Slashdot Mirror

Good point. That and the fact that there is a newly discovered 'Drag and Drop' exploit in XP SP2 where using an Internet Explorer's scroll bar is enough to drop a binary executable in your Windows Startup folder. Perhaps there's more underground exploits that meets the eye. I just gathered details about the 'Drag and Drop' deal from Secunia.

Yeah MS is really on top of the ball.

"In my opinion, Windows XP is a DISORGANIZED MESS!"

The i386 folder on the Windows XP SP1 Corporate version CD is 504,563,416 bytes. Windows XP SP2 is 278,927,592 bytes. Fifty-five percent of the disorganized mess just got replaced.

What amazes me is that there is plenty of evidence of just plain sloppy programming in Windows XP. There have been 102 vulnerabilities and 1,777 viruses affecting Internet Explorer.

I am not sure I understand your point, which sounds like "If I have to choose between functionality and security, I will choose functionality". Is this a correct description of your point of view?

For the sake of discussion, I will assume the answer to my question is "yes." (Of course, it might be "no.") Choosing "functionality" over "security" is a long standing problem for Microsoft and for users of its products. Until this changes, MS products should not be considered to be even slightly secure. Look at the recent security warnings/info:
Atak
IE
IE
MS patchs

The end of the last link above is funny.
"Thomas Kristensen, CTO at security firm Secunia, told El Reg: "There are a variety of vulnerabilities with Internet Explorer that have been around for a while and are been actively exploited. Several are unpatched. We recommend our customers to use another browser for general web surfing and to limit their use of IE to trusted websites where its functionality is required, such as banking websites." ®"
Only use IE at web sites like banking sites, where confidential information and your financial resources are at risk. (Now which web sites did the Russians target? Oh yeah, banking sites.) ?????

The parent is horribly bipolar.

I have heard the "BMP thing" being spouted by a Microsoft / closed-source apologist

Actually an apologist wouldn't be spouting about the BMP exploit. Rather an apologist would be trying to dismiss it as you do in here:

Is there any documented evidence that this has been used in *any* virus/worm/hacks?

There. Now you're being the closed source apologist by saying,"We're sorry about the BMP thing but does it really make a difference?" Since it's been pointed out that the BMP thing was only present in older editions of MSIE (5.5?) it's pretty plausible that the forensic trail of tracking any exploits is long covered, formatted, and reinstalled.

And has there actually been more than one bug found

The security industry has its hands full simply processing data on exploits which are submitted. The people who have time to go over that released source code routine by routine, structure by structure, loop by loop, aren't going to tell you about it first. If they're nefarious they're not telling anyone.

Additionally, did you read this yesterday? Did you try contacting the authors who published those vulnerabilities? It's quite possible that they came onto those vulns by looking at the source code.

So sit down and...

If the exploit was evident by looking at the code, the code writer would probably fix it

That's a bit shallow minded. Not every programmer who works for MS was a 4.0 overachiever who visualized code loops and logic flow in real time. Very few middle managers were 4.0 overachievers--many got to their position because they were better at social networking than coding networks. By the time the code gets to the upper management it's not being audited line by line. Even 4.0 students aren't always guaranteed overachievers with amazing perceptual abilities. Many 4.0 students know how to stand in line and keep their mouths shut. That's the most assured way to a 4.0.

Every single exploit is discovered by accident

I would agree that the majority of exploits are discovered by someone noticing erratic behavior in a program and taking the initiative to dig in deeper. However I know a number of people who take great delight in poring over changelogs and then going back to audit source code when "Bug in <sourcefile.c> fixed." The changelog may have been a roadsign but when sourcefile.c is 1000+ lines it's still a testament to skill to find the bug which was fixed.

Could someone explain how one piece of software can have so many severe vulnerabilities? Are Microsoft programmers unbelievably bad at programming? Are Microsoft programmers just people who moved up from the lawn maintenance crew?

Is is possible that Microsoft does not allow its programmers enough time to finish what they write?

Did the U.S. government's NSA spy agency go in after IE was written and add a lot of bugs?

Here's a better view of the same Secunia advisory: Microsoft Internet Explorer Multiple Vulnerabilities, Secunia Advisory: SA12048 This view shows the 4 new vulnerabilities and shows 54 additional older vulnerabilities at the bottom of the page.

mr kettle black. well funny no one mentions this hole also out today. It effects all browsers. I dont like IE at all but the submitter might as well have mentioned it since it is in the same news blurb on the side..

