News
Microsoft Releases Security Notices
- By Scott Bekker
- November 18, 1999
Microsoft has released updates on two recent security bulletins. On October 22, Microsoft released a bulletin on the availability of a patch that improves the randomness of TCP Initial Sequence Generators. Recently, however, Microsoft learned that the patch contains a regression error and, as a result, has removed it from the Microsoft Web site.
The patch is affected by the same error that was recently announced in Windows NT 4.0 Service Pack 6. The effect of the error is to prevent some applications from connecting to the server via Winsock unless run in an administrative context. The error is not associated with TCP Initial Sequence numbers, nor does it pose any security risk.
Microsoft has also announced a re-release of a patch originally announced on October 18. That patch was a workaround for a vulnerability that would allow a malicious Web site operator to read files on the computer of a user who had visited the site. Microsoft has completed a patch that completely eliminates the vulnerability. Microsoft Internet Explorer 4.01 and 5 are affected by the vulnerability. The patch is available at http://www.microsoft.com/msdownload/iebuild/jsredir/en/jsredir.htm. The IE 4.01 patch requires IE 4.01 SP2 in order to install. That is available at http://www.microsoft.com/Windows/ie/download/windows.htm.
About the Author
Scott Bekker is editor in chief of Redmond Channel Partner magazine.