Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Microsoft's new warning about the old SQL server/MSDE problem
From: Blue Boar <BlueBoar () thievco com>
Date: Thu, 20 Mar 2003 19:12:50 -0800

Richard M. Smith wrote:
A friend of mine just received the attached email from Microsoft
advising him to patch his copy of MSDE.  Talk about closing the barn
door after the cows have already escaped......

Not neccessarily... when did he download the eval software? If it was after the worm came out, and he doesn't patch, he will still be vulnerable and get infected. MS has no way of knowing who has enough clue to know they need a patch for a piece of software they got 5 minutes ago.

You can maybe blame MS for making unpatched software available for general download. They can't do a lot about the CDs out there.

I for one would really like to see patches that also patch an installer image, so that when I install a piece of software on day x, it's current as of day x. As it is now, if I install some version of Windows, I have to patch it with a long list of fixes. If it's an older version of Windows, I also have to apply all the same patches again when I make a configuration change that causes a "new" feature to be installed.

Or maybe it's time to go forward with the dead man's switch for OSes.


Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]