Microsoft -- No security bulletins for December

From Technet webcast event email update

Thank you for your interest in tomorrow's December 10, 2003, Technet Security Webcast: "Information about Microsoft's December Security Bulletins" – THIS EVENT HAS BEEN CANCELLED due to the fact that Microsoft currently has no security bulletins to release as part of the monthly release cycle for the month of December.

In Microsoft's own words:

"In response to extensive customer feedback, Microsoft is implementing changes in the way security bulletins are released. These changes will help enhance the manageability and predictability of the patch management process for customers. Security bulletins will normally be released on the second calendar Tuesday of every month. However, the first monthly bulletins will be released on Wednesday, October 15, 2003."

That would be fine if there were no any outstanding issues...

...but there are - A CHINESE RESEARCHER has discovered 7 new security holes in Internet Explorer and Microsoft is looking into them, or perhaps through them. According to Russ Cooper of TruSecure, two of the holes are critical vulnerabilities which could permit an attacker to remotely execute malicious programs.

So taking those issues into account Microsoft's new strategy seems to be don't release any updates. As usual we will investigate further to see what Microsoft has to say about the matter.

Update: You can give your response to this situation directly to Microsoft. Mike Nash, Vice President of Microsoft's Security Business Unit (SBU), invites you to join him for a one hour discussion on security issues with Microsoft products. Come and let Mike know the issues you are facing and ask questions about what Microsoft is doing to improve security in our products on December 11, 2003 10:00 A.M. Pacific time

Download: Chat: Trustworthy Computing with Mike Nash Event Reminder