Bugs, Old File Dates in New Microsoft Patches

The Cumulative Security Update for Internet Explorer, which addresses numerous security flaws in Internet Explorer 6, introduces bugs involving the scrollbar. After the patch is applied, the page scrolls up or down twice when the user clicks once in the empty areas of the scrollbar. Clicking on the scrollbar arrows or dragging the scrollbar thumb works correctly.

This problem has been reported in Microsofts public support newsgroups, and we have confirmed it ourselves. According to the Microsoft "MVP" monitoring the newsgroup, Microsoft is aware of the problem.

We have also confirmed two other problems with the patch reported in the same newsgroups. When the scrollbar is clicked, text selected on the page is deselected. Also, the window resizeBy, resizeTo, moveBy or moveTo functions generate an "Access Denied" error that didnt appear before the patch.

Although the patch for the flaw titled "Buffer Overrun in Microsoft FrontPage Server Extensions Could Allow Code Execution," released on Nov. 11, has been rated "Critical" by Microsoft, the dates of the files composing the patch indicate that it was completed some time ago.

The various versions of the patch, for different products and versions of Windows that contain the FrontPage Server Extensions, all contain multiple files with various dates, but in all cases the only recent files are related to the patching installation code and not the patch itself. The patch file for Windows XP is dated Aug. 6, 2003, while the SharePoint Team Services version is dated Jan. 21, 2003. Atypically for patch descriptions such as this, the file descriptions in the Security Update Information section do not contain file dates.

We contacted Microsoft for comment on these reports, but the company has not yet responded.