Feeds

MS fesses on silent security fixes

Shh! We're huntin' wabbits

Top 5 reasons to deploy VMware with Tegile

Microsoft has explained its rationale for quietly fixing some security vulnerabilities without issuing an associated bulletin.

Such "silent updates" have been happening for years, but have escaped much notice outside the small community of reverse engineers. Normally the bugs in question are close relatives of disclosed vulnerabilities that emerge during the verification of suspected security problems using fuzzing and other approaches.

Associated flaws can increase the security (or exploitability) rating of their publicly disclosed siblings, but don't necessarily earn a bulletin all to themselves or inclusion in the Common Vulnerabilities and Exposures (CVE) database.

Microsoft said it is not under any obligation to add the silent bugs to the database because the index is restricted to publicly disclosed flaws. Security bugs discovered during internal testing are not included in this category.

A blog posting by Gavin Thomas of Microsoft Security Response Center explaining the issue in greater depth can be found here. ®

Remote control for virtualized desktops

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.