Redmond pulls critical update

Posted on 12 Sep 2005 at 12:30

Microsoft is breaking its monthly cycle of security updates - there will be no release this Tuesday, covering the month of September, despite having previously flagged the presence of a 'critical' vulnerability.

Traditionally, the second Tuesday of each month sees Microsoft batching together any Windows security updates, rather than releasing them piecemeal. But it seems that the company is concerned about the quality of the patch that was being prepared, and no update will appear tomorrow.

In the security team's blog, Microsoft's Mike Reavey explained: 'Late in the testing process, we encountered a quality issue that we decided was significant enough that it required some more testing and development before releasing it.'

In a now updated Security Bulletin Advance Notification, Microsoft announces: 'This update release process involves a significant testing focus to help ensure customers will receive updates that are of a high quality and Microsoft will not release an update until it meets those standards.'

Microsoft is caught between a rock and a hard place. To release a patch that is not fully effective or that itself might require further patching would be damaging to its credibility. The trouble is, however, that an advance warning for system administrators had already been given about a 'critical' patch - people will be aware that vulnerability exists but not be in a position to remedy it. Details of the 'flaw' have not been officially released.

However Reavey pointed out that the September bulletin will still go ahead: 'We are going to issue an updated version of the Malicious Software Removal tool next Tuesday along with one non-security, high priority update for Windows.'

Author: Alun Williams