Microsoft re-released two critical patches on Sept. 16 that were originally included in its Sept. 9 Patch Tuesday. MS08-054 and MS08-053 were both updated to include the Norwegian language update. MS08-054 fixes a hole in Windows Media Player 11 and MS08-053 fixes a hole in Windows Media Encoder 9 Series. (Information about those updates, and others from the September Patch Tuesday can be found here.)
Meanwhile, Symantec’s Vulnerabilities and Exploits blog noted a disturbing result of Microsoft’s patching process — the bad guys are waiting until Microsoft finds the holes, explains them, and are then moving in to attack. Patch Tuesday was Sept. 9 and included a widely discussed critical exploit, the GDI+ vulnerability, patched via MS08-053. A public exploit toolkit that took advantage of the GDI+ hole was released dated Sept. 10 and Symantec’s honeypots began picking up variants of the attack in the wild by Sept. 13. Moral of the story: enterprises can’t afford to wait even a week to apply patches.
Visit the Microsoft Subnet home page for more news, blogs, podcasts.More blog post from the Microsoft Subnet posts:
Microsoft partners with RIM one day after beefing up BlackBerry attack with Nokia partnership MS/Novell/Dell server bundle, what’s not to love?Under the hood of Hyper-V (master list of links). 10 questions for Windows Mobile expert Mort Rosenthal Subscribe to all Microsoft Subnet bloggers.bi-weekly Microsoft newsletter. (Click on News/Microsoft News Alert.)Sign up for the
