Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Microsoft's Tying IE Changes In Security Patch Sparks Backlash

By packaging a functionality change for Internet Explorer with a needed security update, Microsoft has alienated some IT pros, security vendors complained Wednesday.

Along with the 10 patches in Tuesday's MS06-013 security bulletin, Microsoft bundled changes to IE's handling of ActiveX controls. Those changes, which were prompted by a 2003 $521 million judgment against Microsoft in a patent lawsuit brought by Eolas Technologies Inc. and the University of California, will require users to manually activate controls on some sites.

"Microsoft often bundles non-security-related code in security updates," said Mike Murray, director of research at vulnerability management vendor nCircle. "Little optimizations and that kind of thing. But I don't remember them ever bundling a functionality update or, as in this case, removing functionality, with a security bulletin."

The inclusion of the ActiveX changes "makes everything a mess" for companies deploying and testing Microsoft's monthly patches, Murray said. "I've talked to some of our customers, and they're at the point where they're pulling out their hair.

Instead, Microsoft should have separated the IE ActiveX changes from the security fixes. "They easily could have deployed it as a separate patch or rolled it into a service pack," said Murray.

  • 1