to the Internet, but we remain vigilant. |
Our test and engineering plan for that update that we began two weeks ago is on track to have that update ready for Tuesday. |
Security researchers provide a valuable service to our customers in helping us to secure our products. We want to get face to face with them to talk about their views on security, our views on security, and see how best we can meet to protect customers. |
Should MS05-018 have been a more complete update to address the underlying vulnerable function? Yes, Cesar is right. But I want to reiterate that MS05-018 did protect against the issue that was brought to us, |
The huge responsibility we have is that we have to answer to our customers, and our customers represent potentially hundreds of millions of different configurations. |
The key thing is really that we want to make people understand the risk with these flaws and that they enable automatic updates. |
The maximum total severity rating for this month is Critical, so please update systems as soon as possible when the bulletin is available this coming Tuesday. |
The MSRC is constantly monitoring the threat environment for any malicious activity. We are keeping an especially close eye on the newsgroups and vulnerability lists for exploits related to this month's activities and will mobilize immediately to help protect customers against threats as necessary. |
There might be privately reported issues that end up being in that update that haven't been disclosed yet. When we put out the bulletin, we talk about the information in the vulnerabilities … with a beta, how does that work exactly? Do you put out a kind-of-a-bulletin? |
There's been some speculation that ... this trigger was somehow intentional. That speculation is wrong. |
There's been some speculation that you can only trigger this by using an incorrect size in your metafile record and that this trigger was somehow intentional. That speculation is wrong on both counts. The vulnerability can be triggered with correct or incorrect size values. |
This is why it takes so long, but that's not to say that if there's an exploit, we won't accelerate testing and get it out there as fast as we can. But if we find problems in the testing phase, it could trigger a restart and cause even more delays. |
This situation is now resolved and customers should be able to get the update. I want to reiterate that the problem had nothing to do with the update itself, you applied it manually from the download center or got it through SUS 1.0 it should install correctly and protect against the vulnerability. But it's available now for everyone. |
We can't leave anybody behind. And unfortunately you might be introducing new problems. So whenever we look at even a quick hack ... it's got to be of quality. That's what customers have told us time and again. |
We had been looking into detailing the history anyway and some customer questions drove the idea to write it up. We just wanted to make sure people had the history. |