Microsoft releases critical NT4 updates

[scuzzman]

THE MIGHTY purveyor of holy software, Microsoft has issued patches for two critical holes in Windows NT4, despite withdrawing support for the ancient but popular software.

Many users will be wondering why Vole is bothering to release security patches for Windows NT Server 4.0. It said that it would stop doing that in December 2004.

According to Microsoft, it is because its engineers had carried out the bulk of the work on fixing the vulnerabilities before the end of 2004 and so it had decided to release a security update for the operating system version as part of its security bulletin.

However, the company warned that it would not be doing this in the future although its website says:"We reserve the right to produce updates and to make these updates available when necessary."

The article (which can be found here) goes on to say:

Apparently, the patches relate to a problem with the ActiveX HTML help component in Internet Explorer. According the Vole website:"An attacker could exploit the vulnerability by constructing a malicious web page that could potentially allow remote code execution if a user visited that page. An attacker who successfully exploited this vulnerability could take complete control of an affected system."

Unfortunately, this has already been exploited. Redmond's a little late with this one - check this out here.