Meanwhile IE has been picked apart just a little more.

this which affects IE.

Except the Mozilla one is Fixed, and the IE one has been public since 8th June.

From Secunia Virus Statistics web page:

Indicates the percentage of scans that resulted in a found infection (e.g. 1% means that in 10.000 virus scans, 1.000 of these scans resulted in found infections).

They did this twice, too. So does 1% equal one percent of machines infected, or ten percent?

(I refer to this as "Oakland School Administration math" because a high administrator of the Oakland California schools, while testifying before the state legislature, cited the percentages of black teachers in Oakland schools vs. black people in the US population, with the percentage far lower for the teachers. But in the same testimony she gave the actual numbers of black teachers and total teachers, and in fact the percentage of black teachers in their schools was far HIGHER than blacks in the general population. She'd blown the percentage computation. Doubly funny, since she was testifying about how the new teacher certification tests were unfair because they required far too much arithmetic.)

The Windows XP Pro list includes:

• Microsoft Windows 14 Vulnerabilities
• Microsoft Windows RPC/DCOM Multiple Vulnerabilities
• Microsoft Windows ASN.1 Library Integer Overflow Vulnerabilities
• Microsoft Windows RPCSS Service DCOM Interface Vulnerabilities

Actually, Secunia tend to publish alerts based the vendor bulletins. There are better sources for collated vulnerability information, such as Sintelli (free) or TruSecure (fee) which have far higher totals.

Look at these:

IBM z/OS V1.x
one vulnerabilty (in Sendmail, which was ported to z/OS)
By the way, most (if not all) parts of z/OS were written in PL/1.

IBM OS/400 - V4.x, V5.x
zero vulnerabilities
(Note, that OS/400's kernel ("SLIC"), written in C++, is absolutely closed code (afaik you can't even access its machine code on the iSeries 400's DASD), so nobody outside IBM knows, what kind of bugs might be in that kernel; anyway, because of its single-level storage architecture, this system has hardware pointer-in-memory protection, which, as a side-effect, prevents many of the most dangerous kinds of exploits, for example overwriting of return-addresses, overwriting of function pointers and such; so it's impossible to "smash the stack" on this machine)


Conclusion:
===========

To err is human; as long as people use Assembler, C or similar programming languages, they will probably cause buffer overflows and similar bugs; for this reason, we should take advantage of more intelligent hardware architecture, including features like tagged pointers and special CPU instructions for modifying addresses (so you still can change a function pointer, but only if you use the correct instruction; overwriting it using instructions for copying data areas (MOV on intel) would cause the pointer protection hardware to invalidate the pointer). Better hardware is a good foundation for better software. "Protected mode" (memory protection, preemptive multitasking, ...) brought us stable operating systems; some new hardware could get us stable and secure operating systems. By secure I DON'T mean hardware-addons like TCPA. TCPA is inadequate for a free-programmable computer architecture.

Use a suitable programming language to implement applications; you don't need to mess around with direct memory access, pointers and such, if you're programming software for accounting or a spread sheet application. Many commercial applications for z/OS and OS/400 are written in COBOL, PL/1, etc. rather than in C, and they do not seem to have nearly as many critical bugs as most C programs; OpenVMS people will tell you the same story, I don't know what programming language they used to write most of their applications, but I know it wasn't C.
If you can't get an open source Ada, Cobol, PL/1,... compiler, at least use C++ (use std::string).
Don't forget Java; java programs might not be as fast as compiled code, but especially non-GUI applications are still pretty fast, and Java is a well-designed language.

Unfortunately, there are no results for trusted operating systems such as Trusted Solaris; it would be interesting, whether the same bugs that are critical on standard operating systems could cause system access or any similarly critical escalation of privileges on trusted operating systems (my guess is, commonly not; these systems have extremely strong security implemented in kernel code). By the way, Solaris 10 will include many key security features that were only available in Trusted Solaris before (including privilege sets and compartment-like process separation).

Book hint: "The Inside Story of the IBM iSeries" by Frank Soltis, the system architect of the iSeries 400 (aka AS/400) and OS/400; especially interesting because of the fact, that this system's design is very different from common hard- and software architecture;

Look at these:

IBM z/OS V1.x
one vulnerabilty (in Sendmail, which was ported to z/OS)
By the way, most (if not all) parts of z/OS were written in PL/1.

