I’m flattered when folks say they don’t patch their systems until they read
my column, but this
month I’d rather you read Chris Mosby’s column first.
With all the unpatched issues that arise with IE,
it’s not enough to be “fully patched” with Microsoft’s latest fix (MS06-055), you also need
to install workarounds when you hear of them. Fixing recent Microsoft patches —
for example, the two-week-old MS06-049 — is also essential, as I describe below.
I thought all I needed to worry about this Patch Tuesday
was a Windows patch or two and an Office patch.
But it turns out to be essential that you redo August’s critical Internet Explorer and Server
Service patches on Windows 2003 and XP SP1.
I feel like telling everyone to print out today’s
Windows Secrets Newsletter and read it while you’re deploying this month’s patches.
Not only do we have a busy patch month, but the very first patch has many in the
industry thinking that we might see a full-scale, MSBLAST-like incident again.
There are products that need major patching this week, but they aren’t all from Microsoft.
We’re so used to Microsoft programs having security implications
if we don’t patch that we forget the many other software programs that can impact our systems.
If I were a gambler, there are two July 11 announcements (MS06-035 and MS06-036)
that I’d bet will bite people who fail to patch, generating headlines that you’ll
start seeing soon.
This month is also our last chance to say goodbye to Windows 98, 98SE, and Me. As of July 11, these Windows versions are no longer supported
With the June patches being so numerous
this month, even some folks who ordinarily patch quickly are just now getting around to patching.
But with proof-of-concept code and live exploits already on the Net for many of the
flaws announced on June 13, if you haven’t
yet updated, now’s the time to test and patch.
I believe in patching, sometimes even
if things get broken — because it points out that the software that broke was
probably written poorly in the first place.
But this time, there’s one patch I want you to make sure you select not to
install this month.
After our battle scars from the April
patches, Microsoft’s May patches were a bit of a breather for consumers.
While the Exchange patch meant homework for administrators, home users at least
had a break after the “double patch” bout we had in April. But
lest you think everything is rosy on the other side of the operating
system, even Apple folks had to deal with their share of patch pain this month.
Last month was rough for home patchers — and this month isn’t looking much
It seems like only a few days ago we were dealing with issues with Outlook
Express and Windows Shell. Here we are this month with another patch that so far
looks a bit tricky to get on our boxes, especially for home users without a patch-management adminstrator.
Here I was, looking for fallout from Microsoft’s Eolas/Internet Explorer patch
— but most of the issues came instead from other patches.
Just like everyone else, I was expecting most of the problems from Patch Tuesday
would be from 06-013. This is the cumulative Internet Explorer patch, which
changes the way Active X works. I wasn’t expecting to see issues in the Window
Shell patch, the Outlook Express patch, nor in OE’s Junk Mail Filter. These
issues, because they mostly affect consumers, have raised a concern about online
communities and self-help sites. I think they’re masking the real magnitude of