Revised patch for Windows 2000 Server claims to finally plug hole

Microsoft has released a new version of its patch MS10-025, which aims to finally fix the vulnerability in Windows Media Services under Windows 2000 Server. Last week, the company was forced to withdraw the patch when it turned out that it failed to fix a remotely exploitable buffer overflow.

However, there is no easy way for users to test that the patch actually does what it says on the tin – illustrating the issues examined in the recently reignited discussion on full disclosure. Adherents of full disclosure generally publish demo exploits alongside information on vulnerabilities in order to demonstrate the problem in question. Such exploits allow users to determine whether a vendor patch actually fixes the vulnerability and whether workarounds work as promised.

See also:

• Microsoft withdraws placebo patch, a report from The H.
• Verizon claims full disclosure is the preserve of narcissistic "pimps", a report from The H.

(crve)