Captain's Blog

Microsoft Recommends Shavlik

Its pretty well known that we have been working on patch management for a long time, creating MBSA and now providing Shavlik NetChk Limted, which is directly recommended by Microsoft.  We are focused helping assure our customer's and the industry in general are getting strong security support. Our on going relationship with Microsoft is key to this.

Here are some related links:

Microsoft

Legacy Product Support: For customers using legacy products not supported by MBSA 2.0.1, Microsoft Update, and WSUS, Shavlik Technologies provides a free MBSA 2.0.1 companion tool called Shavlik NetChk Limited.

Users who have the following products in their environment can use Shavlik NetChk Limited to augment MBSA 2.0.1 results for comprehensive security update detection.

•	Office 2000
•	ISA Server 2000
•	FrontPage Server Extensions 2000/2002
•	Visual Studio .Net 2002/2003
•	SQL Server 7.0/2000
•	Other products not included in Microsoft Update's supported product list

WindowsITPro

"Shavlik Technologies was an easy choice for Microsoft to go to for providing continuity in supporting [complete security scanning] for customers who are using some of the older products," said Stephen Toulouse, Group Program Manager at Microsoft. "Shavlik has an intimate knowledge of security detection requirements since they helped develop the first version of MBSA for Microsoft."

Redmond Mag

ENT

Shavlik's NetChk Protect Limited searches for critical  security patches and spyware. However, the free version does not install patches  or remove spyware, according to the product's Quick Start Guide posted on  Shavlik's Web site. 

Get this free product, without any registration or timeous here.

MBSA 1.2.1 and MS06-055

Below is a nice detailed note from Doug Neal of partner Microsoft (we created mssecure.xml with them and MBSA 1.2.1 for them) as he posted on patchmanagement.org .  I wanted to also note that our latest MBSA compatable tool does provide one solution for all Microsoft patches - and there is a fully free scanner version along with other free versions of our software as I posted a note a while ago on.

(thanks to Doug)

You may want to read the MSRC bulletin for MS06-055 (http://www.microsoft.com/technet/security/Bulletin/MS06-055.mspx).  Although the MBSA team always provides a public announcement on the Microsoft.public.security.baseline_analyzer newsgroup, the MSRC bulletin will always be the authoritative source for all issues regarding a security update.

There is table within every MSRC security bulletin that identify the level of MBSA 1.2.1 and MBSA 2.0 support.  From the table, you can see that MS06-055 is not supported by MBSA 1.2.1 (which is based on the MSSecure.XML file).  MS06-055 is fully supported by MBSA 2.0 (which uses Microsoft Update and the WSUSSCAN.CAB file).

Any month MBSA 1.2.1 cannot provide support (usually due to technical limitations in the dated scan engine used by MBSA 1.2.1), Microsoft will provide a monthly edition of the standalone Enterprise Scan Tool (EST).  All of the links describing MBSA 1.2.1 support and the EST tool (when needed) can be found in the security bulletin.

Customers who are using the MSSecure.XML file outside of the three Microsoft-supported products (SMS 2.0 SUIT, MOM and MBSA 1.2.1) are not only using the catalog file in an unsupported manner, but are potentially at risk since the MSSecure.XML file will never contain data for bulletins it cannot support (see KB 306460 and KB 895660) which makes it less than authoritative for patch detection outside of the supported Microsoft tools.

The MSSecure.XML file will not include Office products (since an integrated version of the ODT tool is used instead).  MSSecure.XML will also not include bulletins that do not have MBSA 1.2.1 support (like Outlook Express, Windows Media Player 10/11, Internet Explorer 7.0, .Net Framework 1.0/1.1/2.0, Jscript, Microsoft's addition of Adobe Macromedia Flash in Windows, FrontPage Server Extensions, MDAC and a number of other components).  MSSecure.XML will also not include detection and support for 64-bit platforms or Vista.

Additionally, the standalone MBSA 1.2.1 tool will be decommissioned in the coming months in favor of MBSA 2.0 (already released) and an additional tool (yet to be named) that will remove the need for MBSA 1.2.1 detection by filling in the 'gap' of detection for products that are not supported in MBSA 2.0 (which is based on Microsoft Update and WSUS technologies).  See the MBSA home page at www.microsoft.com/mbsa for details as they become available.

Please feel free to post to the MBSA newsgroup (Microsoft.public.security.baseline_analyzer) if you have any questions regarding MBSA that Microsoft can answer since we may not always see them on this mailing list.

doug neal
Microsoft Baseline Security Analyzer (MBSA)
MBSA 1.2, 2.0, EST, CSA and MSSECURE.XML scan tools

Shavlik Survey (SSL Based)

I wrote up a survey at https://www.surveymonkey.com/s.asp?u=394252488617

Please take 5 minutes to answer a few questions if you have the time.  It really helps us build the right products and company for you.

The survey is SSL encrypted and you do not need to give us your name etc unless you want to.

I will post results once there is some solid data.

Thank you,
Mark

 

Free MBSA 1.2.1 upgrade

Below is our marketing team's announcement for our free MBSA 1.2.1, and 2.0, upgrades.  These free products are based on the Shavlik Network Analyzer, or SNA, which is the latest version of hfnetchk, its the same hfnetchk engine in MBSA and many other products - but with 3 years of advancements including much faster scans, remote Microsoft Office support and support for both legacy and new Microsoft products, along with non-Microsoft products.  With Microsoft's recent announcements we decided to provide a free MBSA 1.2.1 upgrade based on our SNA product.  In the past we where happy to let Microsoft give out our engines for free but with the changes being made we choose to provide the free engines ourselves.  We also provide commercial upgrades to this command line product as we have before, along with our GUIs, the for-pay products have a number of features not found in the free products, but the free products still provide a rich base-line from which to start. 

A key item in SNA is remote Microsoft Office product scanning without any agent required, something not found in MBSA.

(again, the blurb below is from our marketing team)

Microsoft Announces Plans for MBSA 1.2.1 Support

In response to Microsoft’s announcement, and as part of Shavlik’s goal to simplify complex network security, Shavlik Technologies has announced the availability of three new choices of its award winning software to support companies using Microsoft MBSA 1.2.1.  Each of these alternatives offers current MBSA 1.2.1 customers an easy solution to patch products no longer supported by Microsoft's WSUS and SMS patching products along with support for all new Microsoft products, and patching for products beyond those from Microsoft.  Shavlik is also offering commercial versions of these free products.  Details of Microsoft's announcement regarding MBSA 1.2.1. can be found here http://www.microsoft.com/technet/security/tools/mbsahome.mspx

Choice one is Shavlik NetChk Analyzer for Microsoft, Shavlik’s new, free command line scanning solution that provides support for Microsoft MBSA 1.2.1 legacy products along with all new Microsoft products.

Choice two is a free and commercial version of Shavlik NetChk Analyzer, Shavlik's full featured command line patch management product that provides a seamless upgrade for Microsoft MBSA 1.2.1.

Choice three is Shavlik NetChk Protect, our flagship product which is being offered free for up to 10 seats for one year.  The product is also available as a full commercial version that can be used on thousands of computers.

Each of the above products can be downloaded from the Shavlik Web site at www.shavlik.com/MBSA.aspx

Microsoft Tech-Ed

I took a quick trip out to Boston for the Microsoft Tech-Ed show, which was at least my 10th time to this show.

Boston is a great town and the weather was nice which made the trip even better. 

I always like going to Tech-Ed because you can spend time with the Microsoft product leadership in very direct and open ways.  They tend to be direct and give straight answers which is very useful because its real data we can use to drive our business both as an ISV or and end-user.

This year the show did not have too much in the way of 3rd party security only vendors. (Our good partners ScriptLogic and Numara had nice, and busy, booths but they sell more than security solutions.)  Tech-Ed is more focused on tools and OS extensions than just security I suppose, but given all the work done for security in the world I would have expected to see more security product dedication.  We did not have a booth there this year for a number of reasons but upon reflection we should have and we will return next year if nothing else to represent the security ISVs.

It was nice to see MBSA still so widely used by Microsoft, with using continuing in MOM, SMS and of course MBSA by itself.  We worked hard with Microsoft to create that product and I wish it a long life.

Microsoft did announce its Forefront product but its not shipping for at least one year so there was not too much to really see.  It did not seem like a disruptive technology by any means and it was not the hot event of the show, in fact I did not see much interest in it for attendees and there was no buzz around it.

The new MOM seems like a good management infrastructure product and it continues to get better and grow.  Vista is Vista, nothing super new there to report on, less users running as admin and I expect many more help desk calls and somewhat better security as a result.  SMS will get a new name in its next release I learned.  Microsoft also has a bunch of other security products now, but nothing new for the show other than Forefront.

Upon reflection it was good to learn the details of the latest Microsoft workings but I did not see any great new technology areas being introduced at the show, which was a similar response I had to the Feb RSA show in SFO. 

I remember seeing the first Blackberrys at Tech-Ed a few shows ago and it was easy to see the changes they brought, or the intro of Microsoft into the Firewall world with Proxy 2.0 a while back - showing Microsoft was going to do something in the security markets.  Or seeing the wide-spread availability of wire-less networks (all completely wide open of course). I have not seen any buzz like that yet this year.

June Microsoft Patch Day

Updated: From the Microsoft Blog

June looks to be a busy month, be sure to set a side the appropriate amount of time to patch next week.

Microsoft June Patch Day Details

Nine Microsoft Security Bulletins affecting Microsoft Windows. The highest Maximum Severity rating for these is Critical.

well written "best practices" guide for Microsoft patch management

From Mark Allen of our Data Team:

Here's a really well written "best practices" guide for Microsoft patch management issues. This is an article from the monthly Microsoft security newsletter by Christopher Budd, Security Program Manager at Microsoft.

http://www.microsoft.com/technet/community/columns/secmgmt/sm0506.mspx

Good stuff!

My History with Microsoft

I am often asked about my personal history with Microsoft, I have blogged on this a bit in the past but here is a short refresher.

I am an ex-Microsoftie. I joined Microsoft in 1986 after working on an IBM PC product that was hosted on Xenix, Microsoft's Unix product at the time.  The project was canceled because something called MS-DOS was taking over the PC world. With project being cancel so I realized I needed to find a new job, I was not out of work but its no fun being on a dead project I quickly learned, and being fairly fresh out of college my options were a bit limited. Thankfully Microsoft came along. 

I knew MS-DOS was changing things as with the PC so I joined Microsoft after a day of fun puzzle solving and code writing. At first I thought it was a bit of a joke but after a while on that interview day I learned to enjoy the deep interaction with those people building a new industry.

After a few years of writing kernel code, working with OEMs and then writing things like Window's installer etc. I chose to leave Microsoft and start my own business.

After a few years of working with Microsoft via working with Microsoft customers, we here at Shavlik created a set of pretty good security products rolled under one GUI and called Inspectorscan.  Circa 1995. 

In 1999 Microsoft asked me to write a version for Inspectorscan for their internal use, which we did.  As part of that I designed what is now mssecure.xml and hfnetchk.  Shortly afterwords Eric Schultze joined Microsoft and put a lot of efforts in to those products and the results are well known.  Microsoft also asked me to move hfnetchk into MBSA, a number of years ago now, which I was glad to do.  We also created our own product, HFNetChkPro along the way also. 

Microsoft recently said their end-users would not let them end Microsoft's distribution of our hfnetchk and mssecure.xml which made me pretty proud of all of our efforts over the years and the number of people using our products and related xml information.

So here it is, over 20 years later and now I just watch the product development from a safe distance (safe for the engineers who feel I get in the way just a bit :) and we are still releasing products to help Microsoft customers out.

Shavlik's engines live on in MBSA 1.2.1

Update: our beta test for our updated command line patch scanner, Shavlik NetChk Analyzer, is looking good and we expect to release it the last week of April, we will make a formal announcement shortly (its released)

Microsoft's customer base has asked Microsoft to continue support the Shavlik HFNetChk engine found in MBSA 1.2.1.  We will still release our updated version of the HFNetChk Command line shortly, with much more speed and many more products that the roughly 3 year old engine found in MBSA 1.2.1 along with full product support so customers do not need to support the multiple engines Microsoft requires for full security.   

Update: we decided to go with a beta of our latest engine, beyond what is shipping today, with Microsoft keeping MBSA 1.2.1 around a bit longer, this beta will go out soon.  Assuming a solid beta we will release the final product in time for the May patch day.

Here is a good link on the topic also, "MBSA 1.2 will live on, says the software giant, after massive public outcry" along with more Shavlik information on our update to MBSA 1.2.1. SMS will use our engine (the older version) until 2010 according to Microsoft, but that is a very old version of our engines.

Doug Neal from Microsoft was kind enough to post  this note to our Patchmangement.org site today (thanks Doug!)

"The MBSA 1.2.1 End of Life has been extended beyond the March 31, 2006 date.

Details:

The previously-posted March 31, 2006 end-of-life (EOL) date for MBSA 1.2.1 and the MSSecure.XML file has been rescinded. The new End-Of-Life date for both MBSA 1.2.1 and the MSSecure.XML file is being extended to an undetermined time.

Microsoft is extending support for the MBSA 1.2.1 tool and updates to the MSSecure.XML catalog file beyond March 31, 2006 in order to collect customer feedback on the MBSA suite of tools and security update detection needs. A new support lifecycle end date for MBSA 1.2.1 will be updated by June 30, 2006.

Communicating this change:

Last week the MBSA Home Page and MBSA 1.2.1 FAQ pages were updated to explain this change. KB articles 306460 and 914791 will also be updated in the coming weeks.

Answers to common questions:

Q: Why is the MBSA product team extending the MBSA 1.2.1 EOL date?

A: Removing MBSA 1.2.1 support at this time would create a gap in security update detection for Microsoft products still in mainstream support but below the WSUS baseline of supported products (MBSA 2.0 supports only products supported by WSUS). Since the MBSA 2.0 tool alone does not provide complete security update detection for customers with products below the MBSA 2.0/WSUS baseline, support for the MBSA 1.2.1 and Enterprise Scan Tools are being extended to ensure these customers of continued and complete update support. Extending the MBSA 1.2.1 EOL date provides customers additional time to use MBSA 1.2.1 + the Enterprise Scan Tool to detect current and upcoming security updates while providing additional time for Microsoft to assess the needs of customers before setting a new EOL date.

Q: Why is there no MBSA 1.2.1 EOL date posted at this time?

A: The MBSA product team is looking for additional customer feedback to provide the best solution for customers who still require features available in the MBSA suite of scan tools. Instead of setting a new date that may be subject to change, the MBSA team is taking additional time to further assess customer needs to ensure the next solution provides a more comprehensive patch scanning solution before a new date will be announced. This further update will come on or before June 30, 2006.

Q: From the updated message, it sounds like you might be planning a survey?

A: Yes. One of the methods the MBSA team will use to gather detailed customer insights will be through a survey that is planned for posting in the coming weeks. Check the MBSA home page for updates and a link to the customer survey when it is available.

Q: Does this affect SMS 2.0 or 2003 customers using Software Update Inventory Tool?

A: No. SMS customers would have had continued, unbroken SUIT scanning and deployment support (which is based on MBSA 1.2.1 technologies) even if MBSA 1.2.1 had been end-of-life'd as planned. There is no effect on SMS customers using the SUIT or Extended SUIT tools.

doug neal

Microsoft Baseline Security Analyzer (MBSA)

MBSA 1.2, 2.0, EST, CSA and MSSECURE.XML scan tools"

MBSA Replacement Details

As  you may know we wrote MBSA for Microsoft a number of years ago. Its key component is the HFNetChk Engine which Microsoft has not updated in a few  years. They are also cutting back on its support at the end of this month, only supporting it in SMS and as a result we are going to release an advanced and updated replacement.  Here are the related details for those interested, I decided to just put the marketing version here since all the details are here.  I hope you give it a try, I think  you will find it useful, maybe a bit retro too since its command line and scripted.  Its also 8 times faster than MBSA 1.2.1, yee hah!  Supports many more products also, including agent-less remote Office scans, something MBSA never did.

Update: we decided to go with a beta of our latest engine, beyond what is shipping today, with Microsoft keeping MBSA 1.2.1 around a bit longer, this beta will go out soon. Assuming a solid beta we will release the final product in time for the May patch day. Its available now. Marketing Text:

Shavlik Is Pleased To Introduce Shavlik NetChk Analyzer

From the creators of Microsoft’s MBSA comes the Shavlik NetChk Analyzer, a command line and scripting tool that simplifies network security by enabling administrators to quickly scan their networks and determine the status of missing and installed patches. This is a complete upgrade to the patch management components of MBSA, which is used to secure millions of computers each week.

Shavlik NetChk Analyzer offers support for today's most widely used platforms including Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003.  Additionally Shavlik NetChk Analyzer scans popular Microsoft and non-Microsoft applications including Microsoft Office, SQL Server, Exchange Server, Adobe Reader, Firefox, Real Player, WinZip and many others.  The list of supported products goes well beyond what Microsoft provides in any of its solutions.

Features

• Fully featured commandline and scripting application

• Non-invasive / agentless scanning (MBSA 2.0 requires a WSUS 2.0 agent on every scanned computer)

• Support for many non-Microsoft applications

• Flexible reporting output including XML, CSV, and TSV

• Supports environments up to 50,000 devices

• Fast, multi-threaded scan engine – up to 256 scan threads active at one time

• Full MBSA 1.2.1 compatibility, with faster scanning performance that’s (8x) that of MBSA 1.2.1

• Uses significantly less network bandwidth than MBSA 1.2.1

• Gathers asset inventory data for each machine

• Use as a complete MBSA 1.2.1 replacement*

* Important: Microsoft MBSA 1.2.1 will reach end of life on March 31, 2006. After this date, the application will no longer be support ed by Microsoft and the MSSecure.XML file which includes all patch updates will no longer be updated to include new security bulletins. For those customers who have been using MBSA 1.2.1, we’d encourage you to migrate to Shavlik NetChk Analyzer right away to ensure continued support from the company who developed MBSA for Microsoft - Shavlik Technologies.

Supported Products & Operating Systems

For a detailed list of the applications and operating systems covered by Shavlik NetChk Analyzer, please go to: http://forum.shavlik.com/viewtopic.php?t=1009

System Requirements

• Windows 2000, Windows XP, and Windows Server 2003 systems

Available: Now, SNA web page