Windows Vulnerabilities Revealed, Patched

Saint Aardvark writes "A big MS Windows remote vulnerability has just hit BugTraq. It concerns a buffer overflow in MS' DCOM, and affects Win2k through Server 2003; here's the security advisory from Microsoft. This is in addition to an earlier vulnerability concerning conversion from HTML to RTF - there's a separate security advisory from Microsoft for this one, and it affects Win98 and NT 4.0 through Server 2003. Patch early, patch often." There's also a CNET News story with a little more explanation on the newest vulnerability.

Comments

*G*

[rylin]

So much for homeland security ;)

Re:*G*

[pileated]

Some people say God is a Jokester. You have to wonder if that's not true when news coincides in such a wonderful way.

heh

[Anonymous Coward]

Microsoft admits critical flaw in nearly all Windows software

...The announcement came one day after the Department of Homeland Security announced that it awarded a five-year, $90-million contract for Microsoft to supply all its most important desktop and server software for about 140,000 computers inside the new federal agency

Re:heh

[Anonymous Coward]

That's from here btw.

Re:heh

[Anonymous Coward]

So there aren't any critical flaws in the Mac OS? Linux?

A system is as secure as the patches applied to it.

Re:heh

[Anonymous Coward]

That's what I thought of when I read 'Patch early. Patch often.'

There's vulnerabilities/flaws of some sort in every operating system, otherwise you'd never need a new release except to add new hardware support/features.
What? You really thought there was that much of a feature/driver difference between Linux 2.4.x and 2.4.x-1?

Re:heh

[Anonymous Coward]

I don't think the Department of Homeland Security has anything to worry about. If you hack into Homeland Security then you must be a terrorist, and you will be pursued with great vengeance and furious anger, more than likely. With the Patriot Act also in existence, is there anyone brave enough to attack the Department of Homeland Security?

Re:heh

[Grishnakh]

Sure, any crackers who aren't living in the US. While the US may think its laws apply to all parts of the globe, there's still places that don't have extradition treaties.

Re:heh

[UnrefinedLayman]

The point is this is a remotely exploitable system level hole.

It's important to note that the system account is god in Windows -- even Administrator has less power than system.

Re:heh

[hkmwbz]

Or could it be that the system is as secure as it was built to be from the ground up, rather than relying on patches to be secure? Or, to rephrase, isn't it better that the system is built for security to begin with? Didn't a Microsoft representative say that their products had never been created with security in mind, but "we'll make it better now, honest!"?

Re:heh

[sebi]

Would you be so kind and write out words the way they are supposed to be written in the future? Poorly obfuscated profanities always give me such a nasty headache.

Re:heh

[buffer-overflowed]

Actually, the flaw is my fault. Didn't you read the summary?

I'm an evil demon that tricks programmers into not bounds checking. ::Cackle::

Re:heh

[epiphani]

This patch that was released - well, I installed it on my home machines today. It screwed up my OpenGL libraries. Considering it should have absolutely nothing to do with OpenGL, microsofts patches are making me EXTREMELY nervous.

Re:heh

[Anonymous Coward]

Heh What amount of the DHS users actually "use" something that has to have security.

E-Mail is insecure in it's basic premise (could it be better YES but is it secure enough for 80% of the users out there or are you afraid that some idiot/user will E-Mail someone the gov't is going to attack coordinates 70.38 by 112.32?

while I believe in security the weakest link is the thing between the monitor and chair.

No amount of "security" will stop stupidity.

Re:heh

[k8er]

140,000 seems like a lot of computers for an upstart federal agency. They must be trying to help out the ole unemployment situation. Or could it be kickbacks?

Re:heh

[whatch durrin]

As I have nothing of *that* much importance on my box, I'll take the chance and NOT update. I've heard these update stories too many times before.

Re:heh

[Anonymous Coward]

Is this more than "root" in linux, and if so, how is the "system" account utilized? Is the system account only used when the windows software is compiled?

Re:heh

[sqlrob]

It's more and less.

It has diddleysquat for network access.

It has more control over the local system - even Administrator can't kill System processes. Win32 itself is a System process, as well as many of the services.

