full-disclosure - Microsoft's new warning about the old SQL server/MSDE problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: BlueBoar at thievco.com (Blue Boar)
Subject: Microsoft's new warning about the old SQL
 server/MSDE problem

Richard M. Smith wrote:
> A friend of mine just received the attached email from Microsoft
> advising him to patch his copy of MSDE.  Talk about closing the barn
> door after the cows have already escaped......

Not neccessarily... when did he download the eval software?  If it was 
after the worm came out, and he doesn't patch, he will still be vulnerable 
and get infected.  MS has no way of knowing who has enough clue to know 
they need a patch for a piece of software they got 5 minutes ago.

You can maybe blame MS for making unpatched software available for general 
download.  They can't do a lot about the CDs out there.

I for one would really like to see patches that also patch an installer 
image, so that when I install a piece of software on day x, it's current as 
of day x.  As it is now, if I install some version of Windows, I have to 
patch it with a long list of fixes.  If it's an older version of Windows, I 
also have to apply all the same patches again when I make a configuration 
change that causes a "new" feature to be installed.

Or maybe it's time to go forward with the dead man's switch for OSes.

						BB