Microsoft issues first Windows 7 patches

But new OS afflicted by half as many bugs this month as Vista, a third as many as XP

Microsoft last week patched nine vulnerabilities, five marked "critical," in Windows 7, a move that will require users upgrading to the new operating system starting Thursday to download a security update to keep their PCs secure.

The patches were the first for Windows 7's final build, dubbed RTM for "release to manufacturing," that has been in some customers' hands, primarily enterprises with volume licensing agreements, since August.

Windows 7's patch count, however, was significantly less than either Windows Vista's, its immediate predecessor, or that of Windows XP, the eight-year-old operating system installed on the majority of systems worldwide.

An analysis by Computerworld of the massive Oct. 13 security update -- the largest by Microsoft since it started patching on a regular monthly schedule six year ago -- showed that Windows 7 was affected by nine of the 34 vulnerabilities, or 26% of the total. Its count of critical bugs -- the most serious as marked by Microsoft -- was five out of a possible 21, or 24%.

Windows Vista, meanwhile, was impacted by 19 of the 34 vulnerabilities, or 56% of the total, with 11 pegged critical, or 52% of the possible.

Windows XP was affected by the most vulnerabilities of all: 24 out of 34, or 71% of the total. Of the two-dozen bugs that needed patching in Windows XP, 18 were tagged as critical, or 86% of the total critical count.

The tallies indicated that, at least this month, Windows 7 was afflicted with about half as many vulnerabilities as was Vista, and about a third as many as was Windows XP. Its critical bug count followed the same pattern.

Those flaws that did affect Windows 7 were probably due to recycled code, said security experts. "The Windows 7 vulnerabilities are coming from its legacy code base," said Jason Miller, the security and data team manager for patch management vendor Shavlik Technologies.

In fact, none of the vulnerabilities patched last week were Windows 7-only flaws. Of the five security bulletins that affected the new OS, all five also impacted Vista and XP, and all but one had to be patched in the even-older Windows 2000.

The phenomenon of vulnerabilities in old code isn't new. Just months after Vista's launch, security researchers took Microsoft to task for overlooking a vulnerability in Windows' animated cursor in the brand-new operating system, even though was closely linked to a bug Microsoft had patched more than two years before.

Microsoft has promoted Windows 7 as safer and more secure than its predecessor, something it did two three years ago when it touted Vista as better than XP. But everything is relative.

Even Microsoft's top expert on designing software with security in mind -- a process Microsoft calls Security Development Lifecycle, or SDL -- has admitted that it is virtually impossible to catch some kinds of bugs without tedious line-by-line review of the code, something even Microsoft is hard-pressed to do.

On the bright side for Microsoft, three of the five critical vulnerabilities assigned to Windows 7 are in Internet Explorer 8 (IE8), the browser that ships with the new OS. The remaining two are in older editions of the .NET Framework and Silverlight, the .NET-based cross-browser, cross-platform media standard Microsoft's pushing.

Windows 7 was also unaffected by the eight vulnerabilities in GDI+ (Graphics Device Interface), which was put at the top of the to-patch list by most experts. Windows XP users had to apply six of the eight GDI+ fixes, while Vista users had to deploy just one.

But that doesn't mean researchers and hackers won't uncover flaws in Windows 7, perhaps an increasing number as time goes on. "Unless Microsoft can make a brand-new operating system, bad things will continue to happen," said Miller of Shavlik.

Users already running Windows 7 can update now, but users who upgrade to Windows 7 starting this week will need to run Windows Update to obtain the patches after they've installed the new operating system.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Windows 7

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?