Compiling under Windows does not require any special privilege, you only need Administrator level to install software, and some software doesn't need even that.

Re:heh

[Anonymous Coward]

>While the US may think its laws apply to all parts of the globe, there's still places that don't have extradition treaties.

Uh... extradition? Shit, we'll just send a few marines over to collect your "enemy combatants", mmmm-K?

Re:heh

[Tony-A]

As I have entirely too much that *is* important on my box, I'm not taking any chances. I'm not updating.

Re:heh

[Trusted Content]

lol

Re:heh

[Dan9999]

well it also has to do with speed, drivers run with the kernel, hense the system account, not as separate processes so that the overhead of process switching and security checking doesn't slow the system down. This is an extreme simplification of the case but... the next level that has to be secured and this level has to get it's bugs fixed.

It should be more difficult for processes to install or modify drivers, but this won't stop the processes that run system functions with bugs so that any old code can be run under the system process, you've heard of one type of bug I'm sure, buffer underruns...

If there was a vote for a hardware security verification upon changing signed code that is run by the system account or letting the system account run any code that is not signed, then I vote YES, and welcome everyone to the era of signed code hacks if yes actually wins :P

Re:heh

[Anonymous Coward]

I installed the patch, and OpenGL works just the same as it did before. Obviously the problem you're having is user related..

Re:heh

[bigman2003]

I applied the patch to dozens of machines today, I didn't have a single problem.

Just wanted to increase the sample size..

Re:heh

[Anonymous Coward]

Or you're not pushing the same areas of OpenGL as the OP. Quick to judge, but never to think.

Re:heh

[derF024]

As I have nothing of *that* much importance on my box, I'll take the chance and NOT update. I've heard these update stories too many times before.

While I can sympathize with your situation of living in mortal fear of updating your software (such is life when using microsoft products), Please please please lock your machine up behind a firewall of some sort (software firewalls don't count.) While you've got nothing of importance on your machine, You have an IP address and the ability to send spam or other malicious traffic to the entire internet should your machine be broken into.

Re:heh

[kasperd]

Compiling under Windows does not require any special privilege, you only need Administrator level to install software, and some software doesn't need even that.

That is no different from other systems.

Re:heh

[Anonymous Coward]

uh, bullshit. I can remove "system" permissions from Files/folders/services, etc. Sure it'll hurt some things like AV and backup, indexing, etc, however Administrator is indestructable, it can and will take control even when system can't.

Re:heh

[TheNetAvenger]

Or, to rephrase, isn't it better that the system is built for security to begin with? Didn't a Microsoft representative say that their products had never been created with security in mind, but "we'll make it better now, honest!"?

Ok, NT was built with security as its main feature, pick up Inside Windows NT so you don't sound silly next time you post.

The NT platform, which includes Win2k,XP,2003 have a token client/server object based security model, which is something that no *nix to this date has or even matches.

So a new flaw has been found in a piece of Windows, and one of the first flaws in Windows 2003 Server.

Let's compare this to an average Linux distribution security alert list from the past week.

[15 Jul 2003] DSA-350 falconseye - buffer overflow
[14 Jul 2003] DSA-349 nfs-utils - buffer overflow
[11 Jul 2003] DSA-348 traceroute-nanog - integer overflow, buffer overflow
[08 Jul 2003] DSA-347 teapop - SQL injection
[08 Jul 2003] DSA-346 phpsysinfo - directory traversal
[08 Jul 2003] DSA-345 xbl - buffer overflow
[08 Jul 2003] DSA-344 unzip - directory traversal
[08 Jul 2003] DSA-343 skk, ddskk - insecure temporary file

Although not many are too serious, but denial of service, and gaining full access to the Linux server do seem a bit of a problem. Of course since this Linux distribution didn't come from Microsoft, I'm sure we won't see any of these in the main press.

Additionally since it didn't come from Microsoft we won't see posts upon posts how 'Security has never been a priority to Linux' as has been stated about Microsoft Windows.

Sure I will give you full credit that Win3.1, Win95, Win98, and WinME were NOT designed with security in mind.

