Microsoft’s December “Patch Tuesday” to unleash fixes – but why no Word patch?

Alex Zaharov-Reutt
Monday, 11 December 2006 10:02

Your IT - Entertainment

Microsoft is releasing six patches along with an update to their Malicious Software Removal Tool. But with hackers already taking advantage of an unpatched Word flaw, why is Microsoft delaying the repair of this critical flaw?

Ah, good ol’ Microsoft. Looking after its own interests as usual, and not those of their consumers. One of the reported patches in the upcoming Patch Tuesday is meant to fix a flaw in Windows Media Player.

It always seems like whenever there’s a flaw that can affect the safety and reputation of the Windows Media Player, software that is inextricably linked to Microsoft’s digital rights management programs, a patch is ultra quick to emerge.

But when Microsoft’s software cash cow of Word has a major flaw that is already being actively exploited… consumers have to wait.

This is a ridiculous situation, especially considering the amount of spam that comes with attachments. I’ve already been receiving ‘invoices’ and ‘remittance statements’ in PDF format, with extremely convincing looking emails, replete with email signatures copied from legitimate businesses that look totally legit.

Were I not incredibly aware of the scamming spammers and their tricks, I might have opened up the PDF in question to have a look. Were my Adobe Acrobat not the latest version that has been fixed to render the latest PDF security flaws useless, I could easily have been infected.

If dodgy PDFs are being sent around, what is to stop dodgy Word documents being sent around in exactly the same manner? Precisely nothing. Nothing at all.

Microsoft, we all appreciate that it takes effort to create the fixes and updates that fix the security holes you accidentally programmed into your own software, and we all appreciate that the patches are made available and can be automatically downloaded and installed.

Sure, you’ll fix this issue. But we need this fix NOW! Otherwise don’t expect us to believe you when you say that you are taking security seriously when you’ve clearly ignored already exploited security holes in your most popular software.