IBM OS/400 - V4.x, V5.x
zero vulnerabilities
(Note, that OS/400's kernel ("SLIC"), written in C++, is absolutely closed code (afaik you can't even access its machine code on the iSeries 400's DASD), so nobody outside IBM knows, what kind of bugs might be in that kernel; anyway, because of its single-level storage architecture, this system has hardware pointer-in-memory protection, which, as a side-effect, prevents many of the most dangerous kinds of exploits, for example overwriting of return-addresses, overwriting of function pointers and such; so it's impossible to "smash the stack" on this machine)


Conclusion:
===========

To err is human; as long as people use Assembler, C or similar programming languages, they will probably cause buffer overflows and similar bugs; for this reason, we should take advantage of more intelligent hardware architecture, including features like tagged pointers and special CPU instructions for modifying addresses (so you still can change a function pointer, but only if you use the correct instruction; overwriting it using instructions for copying data areas (MOV on intel) would cause the pointer protection hardware to invalidate the pointer). Better hardware is a good foundation for better software. "Protected mode" (memory protection, preemptive multitasking, ...) brought us stable operating systems; some new hardware could get us stable and secure operating systems. By secure I DON'T mean hardware-addons like TCPA. TCPA is inadequate for a free-programmable computer architecture.

Use a suitable programming language to implement applications; you don't need to mess around with direct memory access, pointers and such, if you're programming software for accounting or a spread sheet application. Many commercial applications for z/OS and OS/400 are written in COBOL, PL/1, etc. rather than in C, and they do not seem to have nearly as many critical bugs as most C programs; OpenVMS people will tell you the same story, I don't know what programming language they used to write most of their applications, but I know it wasn't C.
If you can't get an open source Ada, Cobol, PL/1,... compiler, at least use C++ (use std::string).
Don't forget Java; java programs might not be as fast as compiled code, but especially non-GUI applications are still pretty fast, and Java is a well-designed language.

Unfortunately, there are no results for trusted operating systems such as Trusted Solaris; it would be interesting, whether the same bugs that are critical on standard operating systems could cause system access or any similarly critical escalation of privileges on trusted operating systems (my guess is, commonly not; these systems have extremely strong security implemented in kernel code). By the way, Solaris 10 will include many key security features that were only available in Trusted Solaris before (including privilege sets and compartment-like process separation).

Book hint: "The Inside Story of the IBM iSeries" by Frank Soltis, the system architect of the iSeries 400 (aka AS/400) and OS/400; especially interesting because of the fact, that this system's design is very different from common hard- and software architecture;

Look at these:

IBM z/OS V1.x
one vulnerabilty (in Sendmail, which was ported to z/OS)
By the way, most (if not all) parts of z/OS were written in PL/1.

IBM OS/400 - V4.x, V5.x
zero vulnerabilities
(Note, that OS/400's kernel ("SLIC"), written in C++, is absolutely closed code (afaik you can't even access its machine code on the iSeries 400's DASD), so nobody outside IBM knows, what kind of bugs might be in that kernel; anyway, because of its single-level storage architecture, this system has hardware pointer-in-memory protection, which, as a side-effect, prevents many of the most dangerous kinds of exploits, for example overwriting of return-addresses, overwriting of function pointers and such; so it's impossible to "smash the stack" on this machine)


Conclusion:
===========

To err is human; as long as people use Assembler, C or similar programming languages, they will probably cause buffer overflows and similar bugs; for this reason, we should take advantage of more intelligent hardware architecture, including features like tagged pointers and special CPU instructions for modifying addresses (so you still can change a function pointer, but only if you use the correct instruction; overwriting it using instructions for copying data areas (MOV on intel) would cause the pointer protection hardware to invalidate the pointer). Better hardware is a good foundation for better software. "Protected mode" (memory protection, preemptive multitasking, ...) brought us stable operating systems; some new hardware could get us stable and secure operating systems. By secure I DON'T mean hardware-addons like TCPA. TCPA is inadequate for a free-programmable computer architecture.

Use a suitable programming language to implement applications; you don't need to mess around with direct memory access, pointers and such, if you're programming software for accounting or a spread sheet application. Many commercial applications for z/OS and OS/400 are written in COBOL, PL/1, etc. rather than in C, and they do not seem to have nearly as many critical bugs as most C programs; OpenVMS people will tell you the same story, I don't know what programming language they used to write most of their applications, but I know it wasn't C.
If you can't get an open source Ada, Cobol, PL/1,... compiler, at least use C++ (use std::string).
Don't forget Java; java programs might not be as fast as compiled code, but especially non-GUI applications are still pretty fast, and Java is a well-designed language.