But I do have to stand up when you say that any of the NT kernel based products were 'never created with security in mind'.

Not only is this not true, as it was a main design goal for the NT project, but it is also a slap in the face of people like Cutler and many of the other NT creators that were some of the top OS and Unix gurus of the time.

Even something as SIMPLE as obtaining C2 level government security certification is something NT obtained, but yet I see no listing of any Linux distribution even meeting this 'dated' and simple security certification.

Re:heh

[x0n]

Not quite true. The system account, aka localsystem, does not have access to network resources. A big difference.

Re:heh

[phaze3000]

There have been 0 linux security advisories in the last week. The advisories you mention are in software that can run under Linux. If you're going to count all software that runs under Linux as a Linux vulnerability, then by extension you have to include all software that runs under Windows as a Windows vulnerability.

The reason this is a big issue isn't because it's a whole in a Microsoft product, it's because it's a whole in the core operating system. Note that /. is also making a big deal of the IOS vulnerability (quite rightly). Stop screaming about bias and start looking at the facts.

Re:heh

[hkmwbz]

"Ok, NT was built with security as its main feature, pick up Inside Windows NT so you don't sound silly next time you post."

I'm just echoing what a Microsoft representative said recently.

It did the rounds on Slashdot and other sites, including CNET and all those. A Microsoft representative said that they had been bad at security so far, but now they started their "security initiative" to make their products more secure. Did you not see this, or are you just here to throw around nonsensical statements about how others are silly when they criticize Microsoft?

Bill Gates even sent out a note about how they would have to start focusing on security rather than features:

http://news.com.com/2100-1001-816880.html

Now maybe you can get back to answering my questions, rather than ignoring the issue altogether: Microsoft have been focusing on features rather than security in the past - by admission of a representative of Microsoft, and also Bill Gates himself.

Re:heh

[Anonymous Coward]

C2 for NT was achieved on a machine minus CD drive and NIC card. (bet that's a machine we all want)

C2 is no longer used by the govt. It's been replaced by something called Common Criteria which Red Hat has obtained.

Re:heh

[Anonymous Coward]

> The advisories you mention are in software that
> can run under Linux

But aren't most of the programs identified part of most distributions' standard ISO image, which in most cases get installed by default? I think it's fair to include if it's on the CD, unlike "all software".

Re:heh

[linuxelf]

If I'm not mistaken, it wasn't just a Microsoft representative, but the very high ranking executive Jim Allchin. He then went on to say that some Microsoft code is so flawed that merely disclosing the source code would constitute a national security threat.

Re:heh

[tsa]

If you're going to count all software that runs under Linux as a Linux vulnerability, then by extension you have to include all software that runs under Windows as a Windows vulnerability.

We'll just have to wait until they integrate Word in Windows. Any day now...

Re:heh

[TheNetAvenger]

There have been 0 linux security advisories in the last week. The advisories you mention are in software that can run under Linux

I would assert that a bug in a component that is shipped with and used by the basic NFS of Linux is a serious problem, especially considering the severity of the bug.

Call it a component and not part of Linux if you want, but it is still shipped with most Linux distributions and NFS is used as a 'part of Linux' on a daily basis.

I could also argue that NTFS is not a part of Windows, because the NT kernel has no allegiance to any File System as well, but if there was a problem in NTFS or the network access of NTFS, then we could pretty much call it a 'Windows' problem.

Go blow smoke up another hole.

Re:heh

[schon]

But aren't most of the programs identified part of most distributions' standard ISO image

No. You listed 8 notices. "Most" means at least 5 of them must be present - there are 2 apps there that would be included as part of a standard distro.

which in most cases get installed by default?

No. Unzip may be installed as part of standard system utilities in most distros, but the rest of them (including NFS) won't get installed "by default". You have to explicitly install it. It may come on the CD, but it doesn't get installed unless you want it there.

Please take your troll somewhere else. If you're going to attempt to do this, you should at least learn a LITTLE about Linux - otherwise you just look like a moron.

