Microsoft Issues First Patches For Vista

Microsoft confirmed Tuesday that two of the 12 security bulletins issued last week affect Windows Vista Beta 2, the widely-used preview, and posted download instructions for the first security updates to its next-generation operating system.

"We are committed to releas[ing] Windows Vista updates for all MSRC [Microsoft Security Response Center] critical class issues that may arise during the beta testing period," wrote Alex Heaton, product manager for the Windows Vista security team, on the group's blog.

Out of the dozen bulletins released Aug. 8, two -- MS06-042 and MS06-051 -- impact Vista Beta 2. "Of the seven critical Windows updates released in August, only 2 also affect Windows Vista Beta 2 or later," said Heaton.

MS06-042 is a cumulative security update for Internet Explorer that included patches for 8 different vulnerabilities; MS06-051 detailed a fix for a flaw in the Windows kernel that might let attackers hijack PCs by drawing users to malicious Web sites.

Neither bulletin, however, yet offers details on Vista Beta 2, nor even mention the operating system as among those impacted. The only explanation came from Heaton. "Microsoft does not include information about beta products in formal security bulletins." The company did not immediately respond to follow-up queries about how it released the Vista vulnerabilities' patches and why it chose to deliver them sans details.The download sites for the updates -- this link is for the IE 7 fix, this site for the kernel patch -- also lack the information normally posted by Microsoft in its security bulletins' FAQs.

"We really should have been told about these Vista vulnerabilities last week," said Michael Cherry, an analyst at Redmond, Wash.-based Directions on Microsoft. "Microsoft should have told us then that Vista needed to be patched, too."

Vista is in beta, Cherry acknowledged. "On one hand, it's not a supported release and people are supposed to take the appropriate cautions, and not put it into a production environment. But you can't test it that way. And this is a very wide beta."

More worrisome, said Cherry, is that Vista, even in beta, faces a much different security landscape than the last-released desktop client OS, 2001's Windows XP. "Then, if you put a beta on a machine, someone might get to it and, say, deface a Web site," Cherry said. "Minor stuff. But now it's just as likely that they'll try to turn these Vista machines into zombies.

"The [security] environment has changed. I'm very nervous about using Vista Beta 2 like this because the [security] situation's changed."Microsoft's Heaton, meanwhile, told Vista Beta 2 users that update support will end as soon as the preview's successor -- to be dubbed Release Candidate 1, or RC1 -- appears. "Updates will no longer be released for Windows Vista Beta 2 after RC1 has been released, and updates for pre-release versions will not be released after Windows Vista has released to manufacturing."

Whatever information Microsoft decides to provide on future security vulnerabilities within Vista will be posted to the support document tagged as "921583" and available here. In that document, Microsoft recommended users apply the updates "immediately."