Firms urged to use unofficial Windows patch

[Deja Q]

http://news.zdnet.com/2100-1009-6016649.html

Experts are advising corporations to use an unofficial patch to combat the latest Microsoft Windows Meta File exploit.

Antivirus vendor F-Secure and the Internet Storm Center, a volunteer security group, separately urged businesses on Tuesday to use the unofficial patch, as Microsoft has not yet offered an authorized fix for the problem.

Microsoft, though, has advised businesses not to use third-party updates, even though its own patch won't be available until next Tuesday.

Sigh.

[salvorhardin]

1. Since Ilfak Guilfanov's patch is freely available

Why doesn't Microsoft "rebrand" it and call it the official patch? :-)

[AntiCoup2K4]

2. They would only do that if they could sell it.

Kinda like they did with DOS.

[wtmusic]

3. Just a matter of time

before Microsoft engineers "think" of virtually the same patch.

[Terre]

4. Since Ilfak's web blog is down

due to server overload, CastleCops is helping to set up a new site, in addition to mirrored sites for the download.

Here's a link to the post where they're discussing it:
http://castlecops.com/t143195-Problems_accessing_hexblog_com_Use_this_coral_cache_link.html

And here's a link to CastCops Hexblog Main forum:
http://castlecops.com/f212-Hexblog.html

Whether firms take him up on the offer is obviously up to them, but frankly, I wouldn't want to be in their shoes if they encounter major problems only because they're reluctant to do anything proactive just because MS considers it "unofficial".

As for me, after all I've researched, there are enough respected people and sources to vouch for this temporary patch.

[salvorhardin]

5. I agree

When SANS validated it on New Year's day that was the closer for me.
http://isc.sans.org/diary.php?storyid=994