Re:heh

[TheNetAvenger]

Now maybe you can get back to answering my questions, rather than ignoring the issue altogether: Microsoft have been focusing on features rather than security in the past - by admission of a representative of Microsoft, and also Bill Gates himself.

First I was responding to your words, not mine... Didn't a Microsoft representative say that their products had never been created with security in mind...

Now, I will again assert that this is NOT what any person from Microsoft has ever conveyed.

Microsoft noted that with previous generations of Windows, such as 3.1, 95, 98, and ME, security was not a major focus of the products. And that as a whole, the company could have been doing a better job, especially as the desktop leader, to provide a higher level of security for its consumers.

However SECURITY has been a MAJOR role of NT since 1992, and holding to its track record of maintaining a VERY credible security history from C2 certification, to maintaining secure Web Sites even on NT4 that was in the mid Internet boom and the beginning of new security attack techniques that were developed about that time.

So re-read the words from any source at Microsoft you quote.

NT was built to be secure from day one, and even with the evolution of security exploits, I would say that an OS that is as OLD as NT 4.0 is, it holds a pretty good pattern of having a solid internal security system, and the ability to easily extend past the initial security concerns that it was designed to protect at the time to protect against new attacks that have become common since its release.

My company specifically has deployed NT4 and Win2k in many government installations, and to this day, we have NEVER had a client have their system compromised while running NT4 or Win2k.

Unless you can find a quote that specifically says that security was NEVER a priority or concern on the NT platform, I will stand by my words. NT was built as security being a top priority, that is why the underlying security system is an object/token based system that has features reaching far beyond what we can currently get in any *nix. Period.

Re:heh

[Anonymous Coward]

Stock NT as it installs (say NT4 workstation) is not C2 compliant. you have a LOT of setup and lockdown to do to get there.
Besides, didnt MS get most of NT and it's features from OS/2 (they jointly developed it until version3)

Re:heh

[Anonymous Coward]

I would assert that a bug in a component that is shipped with and used by the basic NFS of Linux

What, exactly is "the basic NFS of Linux"?

NFS is a utility suite which gets installed if the administrator specifically installs it.

It is no more "part of Linux" than Apache, Samba, Sendmail, or any other server software which may or may not be installed (and in this case, usually not.)

I could also argue that NTFS is not a part of Windows, because the NT kernel has no allegiance to any File System as well, but if there was a problem in NTFS or the network access of NTFS, then we could pretty much call it a 'Windows' problem.

And you would be right. HOWEVER, NFS is not even REMOTELY similar to NTFS.

NTFS is a file structure used by the disk.

NFS is a NETWORK SERVER.

If you had used "IIS" as an example, instead of NFS you would have a much closer analogy - but then (of course) your argument would fall apart as well. (As nobody here has claimed that IIS is a part of Windows.)

So instead of conceding that you're wrong, you demonstrate that you have NO IDEA what NFS is, but decide that it might support your point if everybody is as ignorant as you.

Go blow smoke up another hole.

Physician, heal thyself.

Re:heh

[Anonymous Coward]

However SECURITY has been a MAJOR role of NT since 1992, and holding to its track record of maintaining a VERY credible security history from C2 certification

Man, you're just full of it.

NT's C2 security rating is BS... you have a machine with no CD, no network card, and no modem. Yeah, that's REAL "credible".

What about the most recent RPC vulnerability? Hmm, didn't MS say that would not be fixed in NT4? EVEN THOUGH NT4 IS STILL A 'CURRENT' PRODUCT? Yeah, that's real dedication to security. A remotely exploitable security vulnerability. Which can give administrator access. In an actively supported product.

And the vendor says "we won't fix it, 'cause it's too difficult.'

If you consider that "holding to its track record", then I can understand why you believe MS products have good security.

it holds a pretty good pattern of having a solid internal security system, and the ability to easily extend past the initial security concerns that it was designed to protect

This is EXACTLY why MS has such a poor record - security is a system, not a product. You don't "add security" to something, and you don't try to anticipate the types of attacks that might happen - you have to design in security from the ground up... which is something that MS has failed to do. The sheer number of exploits against NT proves that MS has not done this.

