Microsoft Vista patches 20 security flaws

By Joris Evers Staff Writer, CNET News.com -->
Published: February 13, 2007, 12:54 PM PST


Microsoft on Tuesday released fixes for 20 vulnerabilities in a variety of products including Windows, but none of the operating system flaws affect Vista.
The fixes arrived in a dozen security bulletins, released as part of Microsoft's monthly patch cycle. Six of the alerts were tagged "critical," the company's most serious rating. These flaws could enable an attacker to gain complete control over a vulnerable computer with no action, or minor action, on the part of the user, Microsoft warned.
The critical vulnerabilities are in Windows, Internet Explorer, Office and in Microsoft security tools such as Windows Live OneCare and Windows Defender. None of the Windows or Office flaws affect Vista or Office 2007, Microsoft's latest updates. However, Windows Defender ships as part of Vista, so the new operating system is at risk from that direction.
Microsoft used its February patch day to clear a backlog of "zero-day" flaws, or security holes that have been publicly disclosed but not fixed. Seven of the 20 vulnerabilities addressed by Tuesday's bulletins were zero-days, and five of those were in Office applications. Microsoft planned to issue patches for the Office zero-day bugs last month, but postponed their delivery.
Most of the Patch Tuesday flaws are only potentially harmful if people with vulnerable PCs visit a malicious Web site or open an infected document. For example, the Microsoft security tools could be compromised when they scan a rigged PDF file, according to the company's advisory.
The updates will be pushed out to Windows PCs that have enabled Automatic Updates. They are also available for manual download from Microsoft's Web site.

More buyers home in on Office 2007

By Dawn Kawamoto Staff Writer, CNET News.com -->
Published: February 12, 2007, 4:11 PM PST

Sales of Office 2007 were substantially better than those of Office 2003 during the first week of its launch, according to a study comparing retail figures for both products.
In the first week of its launch in late January, Office 2007 unit sales exceeded first-week sales of Office 2003 by 108.3 percent, according to a preliminary report released Monday by the NPD Group, a consumer and retail trade researcher.
While the average selling price for Office 2007 declined 1.1 percent to $206.93, the dollar volume jumped by 106.3 percent compared with Office 2003, the report noted.
"Unit shipments grew faster than dollars," said Chris Swenson, NPD director of software industry analysis. He noted that sales of the cheaper Home and Student editions of Office contributed to the dip in average selling price.
NPD, however, said its preliminary figures are conservative, given that one participating retailer in its survey did not supply its information in time to be considered for the report.
Office 2007 commercial unit sales, meanwhile, climbed approximately 61.3 percent during its first month of sales, compared with Office 2003 in its first month, the report noted. The new version of Office was released to business customers in November.
Dollar volume rose 97.8 percent in the first month of Office 2007 commercial sales to value-added resellers, compared with the first month of Office 2003, the report noted. And the average selling price rose 22.6 percent over Office 2003 to $301.33 in its first month of sales.
"The Office 2007 launch was extremely successful, no matter how you look at it--whether it's the weekly or monthly sales," Swenson said.
He added that the launch performance of Office 2007 and Vista came as a surprise to him.
"With almost zero advertising and marketing until the January 30, 2007, retail launch, I expected U.S. commercial license sales of Office 2007, as with Windows Vista, to be significantly below the sales of the previous version in its first full month on the market," Swenson
said. "They weren't. Sales of Office 2007 were significantly better."


POST Correction: Due to incorrect information provided by NPD Group, the original version of this story misidentified the sales period focused on by researchers and mischaracterized first-week sales results for Office 2007 and Office 2003.