New Security Advisories Launched

A new form of security warning, the security advisory, accompanied a security bulletin rated important for Windows and an updated free Malicious Software Removal Tool on Microsoft’s May 2005 “Patch Tuesday.” Customers will need to monitor the new security advisories, which resemble streamlined security bulletins, because they provide information on issues that can impact the overall security of computers. (For a summary of the bulletin and the advisories, see the chart “May 2005 Security Communications Summary“.)

Security Advisories

Microsoft has created the new security advisories to notify customers in a timely manner and provide guidance about security issues it feels do not warrant a security bulletin.

Security bulletins provide information and guidance about software fixes or patches that address software vulnerabilities. Each released security bulletin has an associated software fix for the affected product and an associated severity rating.

Security advisories, in contrast, could address broader security issues not dealt with by bulletins, or provide guidance about public vulnerabilities for which Microsoft does not currently have an update. For example, Microsoft may use the advisory to announce changes in a feature of a product that works the way it was initially designed, but that Microsoft has updated to harden the product’s overall security. Microsoft will also use security advisories to provide guidance and workarounds to mitigate vulnerabilities that become public before a fix is available. Security advisories might also advise of a perceived security threat that is actually a hoax. In cases where Microsoft provides guidance through a security advisory for a software vulnerability, that security advisory could evolve into a security bulletin, with an associated severity rating, when an update is released to address the issue.