MS09-054: Cumulative security update for Internet Explorer

External Since: Jun 18, 2009 Posts: 116

Jeff Richards wrote:
> "Greg" <invalid RemoveThis @invalid.net> wrote in message
> news:7kho00F31quv1U1@mid.individual.net...
>> snip <
>>
>> Jeff,
>> No offense is meant to MEB or anyone else. I am trying to be nice
>> here.
>>
>> I did understand your post.
>>
>>
>> Greg
>>
>
> Thanks for confirming that, but I had pretty much taken that for granted, as
> the point was not complicated, namely that the statement I quoted was simply
> incorrect. I have not commented at all on whether or not it is sensible or
> useful to install this particular patch - others have done that more than
> adequately.

No your statement was wrong. The files BEING DISCUSSED require the full
NT OS to function properly and fully. IT SAYS:
"to accomplish the goal."

Let me refresh your memory one more time:

You wrote:
"MEB" <MEB-not-here RemoveThis @hotmail.com> wrote in message
news:eWXPrtRUKHA.4704@TK2MSFTNGP02.phx.gbl...
> > snip <
> > It *MAY* contain a fix
> > [within that file], but that also requires *ALL* the other files and
> > their fixes to accomplish the goal.

That statement is completely incorrect. It is quite feasible, and in fact
quite common, that a change to a single file provides protection
against the
exploit.

It is unfortunate that you react in such an emotional manner to anyone who
attempts to clarify what you are trying to say, because some of your
comments are correct.

For instance, it is possible that the files that _can_ be installed are not
the files that needed to be changed to protect against the exploit. It is
possible that the exploit exists in W98 regardless of whether the files are
patched or not, because W98 does not contain the features that the patch
relies on in order to provide the claimed protection. It is possible that
the patches are irrelevant for W98 because the vulnerability never existed
in the first place. There are, in fact, a wide range of possibilities.
But
that message is lost in your rudeness and name-calling. And your statement
that I have quoted above is just plain wrong.
----

I wrote:

Jeff Richards wrote:
> > "MEB" <MEB-not-here RemoveThis @hotmail.com> wrote in message
> > news:eWXPrtRUKHA.4704@TK2MSFTNGP02.phx.gbl...
>> >> snip <
>> >> It *MAY* contain a fix
>> >> [within that file], but that also requires *ALL* the other files and
>> >> their fixes to accomplish the goal.
> >
> > That statement is completely incorrect. It is quite feasible, and
in fact
> > quite common, that a change to a single file provides protection
against the
> > exploit.
> >
> > It is unfortunate that you react in such an emotional manner to
anyone who
> > attempts to clarify what you are trying to say, because some of your
> > comments are correct.
> >
> > For instance, it is possible that the files that _can_ be installed
are not
> > the files that needed to be changed to protect against the exploit.
It is
> > possible that the exploit exists in W98 regardless of whether the
files are
> > patched or not, because W98 does not contain the features that the
patch
> > relies on in order to provide the claimed protection. It is possible
that
> > the patches are irrelevant for W98 because the vulnerability never
existed
> > in the first place. There are, in fact, a wide range of
possibilities. But
> > that message is lost in your rudeness and name-calling. And your
statement
> > that I have quoted above is just plain wrong.
> >
> >

Really, so where is your information which provides the argument to
back your statement?

You ARE correct the vulnerabilities may not even exist [most relate
directly to issues within the NTs AND other updates {such as system}
which do come into play during the usage], you are incorrect or
misleading when trying to indicate that other files from the NTs are not
necessary to provide full security functionality. Nor have you even
remotely addressed the issue of IE6 incompatibility within 9X to start with.

And cram the emotional garbage back where it belongs... I respond as
needed. You apparently do as well, don't you... so FO.
---

For the FULL fix for which these files are to be used for REQUIRES the NTs.

NO? Let's let Pa Bear make the clarifying comment then:

"Horse hockey! KB974455 applies to IE6 SP1 running in Windows 2000
*SP4* (only), WinXP SP2 or SP3 (only), and Win2003 SP2 (only).

<QP>
It should be a priority for customers who have older releases of the
software to migrate to supported releases to prevent potential
exposure to vulnerabilities.
</QP>
Source: http://www.microsoft.com/technet/security/bulletin/MS09-054.mspx
(FAQ)

-----

NO WHERE does MS recommend installation in 9X, nor has MS tested for
any applicability or security fixes or anything else for that matter
related to 9X applicability or functionality... ANY statement of
applicability and install ability, AND usage recommendation within 9X
FOR ANY REASON, requires *careful testing* to ensure that there are NO
incompatibilities, the fixes actually work, and IN PARTICULARLY, that
they introduce no NEW vulnerabilities.

Now where is YOUR clarification?

Better still, provide links to the materials which PROOF these
necessary aspects in Win9X OSs.

--
MEB
http://peoplescounsel.org/ref/windows-main.htm
Windows Info, Diagnostics, Security, Networking
http://peoplescounsel.org
The "real world" of Law, Justice, and Government
___---

External Since: Mar 24, 2009 Posts: 16

Are you really now going to try and claim that your blatantly incorrect
statement only referred to the files currently being discussed? Go back and
read what you wrote. Your statement, and my disagreement with it, was
clearly a generalisation across any patch ever released for a vulnerability.
That's why it's such as fatuous remark. If you didn't mean to say that,
then you could have pointed it out immediately. You didn't - in fact your
response emphasised that your claim applied in general. Or is the reason
that you didn't point it out is that you have only just realised what a
ridiculous claim it is, and you are now searching for a way to back away
from it?

And if you want to educate yourself as to why it is so incorrect, do this.
Look up "security patch" and "buffer overflow" or similar. Look for the
Windows 2000 examples, because these are most common. Look for cases where
the patch included adding a 'get required buffer size' function - there's
plenty of them. These are the cases where a change to one DLL fixed a
problem in a whole series of other modules. It means that, even though those
other modules were updated and were included in the patch, certain ones that
already included a checked buffer _do_not_have_to_be_installed for the patch
to be effective.
--
Jeff Richards
----------------------------------------

"MEB" <MEB-not-here RemoveThis @hotmail.com> wrote in message
news:Ol1uHsUVKHA.3720@TK2MSFTNGP04.phx.gbl...
> snip <
>
> No your statement was wrong. The files BEING DISCUSSED require the full
> NT OS to function properly and fully. IT SAYS:
> "to accomplish the goal."
>