Threat Level: green Handler on Duty: Russ McRee

SANS ISC: Errata, Mea Culpa, "latest" "Date released" and "Date Published" - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Errata, Mea Culpa, "latest" "Date released" and "Date Published"
The Handlers Diary of September 24th 2005 concerning IE 6 SP1 and Direct X downloads Published: 2005-09-24, Last Updated: 2005-09-24 22:37:53 UTC by Adrien de Beaupre (Version: 1) was a result of my reporting what MS describes as the "latest" "Published" security updates to Adrien. After he was kind enough to post what I thought was new MS security information, I remembered that I had once before made the mistake of interpreting Microsoft information as indicating new when in fact they were not just "Published" or not just "released". Unfortunately I didn't jump through to the digital signatures to determine the actual date's issued. So Adrien, I apologize for sending in un-vetted information that caused you and some readers problems. And I thank the Diary readers who took the time to determine the actual date's issued and point out the errors to me.

"Release date" and "Date Published" and "latest" as used by MS on their "Download Center" and as a result of going through their "Microsoft Download Notifications" email service are useless in determining currency. Take the additional steps and check the digital signature dates and research some more and you'll know if they're needed in your environment.

Reader clue Submission;

We had some posts pointing out that these were not "new" items, one submission (they requested anonymity) said it best;

"1. the ie6sp1 for non-xp sp2 systems that you say it is new..the file date&time it may well be, but the digital signature date for the file that i downloaded from that link says it was signed on May 3rd 2004 !!! so its an old one.

Maybe the file date was modified on the download server, but the  says otherwise.

2. same with the dx8 file.. this one is even older

the digital signature says it was created on August 8th 2003, even older!

please check the digital signatures in the future before posting announcements."


Thank you "anonymous", next time I'll be sure to remember that.

Exculpatory information

The Microsoft's Download Center's "Release Date" for the Diary items said;

"Internet Explorer 6 Service Pack 1 Release date 9/21/2005" and "Security Fix for DirectX 8 (KB819696) Release date 9/22/2005".

When you click the download link for the details of each Download Center item, the download "Date Published" information says;

"Internet Explorer 6 Service Pack 1 Date Published:  9/22/2005" and goes on to say:
"Quick Description:
Internet Explorer 6 is the set of core Web browsing technologies in Windows XP. These core technologies have recently been updated as part of Windows XP Service Pack 2 (SP2) with Advanced Security Technologies". And I assumed (I know ....) that MS had updated IE running on XPSP1 with IEXPSP2 security technology.... No other clueful information there.

Moving on, the "Security Fix for DirectX 8 on Windows 2000, Windows ME, Windows 98 SE, and Windows 98 (KB819696)" says "Date Published:  9/22/2005". Again, there's no other clueful information there.

On "Latest" and Published"

In addition,  when you receive the "Microsoft Download Notifications" email service (in this case September 23, 2005") and click it's links for the "latest" you get the same date items as above. The "Notifications" email is "a free weekly mailing that provides you with the latest drivers, trial software, service packs, and other downloads from the Microsoft Download Center. Listed below are downloads published in the Download Center in the past week, in the categories that you have chosen*".

In summary "Date released", "Date Published" and "latest" have nothing to do with currency.

I did contact MS about this but I'm having problems understanding where to go from here. Encyclopedia? Susan Bradley, ( ; ^ ) Susan!

Other;

"Release date" use;
"Earnings Release Date Set"
http://moneycentral.msn.com/investor/alerts/glossary.asp?TermID=2

"Date Published"
http://www.cgpublisher.com/CGOntology/CGDatePublished

Patrick Nolan ( ; ^ )
Patrick

193 Posts

Sign Up for Free or Log In to start participating in the conversation!