Unfortunately, there are no results for trusted operating systems such as Trusted Solaris; it would be interesting, whether the same bugs that are critical on standard operating systems could cause system access or any similarly critical escalation of privileges on trusted operating systems (my guess is, commonly not; these systems have extremely strong security implemented in kernel code). By the way, Solaris 10 will include many key security features that were only available in Trusted Solaris before (including privilege sets and compartment-like process separation).

Book hint: "The Inside Story of the IBM iSeries" by Frank Soltis, the system architect of the iSeries 400 (aka AS/400) and OS/400; especially interesting because of the fact, that this system's design is very different from common hard- and software architecture;

There is truth in your statement, however, it does not change the fact that Windows and its associated applications have a significantly larger number of flaws when compared to the competition.

If you look at the secunia statistics for IE you find that by itself it has nearly as many exploits as competing operating systems and all their associated applications combined.

secunia.com/product/11/

burnin

In the XP stats they show one advisory for IE. But looking at the exploits statistics on the same website you find that the one Microsoft application by itself has about as many exploits as other competing operating systems and all their applications combined:

secunia.com/product/11/

Sorry Windows lovers, its time to face the facts, your OS of choice and associated applications are a haven for worms and viruses not because there are so many of you, its because the software is crap.

burnin

Agreed, and your point can be proven even with the secunia statistics. They show XP with only one advisory for Internet Exploerer and yet Internet Explorer by itself had about 40 exploits by itself during the same period of time this MS shill is reporting on.

secunia.com/product/11

burnin

There are two major things wrong with this article, which have been touched on by other posters. One is that the number of vulnerabilities is different than the number of advisories, because advisories can cover multiple vulnerabilities.

The second is that (as other posters have covered) Linux distributors post advisories and bug fixes for all software bundled with their distribution, not just the kernel and core libraries. Looking at the list of MS Windows XP advisories, all I see are the core components, with the glaring omission of Internet Explorer (which these days is in fact a core component of the operating system).

There are two major things wrong with this article, which have been touched on by other posters. One is that the number of vulnerabilities is different than the number of advisories, because advisories can cover multiple vulnerabilities.

The second is that (as other posters have covered) Linux distributors post advisories and bug fixes for all software bundled with their distribution, not just the kernel and core libraries. Looking at the list of MS Windows XP advisories, all I see are the core components, with the glaring omission of Internet Explorer (which these days is in fact a core component of the operating system).

There are two major things wrong with this article, which have been touched on by other posters. One is that the number of vulnerabilities is different than the number of advisories, because advisories can cover multiple vulnerabilities.

The second is that (as other posters have covered) Linux distributors post advisories and bug fixes for all software bundled with their distribution, not just the kernel and core libraries. Looking at the list of MS Windows XP advisories, all I see are the core components, with the glaring omission of Internet Explorer (which these days is in fact a core component of the operating system).

There are two major things wrong with this article, which have been touched on by other posters. One is that the number of vulnerabilities is different than the number of advisories, because advisories can cover multiple vulnerabilities.

The second is that (as other posters have covered) Linux distributors post advisories and bug fixes for all software bundled with their distribution, not just the kernel and core libraries. Looking at the list of MS Windows XP advisories, all I see are the core components, with the glaring omission of Internet Explorer (which these days is in fact a core component of the operating system).

I was looking at Secunia's Virus Info Page .. right under the graph it says "Based on Information delivered by BullGuard".

That set off a few bells... Know what BullGuard is? It's spyware that happens to come bundled with Kazaa. Amusingly, you can see BullGuard on Kazaa's *cough* No Spyware Policy Page, where they try to pretend that their bundled software isn't spyware.

And simply reading the article is exactly what this Microsoft shill is expecting everyone to do.

This may be asking alot, but I'd like everyone to dig a little deeper and actual go to the secunia.com website and poke around at the statistics yourself. What you will find is that the guy who wrote this article is either too damned lazy to fully research his topic or he is intentionally using these statistics inaccurately in order to prove a false point.

For those who don't have the time to find out for themselves what the statistics REALLY say, here is what I found:

In the secunia.com statistics for Windows XP there is only a single exploit related to Internet Explorer. That sounds pretty good but its also blatantly false.

