Did the BugBlog help you? Donate via PayPal to say thanks.

Even better, subscribe to the BugBlog Plus for even more coverage of bugs and their fixes.

Order books and more at Amazon.com

Order Windows 2000 Secrets from Amazon.com

BugBlog Bug of the Month

Starting with January 2005, the BugBlog will pick its Bug of the Month, representing the most significant bug found in the past month. Sometimes, the bug will be the one which could potentially cause the most damage; sometimes it will be the bug which affects the most users. And sometimes, it will be the bug that is just the most interesting bug. This bug will be selected either from the free Bug of the Day, or from the subscription-only BugBlog Plus.

The Bug of the Month for May 2005 was posted as the Bug of the Day on April 12.

Microsoft has patched TCP/IP in most versions of Windows to fix five separate bugs that may allow remote attackers to crash your computer or possibly take it over completely. This affects Windows 2000 Service Packs 3 and 4, Windows XP Service Packs 1 and 2, and Windows Server 2003. Earlier versions of Windows (98, ME) are affected, too, but Microsoft says its not critical for them. This has already been fixed in Windows Server 2003 Service Pack 1, which was released last week. You can get patches for your version of Windows at http://www.microsoft.com/technet/security/bulletin/MS05-019.mspx. Microsoft credits these people for finding these bugs: Song Liu, Hongzhen Zhou, and Neel Mehta of ISS X-Force; Fernando Gont of Argentina's Universidad Tecnologica Nacional/Facultad Regional Haedo; and Qualys.

Why this one? This bug was one of eight released by Microsoft on Patch Tuesday, the second Tuesday of the month when they release all their security bulletins. Five of those bulletins, including this one, were marked Critical. Just about every version of Windows was affected, including last year's Windows XP Service Pack 2. This patch actually took care of five separate bugs within TCP/IP, which is the protocol used for communicating over the Internet. So this bug affects a huge number of users, is in an important function, and could have a devestating impact. All those factors make it the Bug of the Month.

Previous Bugs of the Month

April 2005: Denial of Service against Symantec Norton AntiVirus

March 2005: IDN Spoofing Bug

February 2005: Windows Animated Cursor Bug

January 2005: Windows Firewall Problems with Dial-up connections

The Bug of the Month is also posted at Blogcritics.org