One in five applications installed on Windows PCs are missing security patches, a Copenhagen-based vulnerability tracker has reported.

According to Secunia APS, more than 20 percent of the applications scanned by its Personal Software Inspector (PSI) utility were open to attack because available fixes for security flaws had not been applied.

"More than 20 percent of all applications installed on users' PCs have known security flaws, but the users have yet to install the patch provided by the vendor of [the] product," said Jakob Balle, Secunia's development manager, in a post to the company's blog last week.

The 20 percent figure was based on scans of more than 14.5 million applications installed on the Windows PCs operated by users who downloaded and installed Secunia's PSI. The utility scans for some 4,200 different applications and reports on their patch status.

The 1-in-5 ratio, however, is an improvement over earlier PSI scans. Last May, Secunia said that 28 percent of the applications PSI scanned were missing available security updates.

Secunia released the free patch-detection utility a year ago but shifted it to Release Candidate 1 (RC1) stage earlier this month. The company claimed that nearly 191,000 users have downloaded and run the program.

PSI, which runs on Windows 2000, XP, Vista and Server 2003, can be downloaded from Secunia's Web site.

Computerworld is an InfoWorld affiliate.

Microsoft product managers Friday claimed that a data corruption bug in Windows Home Server crops up only when the system is under an "extreme load," but also defended their decision to sound a general alarm before they had completed their investigation.

The news that Windows Home Server (WHS) could corrupt files raised a storm of criticism from customers and observers alike.

"The problem isn't one hundred percent reproducible, and depends on quite a few different factors," explained Todd Headrick, the product planning manager on the Windows Home Server (WHS) team. "Home Server has to be under an extreme load while doing a large file copy," he said, adding that the flaw comes into play only in instances when the file server's cache is full and the user is editing a file previously saved to a shared folder.

"But we thought it was important enough to generalize [the bug] so people would take it seriously, even though we took a PR [public relations] hit," Headrick added.

Wednesday, Microsoft warned users in a tightly worded support document not to edit files stored on their servers with certain programs. "Files may become corrupted when you save them to the home server," Microsoft said in KB946676, which it published last week to its support site.

Saying that the bug was in the shared folders feature of WHS, the document urged users to stop using seven Microsoft applications, including Windows Vista Photo Gallery, Windows Live Photo Gallery, OneNote 2003, OneNote 2007, Outlook 2007, Microsoft Money 2007 and SyncToy 2.0 Beta under some conditions. "We recommend that do not use the programs to save or to edit program-specific files that are stored on a Windows Home Server-based system," the document read.

That wide-ranging recommendation caught the eye of WHS users and Microsoft critics alike. Some sounded white-hot.

"I've had a fair share of files corrupted," a user identified as Shane K claimed on the WHS support forum. "I have 800+ gigs of data on my home server and I've had just about every file type you can imagine refuse to open or at sometime go to 0KB file size for no reason. This issue has been around for MONTHS so I don't know why suddenly the WHS team decides to 'work through the holidays' to resolve it when there has been plenty of action on the boards since beta about this issue."

Others misunderstood Microsoft's warning, and assumed that client backups to WHS would end up corrupted, which wasn't true. "This could potentially be the 'my dog ate my homework' for the 21st century," said a user named BVis on a Slashdot.org thread that tracked Computerworld's original story. "'I did my homework, but the power went out before I could save it, and my backups were all corrupt!'"

"People read things into [the KB]," said Headrick. "I heard people say 'Don't use the computer backup,' but there were no problems whatsoever with Windows Home Server backup."

Headrick and Joel Sider, a WHS senior product manager, both defended the decision to issue the warning. "This is a very serious issue," said Headrick. "We take any [data] corruption issue very seriously."

"We went with the amount of information we had at the time," said Sider. "We had seen a reproducible problem, but we hadn't created a reproducible environment yet."

"We didn't have any more information, other than we were working on the problem, which we'd already said," echoed Headrick in explaining why the team left the original support document untouched until late Friday. Then, Microsoft updated KB946676 to include some of the same information that Headrick and Sider discussed in their interview with Computerworld.

"You can still use the WHS home computer backup to back up and restore files from and to your home computers," the revised document read.

Headrick promised that the WHS team would work around the clock to come up with a permanent patch for the corruption bug, and would release it first as a hotfix that users would have to download manually from the Microsoft site. He refused to set a schedule for its release, however, saying only that the developers would have something to test "in fairly short order."

At some later date, the fix will be pushed to all WHS customers via Windows Update, Microsoft's update service, with the process determined by the server software's Automatic Updates settings, Headrick promised. He also said that although the WHS team was aware of file corruption reports related to Torrent applications, Intuit Inc.'s Quicken personal finance program and Intuit's QuickBooks small business accounting software, it has not been able to reproduce the bug on its test systems. In addition, Headrick put the responsibility for any problems with Quicken on users' shoulders.

"Quicken [data] was never meant to be stored on a network share," said Headrick.

Computerworld is an InfoWorld affiliate.