Microsofts recent set of security patches is causing problems, namely for Internet Explorer 6 users, who are watching their browsers crash midstream when visiting some sites. Redmond has offered a technical workaround to solve the problem until a more formal fix can be developed.
"First, I want to note the security update does protect against the vulnerabilities noted in the bulletin," Kieron Shorrock, Microsoft Security Response Center (MSRC) program manager responsible for Internet Explorer, wrote in the MSRC blog. The Internet Explorer patch fixes four critical vulnerabilities in the browser, making it the most important of Decembers Patch Tuesday updates.
Shorrock said Microsoft has been working with a "small number" of customers who reported issues related to the browser resulting from the update described in security bulletin MS07-069. The problem generates a message that reads, "Internet Explorer has encountered a problem and must close." The bug is not widespread, according to Microsoft, and only affects certain installations of Internet Explorer 6 on Windows XP.
LARGE-SCALE ISSUE?
While Microsoft downplayed the bug, Paul Zimski, senior director of market strategy at Lumension Security, called the Internet Explorer problem a large-scale issue. The problem, he said, illustrates that the patch-management process is not one that administrators should treat as a checklist item.
"Microsoft has yet to issue a fix, and its temporary workaround does not guarantee to correct the problem. Uninstalling the patch is also not an ideal solution because it will leave a tremendous number of machines vulnerable," Zimski said.
"To avoid similar issues in the future," Zimski went on to say, "we recommend that organizations deploy solutions for developing customized, home-grown patches and other hot fixes as an added layer of protection against vulnerabilities in case vendor-issued patches do not work correctly."
INTERNET EXPLORER 8 BETA
Meanwhile, Microsoft developers are working on Internet Explorer 8. The company said the beta is due out in mid-2008. Microsoft developers achieved a significant milestone last week, passing the Acid2 browser test, which determines how well a browser adheres to Web standards.
"Showing the Acid2 page correctly is a good indication of being standards-compliant, but Acid2 itself isnt a Web standard or a Web standards compliance test," Dean Hachamovitch, the general manager for the Internet Explorer team, said in a blog post. "The publisher of the test, the Web Standards Project, is an advocacy group, not a Web standards defining body."
Still, many people consider the Acid2 test an important one. With Internet Explorer 8 successfully passing the test, it might mean that developers wont have to spend as much time adjusting their Web sites to work with multiple browsers. Of course, Hachamovitch noted, this is only one of several milestones for interoperability, standards compliance, and backwards compatibility that Microsoft has committed to for this release.
