Microsoft Releases Security Update

From: MicrosoftReleasesSecurityUpdate (
Date: 07/03/04

Date: Sat, 3 Jul 2004 12:54:58 -0700

Microsoft Releases Security Update
Jul 2, 2004

(Associated Press) - Microsoft Corp. (MSFT) issued an
interim security update Friday to protect users of its
nearly ubiquitous Internet Explorer browsers from a new
technique for spreading viruses.

The update does not entirely fix the flaw that makes the
spread possible, but it changes settings in Windows
operating systems to disable hackers' ability to deliver
malicious code with it.

The security measure came in response to last week's
discovery of a computer virus designed to steal valuable
information like passwords. Though its outbreak was mild,
security experts said the technique for spreading it was
novel and could be used to send spam or launch broad
attacks to cripple the Internet.

Hackers had converted hundreds and possibly thousands of
Web sites into virus transmitters by first hiding
malicious code using a vulnerability with Microsoft's
software for operating Web sites. A fix for it had been
issued in April but was not universally applied.

Two other flaws in Microsoft products allowed hackers to
direct Internet Explorer browsers to automatically run the
virus when visiting an infected site.

Though one of those flaws remains unfixed, Friday's
setting changes thwart any attack by prohibiting a Web
application from writing files - such as the virus code -
onto users' computers.

The U.S. Computer Emergency Readiness Team urged computer
users to install the update, saying it would greatly
increase protection. But the advisory warned other types
of attack remain possible.

Stephen Toulouse, a security program manager at Microsoft,
said the company still was working on a comprehensive
patch to fix vulnerabilities with Internet Explorer, but
the settings change should protect users from the
immediate threat.

The software update covers Windows XP, Windows Server 2003
and Windows 2000, and Microsoft was working on ones for
older systems.

The update will also be included with a major Windows XP
upgrade, called Service Pack 2, later this summer.
Toulouse said the Service Pack will include additional

After installing Friday's update, users should be able to
lower their security settings from the "high" one
initially recommended as a stopgap, he said.

Russ Cooper, a senior researcher at TruSecure Corp.,
welcomed Friday's update, but said it should have come
sooner than a week.

"It would have taken a couple of hours to put it together
as a package, and (the testing) process can take a day or
two," Cooper said.

But Toulouse said that given the broad user base for
Windows and Internet Explorer, even a problem affecting
less than 1 percent of users potentially hurts millions of

He said the settings could potentially affect legitimate
applications used internally by Web developers and
corporate networks, and special instructions were
available to address those cases.

The update will be automatically installed if computers
are set to receive it. It is also available at

Microsoft shares fell 6 cents to close at $28.57 Friday on
the Nasdaq Stock Market.

On the Net: