The Air Force dropped his e-mail fix when Microsoft Corp. came out with its own patch for the problem. And that is as it should be, Mullen said. Certainly, the recommended course of action is to follow the manufacturer s advice, he said. This was a clear indication to me that there is a need for an automated distribution system for fixing security flaws, he said. The Microsoft fix is superior to his, Mullen said, but it requires installing a different patch for each version of Internet Explorer, down to the service pack level.
Many administrators have no easy way of getting the patches out to thousands of users.
I would venture to say that only a small percentage of machines have been fixed, he said. And therein lies a vulnerability more persistent than any flaw ever accidentally programmed into a piece of software. Manufacturers can turn out patches and fixes until they are blue in the face, and it doesn t do a bit of good until somebody installs them. Mullen took pains to make his e-mail vaccination benign. Because it was intrusive and changed settings without permission, he didn t want recipients to forward his e-mail to other users.