In fact, if you dig a little deeper into the statistics on their web site you discover that Internet Explorer 6 from 2003 to 2004 had 40 advisories by itself with 98% allowing remote attack and 31% enabling system access.

secunia.com/product/11/

So taking into account all the IE vulnerabilities instead of grouping them into one advisory we suddenly discover that Microsoft Windows XP Proffessional had 86 advisories from 2003 to 2004 with 71% allowing remote attacks and 38% enabling system access!

Now some will say "not fair" because IE is a seperate application. All I can tell you is that if you actually looked at the statistics you would already know that the OSX and linux statistics include security advisories for ALL applications included in with the OS. So it is only fair to also include ALL Windows applications that come with Windows.

So in conclusion, when I include the vulnerabilities of just one single Windows application the number of exploits in Windows is around double what you have with the likes of OSX or linux. I suspect that including other Windows applications that were excluded from the Windows statistics everyone will begin to understand why Windows is a haven for worms and viruses.

I don't think I will be migrating from my Mac OSX and linux installs any time soon.

burnin

Or did, at any rate. For a number of years the US Army used Mac OS 9 and Webstar to host www.army.mil. Looking at Netcraft now, they've moved to OS X but are still using Webstar, which has a much lower rate of vulnerabilities then Apache.

Or did, at any rate. For a number of years the US Army used Mac OS 9 and Webstar to host www.army.mil. Looking at Netcraft now, they've moved to OS X but are still using Webstar, which has a much lower rate of vulnerabilities then Apache.

I wonder...Could it be another case like we've see in the past where a "think tank" gets funding to do research and the later everyone finds out that the company/companies that funded the study are the one that the data showed to be better that all the rest. I wonder where secunia gets there funding for this new study. I tryed looking around on their webpage, but i didn't find the info i was looking for anywhere.

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

From the products page of the Secunia web-site:

• Apple Macintosh OS X
• Linux Kernel 2.4.x
• Linux Kernel 2.6.x
• Microsoft Windows 2000 Professional
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• OpenBSD 3.x
• RedHat Linux 9
• Sun Solaris 9

Browsing through Secunia's Site doesn't reveal too much regarding the report mentioned in the article. The links to the vendor's security pages do show that Apple, Suse, and others list vulnerabilities and security issues for products not developed by the particular company. Apple lists Apache, OpenSSH, rsync, and others. Since most Linux and BSD operating systems report security vulnerabilities in third party applications. Thus listing Suse and Redhat as having 48 and 50 vulnerabilities respectively 57 of them are probably the same vulnerabilities.

In my experience Microsoft only lists security vulnerabilities for their own products. With the methods used in these statistics vulnerabilities and the open source community are probably overcounted many many times over.

Secunia is probably just trying to get attention.

Friends, it's clear from Secunia's own data that we should all switch back to MacOS 9, since Secunia knows of only one security issue for that OS.

Friends, you just can't argue with pie charts.

These are the statistics that really matter:

Secunia Virus Statistics

Of course you'll notice the common Win32. in front of all of them.

http://secunia.com/multiple_browsers_frame_injecti on_vulnerability_test/

So you visit a M$ page in IE with all that bollocks... so funny it really is a sham all the spin from M$.

http://secunia.com/advisories/10395/

All XP sp2 will bring is more eXtra Problems #2.

In every case where there has been a problem with Windows security, it's been AFTER they released a patch for the vulnerability. Every one!

- "Microsoft issued a software patch, MS03-032, on Aug. 20 that was supposed to fix the problem. However, that patch failed to close the hole on Windows machines running Internet Explorer Versions 5.01, 5.5 or 6.0.
On Sept. 8, Microsoft acknowledged problems with the MS03-032 patch and promised to issue a fix as soon as possible. Since that time, no changes have been made to the MS03-032 patch. In the succeeding weeks, hackers moved quickly to take advantage of the company's slow response." ( Computerworld.com )

- "Two vulnerabilities have been reported in Internet Explorer, which in combination with other known issues can be exploited by malicious people to compromise a user's system.
1) A variant of the "Location:" local resource access vulnerability can be exploited via a specially crafted URL in the "Location:" HTTP header to open local files. ...
2) A cross-zone scripting error can be exploited to execute files in the "Local Machine" security zone.
Secunia has confirmed the vulnerabilities in a fully patched system with Internet Explorer 6.0. It has been reported that the preliminary SP2 prevents exploitation by denying access.
Successful exploitation requires that a user can be tricked into following a link or view a malicious HTML document.
NOTE: The vulnerabilities are actively being exploited in the wild to install adware on users' systems." ( Secunia )

