By David Berlind, CNET News.com
In this article ZDNet's David Berlind explains the flaws in Microsoft's patch process. After the Download.Ject attack, Microsoft on Friday released a "configuration change" it wants people to apply to installations of the Windows XP, Windows Server 2003 and Windows 2000 operating systems. The software behemoth announced the move in a bid to shut down any additional exploitation of a vulnerability that affects Windows-based desktop and notebook PCs. Microsoft says that users who have beta versions of its forthcoming Service Pack 2 for Windows XP installed are already protected. But the latest episode also points at the time constraints of dealing with malicious code. Crucial days -- if not hours -- can elapse between the moment vulnerabilities surface on the Internet and the time vendors get around to releasing patches and configuration changes.
http://news.com.com/2010-1009-5256301.html
See also the MS partial patch: http://news.com.com/2100-1002_3-5256297.html