AplusWebMaster
Topic Starter
FYI…
- http://www.techweb.com/article/printableAr…_section=700028
April 12, 2006
"By packaging a functionality change for Internet Explorer with a needed security update, Microsoft has alienated some IT pros, security vendors complained Wednesday. Along with the 10 patches in Tuesday's MS06-013 security bulletin, Microsoft bundled changes to IE's handling of ActiveX controls. Those changes, which were prompted by a 2003 $521 million judgment against Microsoft in a patent lawsuit brought by Eolas Technologies Inc. and the University of California, will require users to manually activate controls on some sites… The inclusion of the ActiveX changes "makes everything a mess" for companies deploying and testing Microsoft's monthly patches, Murray said. "I've talked to some of our customers, and they're at the point where they're pulling out their hair"… Microsoft has posted a "compatibility patch*" to delay the court-mandated changes to IE until June 13, that month's scheduled bulletin release date, when the changes will be made permanent… In an alert to users of its DeepSight Threat Management System, Symantec advised enterprises to either update or consider dropping IE. "The DeepSight team strongly encourages system administrators to apply the fixes in this update as soon as possible," the alert read… Symantec and other security companies raised the alert in part because 3 of the 7 critical flaws described in the bulletin are either currently being exploited or have been the target of published proof-of-concept code…"
* http://support.microsoft.com/default.aspx/kb/917425?
- http://www.techweb.com/article/printableAr…_section=700028
April 12, 2006
"By packaging a functionality change for Internet Explorer with a needed security update, Microsoft has alienated some IT pros, security vendors complained Wednesday. Along with the 10 patches in Tuesday's MS06-013 security bulletin, Microsoft bundled changes to IE's handling of ActiveX controls. Those changes, which were prompted by a 2003 $521 million judgment against Microsoft in a patent lawsuit brought by Eolas Technologies Inc. and the University of California, will require users to manually activate controls on some sites… The inclusion of the ActiveX changes "makes everything a mess" for companies deploying and testing Microsoft's monthly patches, Murray said. "I've talked to some of our customers, and they're at the point where they're pulling out their hair"… Microsoft has posted a "compatibility patch*" to delay the court-mandated changes to IE until June 13, that month's scheduled bulletin release date, when the changes will be made permanent… In an alert to users of its DeepSight Threat Management System, Symantec advised enterprises to either update or consider dropping IE. "The DeepSight team strongly encourages system administrators to apply the fixes in this update as soon as possible," the alert read… Symantec and other security companies raised the alert in part because 3 of the 7 critical flaws described in the bulletin are either currently being exploited or have been the target of published proof-of-concept code…"
* http://support.microsoft.com/default.aspx/kb/917425?
