full-disclosure - The new Microsoft math: 1 patch for 14 vulnerabilities, MS04-011

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: support at mmicman.com (Edward W. Ray)
Subject: The new Microsoft math:  1 patch for 14 vulnerabilities, MS04-011

I would not mind the bunching, except that many of the vulnerabilities were
discovered more than 4-6 months ago.  The other Oses release patches much
more quickly.  What if someone other than Eeye with an axe to grind
discovered these flaws before Microsoft decided to patch them? 

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Roman
Drahtmueller
Sent: Wednesday, April 14, 2004 7:36 AM
To: full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] The new Microsoft math: 1 patch for 14
vulnerabilities, MS04-011

>  
> I use Linux, OpenBSD and Windows in my enterprise.  Linux and OpenBSD 
> use the "1 patch for 1 vulnerability" rule.  Seems to me that MS is 
> bunching their patches together in order to make it seem on the 
> surface that Windows has less patches than other Oses, therefore it is 
> more secure.  CIOs, take note.

It happens from time to time (today...) that several bugs get fixed with one
update package on SUSE Linux (and other Linuxes). But: One update package
fixes one package, whereas one patch can consist of several update packages
(in our patch management framework).

After all, it is a matter of transparency if you can manually, individually
select what update package you want on your system and which not. Probably
even more important: You should also be able to see what _changes_ have been
applied to every single update package. Otherwise, you just can't know what
else has been "fixed"...

Regards,
Roman.
-- 
 -                                                                      -
| Roman Drahtm?ller      <draht@...e.de> // "You don't need eyes to see, |
  SUSE Linux AG - Security       Phone: //             you need vision!"
| N?rnberg, Germany     +49-911-740530 //           Maxi Jazz, Faithless |
 -                                                                      -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html