- "The flaw, which is different from RPC DCOM flaw that spawned the Blaster and Nachi worms, makes Windows XP and 2000 servers vulnerable to denial-of-service attacks because of a multi-threaded race condition that exists. A remote attacker could crash the RPC service simply by sending multiple RPC requests. The vulnerability occurs if two threads process the same request, thereby corrupting memory.
Microsoft still has not released a patch for the flaw, leaving nearly every Windows XP and 2000 system exposed to potential exploits. Microsoft may, however, be preparing an all-encompassing RPC patch that would address this issue and previous flaws surrounding the network service, said Gerhard Eschelbeck, chief technology officer with Qualys Inc., at RSA Conference 2004. RPC is a protocol that one program can use to request a service from another program located elsewhere on a network." - ( searchsecurity.com )

- "Attackers are taking advantage of a security hole in Internet Explorer not immediately patched by Microsoft
Security experts have warned that a vulnerability that has apparently been left un-patched by Microsoft is being exploited by attackers "in the wild".
The "object type" vulnerability, which was first acknowledged publicly by Microsoft on 20 August this year, allows an attacker to take control of a system by embedding malicious code in a Web-page. If the Web page is viewed by an Internet Explorer browser - even a fully patched browser - the malicious code embedded in the Web-page will execute, experts say. Despite Microsoft acknowledging the patch doesn't work, it evidently has not yet issued a working fix for the vulnerability.
US-based information security company iDefense released a statement over the weekend claiming the vulnerability is being actively exploited "in the wild".
"Whether you are patched or not, attackers can execute code on your computer at will when you visit a hostile website when using vulnerable versions of Internet Explorer," the statement read.
The relevant Microsoft bulletin was issued on 20 August and last updated on 8 September." - ( ZDnet - but then again, you didn't say "...after

How's postfix's security record? i.e. Can I set up a postfix server, then go on an 18-month holiday and be confident that my box will still be working when I get back (like I can with qmail)?

You can be very confident that it will be. Postfix uses privilege separation, runs as its own user account (not root), and is designed with a chroot environment in mind. It's also very componentized and designed so that a breach in one component can be isolated without a risk to the others. To the best of my knowledge, there has never been a remote code execution vulnerability in Postfix.

The last major security problem was a year ago and was just a DoS possibility. Even qmail has DoS problems. Before the DoS, in 2002 there was a problem that might allow someone to use Postfix to portscan another system (no risk to the system running Postfix). Both of these were in the older 1.1 version. The 2.x series, released in 2002, has never had a security problem bad enough to warrant an advisory for.

The only other thing I could find is djb ranting about a Postfix problem that has been fixed for over 6 years.

FYI, Secunia's Advisory about the vulnerability

That in of itself makes it more insecure. I mean, it uses Windows' SSL whereas Mozilla has its own SSL. It has Windows remember passwords whereas Mozilla has a password manager. Mozilla just being a stand alone app makes it safer in that regard. And even a recent exploit caused by an issue with file extension spoofing vulnerability was an issue only with IE. Mozilla still showed the file's name in its entirety.

Seeing as how IIS 6 has had no (that's right, 0) reported vulnerabilities in the year since its release, and Apache 2.0.x (core) has had on the order of eleven, I think your comparison is a bit of a broken reed.

> Again, this is an OpenSSL issue, not an Apple issue,

I find this a rather unhealthy attitude. If you include other peoples code because it makes your software more featureful, their problems are also your problem. You can't have it both ways.

> WTF? An "unspecified vulnerability" that "has not been confirmed"? Did the lawyers from SCO write this article?

This is exactly what the article is about. Apple released patches to CoreFoundation, but didn't state exactly what vulnerability it fixes. That's what Secunia is railing against, that from the Apple docs, it's impossible to tell how serious the issue is.

I believe 5 refers not to the number of patches but to the number of vulnerabilities the patch is supposed to fix, see the Secunia advisory.

Not only does the article offer only very little in the way of evidence, but the whole point of the article appears moot. My favorite quote at http://secunia.com/advisories/11539 (linked from the article):

"Solution:
Apply Security Update 2004-05-03."


(The article is dated "04 May 2004")

Secunia also alerted about this worm several hours ago, they have a great page about it with lots of details: Sasser worm details