Microsoft Issues Emergency Patches for IE

Microsoft today took the unusual step of releasing out-of-band patches for severe security flaws in all versions of Internet Explorer, along with related holes in the Microsoft Active Template Library included with Visual Studio.

Microsoft generally only releases patches outside of its normal monthly cycle for the most dangerous security flaws. The IE risks involve "components and controls that have been developed using vulnerable versions of the Microsoft Active Template Library," according to Microsoft, and could allow an attacker to run commands or download malware on a vulnerable PC if you simply view a malicious Web page. Such drive-by-download attacks are a favorite among Internet attackers.

According to Microsoft, this MS09-034 patch "is rated Critical for Internet Explorer 5.01 and Internet Explorer 6 Service Pack 1, running on supported editions of Microsoft Windows 2000; Critical for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 running on supported editions of Windows XP; Critical for Internet Explorer 7 and Internet Explorer 8 running on supported editions of Windows Vista; Moderate for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 running on supported editions of Windows Server 2003; and Moderate for Internet Explorer 7 and Internet Explorer 8 running on supported editions of Windows Server 2008."

Translation: if you use any version of IE on Windows 2000, XP or Vista, get the fix asap by running Windows Update. IT folks who maintain Windows Server 2003 and 2008 boxes don't have to rush quite as quickly but will still want the fix.

The companion patch fixes holes in the Microsoft Active Template Library, part of Visual Basic, which can be used to create the vulnerable ActiveX controls that trigger the IE flaws fixed in the MS09-034 patch. According to Symantec, the ATL patch won't fix vulnerable controls that have already been created, but will avoid creating new vulnerable controls. For more information see the MS09-035 bulletin.

EMC distances rival NetApp

EMC  has scored another victory over storage rival NetApp by purchasing Data Domain, a merger which widens the technological gap between the companies in the fast-growing data de-duplication market.

NetApp desperately wanted Data Domain to bolster its largely unsuccessful de-duplication business, as evidenced by its $1.9 billion bid to purchase the company. But EMC proved too rich, and on Wednesday signed a definitive agreement to buy Data Domain for $2.1 billion. 

"This is a move that strengthens EMC and doesn't put them in any financial or competitive bind," notes Pund-IT analyst Charles King. "From a competitive standpoint, I think EMC won the day here."

De-duplication is expected to play a major role in the storage market because it lets companies reduce the amount of disk space they need in their data centers. With data volumes growing quickly, technologies that make storage more efficient will be of huge importance over the next few years, says Forrester analyst Andrew Reichman.

But Reichman believes EMC paid too much for Data Domain. De-duplication is important because it automates the process of reducing storage requirements, but it isn't the only technology that can make storage more efficient, he says. Thin provisioning, snapshots and clones, and denser drives can all help enterprises use disk space more efficiently, he says.

The $2.1 billion price tag for Data Domain could be "mitigated by significant market growth" in de-duplication, Reichman says. "But I think in a number of years we might look back on this deal and say the winner lost and the loser won," he says. "You could say NetApp is a loser in this buy they didn't spend that huge amount of money. That gives them flexibility.

NetApp actually comes out of the negotiations $57 million richer, courtesy of a merger agreement termination fee Data Domain was obligated to pay. NetApp CEO Dan Warmenhoven said the company could not justify "engaging in an increasingly expensive and dilutive bidding war," and that NetApp remains confident in its "already compelling strategic plan, market opportunities, and competitive strengths."

NetApp was smart to walk away from the bidding war, but may still attempt to acquire another de-dupe vendor, says Deni Connor, principal analyst with Storage Strategies Now.

"I think it was a wise decision for NetApp to step away from it," Connor says. "Re-bidding for Data Domain would have really hurt their cash flow. It'll be interesting to see, though, what both companies do, how EMC integrates the Data Domain products and also what NetApp does in order to get some extra de-duplication capability."

Even if NetApp's decision was the right one, the bidding war forced the company to expose its financial limitations relative to EMC.

"This puts NetApp in a curious position," King says. "I've seen some analysts say that the company with the deeper pockets won and that's true enough. But the bidding war has also exposed the amount of money that it took to make NetApp blink, in essence. From a strategic standpoint, that's not a great place for a vendor to be in. … They've laid their cards on the table and moving forward I think that would put them at a disadvantage."

EMC reportedly has more than $7 billion in cash reserves, compared to $2.7 billion for NetApp. EMC also has a sizable sales lead, with $871 million in external disk storage systems factory revenue in Q1 2009, compared to $373 million for NetApp, according to a June report by IDC. NetApp isn't even EMC's biggest rival in terms of storage revenue, as HP, IBM, Dell and Hitachi all earn more NetApp.

To one observer, the Data Domain bidding war made little sense for either potential buyer. Data Domain's de-duplication technology is robust, but not the only game in town, notes analyst Arun Taneja of the Taneja Group. Data Domain's technology is single-node, meaning it can only de-dupe one node at a time, whereas rivals such as FalconStor, Sepaton and Permabit offer the more expansive global de-duplication, Taneja says.

"I think there are way less expensive ways of getting really good technology," Taneja said earlier this week, when the outcome of the bidding war was not yet clear. "The price is excessive right now. I'm always in favor of a company getting fair value. This is beyond fair, this has gone into a degree of madness. And I don't understand that because there are other technologies that are extremely viable."

NetApp does offer de-duplication today, but Taneja says the offerings haven't caught on with customers. "Unquestionably, NetApp needs a data de-duplication product. They don't have [a successful] one of their own," he says.

NetApp has offered de-dupe with its VTL product, but "it has no visibility, it has no traction," Taneja said.

NetApp last year  boasted that it can de-dupe primary storage from third-party vendors such as EMC, Hitachi and HP, as part of its V-Series line of storage virtualization products. NetApp has de-dupe built into its Data Ontap operating system, but clearly wanted to adopt an appliance-based approach by purchasing Data Domain, Connor says.

Connor expects further consolidation in the data de-duplication market. In addition to NetApp, HP and Dell might be interested in picking up one of the various de-dupe vendors, such as FalconStor, Sepaton, CommVault or Quantum, she says.

"I think it will be interesting to watch what else happens in the de-duplication wars. I don't think it's over yet," Connor says.King believes the pickings are slim now that Data Domain is off the market. Despite the limitation noted by Taneja, King said Data Domain succeeded in building a product with great efficiency and price-performance. "There are some other good companies out there, but I don't believe there are any with the same stature as Data Domain," King says.

One more question is how EMC will integrate Data Domain into its own line of products. The acquisition could potentially be bad for customers, who would have preferred de-duplication offered by an independent vendor, suggests Juergen Urbanski, managing director with industry analyst firm TechAlpha.

"Storage efficiency (notably de-duplication) is the enemy of a business model predicated on pushing more disk capacity out the door year after year, which is why customers we spoke to would have preferred to see such a disruptive technology remain in the hands of an independent vendor," Urbanski writes in a blog. "By acquiring Data Domain, EMC controls the pace of innovation, possibly pushing out the time when Data Domain's technology becomes applicable to ever broader classes of workloads."

EMC has sometimes maintained acquired companies as separate product lines or business units, for example VMware, Reichman notes. It's too early to tell how far EMC will go in integrating Data Domain into its own product line, he says.

"That's the question," he says. "Do they leave it alone? Or will they take the software technology and merge it into their core offerings? Initially they will definitely want to leave it separate. You could argue they will get more benefit if it's more tightly integrated into their own products."