No new service pack for Win XP until late next year

Microsoft won't release a second service pack for Windows XP until the second half of next year, giving users more responsibility for applying individual patches and updates.

Service packs roll in all the security fixes and driver updates issued since the release of a product or of a previous service pack. They are meant for customers who don't apply all the updates as they are released, because they prefer to do maintenance on their own schedule or because they are too lazy or busy to keep up with the stream of updates.

Windows XP was released in October 2001. Service Pack 1 followed less than a year later on Sept. 4, 2002. Despite several high-profile security vulnerabilities, Microsoft is leaving a two-year gap between the first and the second service pack, which is planned for the third quarter of 2004, the company said in a road map posted online Friday.

"That does seem a long time to wait given what just happened this week with Blaster and given the number of patches that are already out for Windows XP," said Michael Cherry, a lead analyst with Directions on Microsoft Inc. in Kirkland, Washington.

Blaster, also known as DCOM or Lovsan, is an Internet worn that takes advantage of a security vulnerability in Windows. The worm spread quickly this week, infecting as many as 1 million computers worldwide, according to some estimates. Microsoft issued a patch to fix the flaw exploited by the worm in July.

Microsoft is delaying Windows XP Service Pack 2, according to Joe Wilcox, a Washington, D.C.-based Jupiter Research senior analyst. "Third-quarter 2004 delivery of Windows XP Service Pack 2 is surprising, " he wrote in his company's Microsoft Monitor Web log. "Microsoft appears to be stretching out the span between service packs -- at least for Windows XP," he wrote.

Some users prefer service packs over individual patches because the bundles have been more thoroughly tested. There have been several instances in which Microsoft has had to pull security patches because they wreaked havoc on users' computers.

"Patches have to be released in a very time-responsive manner and are tested to a lesser degree than a service pack. You certainly don't expect a service pack to ever be pulled," said Cherry.

However, the service pack delay does not have to mean a crisis for users, according to Wilcox. "Businesses will have to take more aggressive responsibility to use the tools and information Microsoft provides to ease patch management woes," he wrote.

On its "Windows Service Pack Road Map" page on the Web, Microsoft also announced that the first service pack for Windows Server 2003 should be out in the first quarter of 2004, almost a year after the initial product release in April.

No release date was set for a Windows 2000 service pack, and no further update packs are planned for Windows NT Workstation or Windows NT Sever 4, according to the road map.

The road map, which replaces a Windows desktop service pack road map issued by Microsoft last year, is online at: http://www.microsoft.com/windows/lifecycle/servicepacks.mspx

The Jupiter Research Microsoft Monitor Web log is at http://www.microsoftmonitor.com/