My company specifically has deployed NT4 and Win2k in many government installations, and to this day, we have NEVER had a client have their system compromised while running NT4 or Win2k.

And that proves what, exactly?

My company has deployed Linux in many installations, and has never had a system compromise. And unlike you (since you're harping on C2 so much), ALL of our systems are connected to the internet.

NT was built as security being a top priority

Just because someone says "security is a top priority" doesn't mean that they actually know how to make a product secure.

that is why the underlying security system is an object/token based system that has features reaching far beyond what we can currently get in any *nix.

Man, you are just so stupid it's unreal. Are you sure you're a real person, and not a script? If you really believe this, then you know even less about security than I thought you did. Perhaps you should turn off the computer and go back to your job flipping burgers.

Re:heh

[Anonymous Coward]

So, you're playing Unreal, Q3, and other OpenGL games on all those dozens of machines, are you?

Re:heh

[bigman2003]

Well, on at least two of them...yes..

Re:heh

[TheNetAvenger]

And you would be right. HOWEVER, NFS is not even REMOTELY similar to NTFS.

NTFS is a file structure used by the disk.

NFS is a NETWORK SERVER

You missed the point completely.

First off, even though NTFS is a file system, it is 'integrated with the networking security model of NT' and NTFS provides the basic security mechanisms that are used by the object based security model that is used in NETWORK access of NTFS volumes. It is INTEGRATED with the Networking security structure that NT offers.

Sure NFS is not a 'part' of the base OS, just like 'Microsoft File & Printer Sharing' is not a 'part' of the base OS or the base kernel of NT. Actually NTFS isn't even a part of the BASE kernel of NT. (Remember installable file system technology here)

However, the point I was making is that NFS is a 'commonly used' component (just like "Microsoft File Sharing" is a 'commonly used' component of WindowsNT.

And for there to be so many SEVERE security flaws in such an 'intrinsic component' is quite disturbing.

If NFS was designed like the NETWORK access is in NT with the additional NTFS security model, it would not solely rely upon its security mechanisms of sharing. You see with NT, not only do you have the Networking sharing security mechanism for volume access, you also have to get through the NTFS security system before you can access files on any volume.

No matter whether the user is accessing them locally, from a Networking Share, FTP, IIS, or any other form of volume access you can imagine not only do you have to get through the Networking mechanism for security but NTFS as well.

Conviently...

[jointm1k]

... discloded after they got the Homeland security account. >_

Re:Conviently...

[suss]

... discloded after they got the Homeland security account.

Yeah, like it's a big secret that microsoft products are insecure... come on, it's not like they're stupid and/or oblivious at the department of Homeland Security, are they...?

Re:Conviently...

[Anonymous Coward]

I presume you meant convently discloding, i.e., removing earth in a manner typical of buildings where nuns live.

Re:Conviently...

[Anonymous Coward]

come on, it's not like they're stupid and/or oblivious at the department of Homeland Security

Heh, that's a +5 Funny if ever there was one.

Re:Conviently...

[Anonymous Coward]

How is this insightful? The Homeland Security account was a done deal probably weeks before it was announced.

Re:Conviently...

[grp]

You're right, all Linux software is 100% secure and has never had a hole.

Why is it that whenever someone criticizes Windows for insecurity, the only retort is a jab at Linux?

Though personally, if I wanted to make that kind of argument, I would've mentioned the remote root exploit in SSH in the default install of OpenBSD as a counterexample to this.

Also, the MUCH MUCH higher use of Windows has nothing to do with it.

Neither does the fact that the source code is closed.

Re:Conviently...

[Overly Critical Guy]

Why is it that whenever someone criticizes Windows for insecurity, the only retort is a jab at Linux?

Because when someone acts as though Windows is completely insecure, they 99% of the time pretend Linux is the all-secure "solution."

Neither does the fact that the source code is closed.

Open source software doesn't automatically mean secure code. See? You illustrate my point above.

Re:Conviently...

[grp]

Because when someone acts as though Windows is completely insecure, they 99% of the time pretend Linux is the all-secure "solution."

Linux wasn't mentioned in this thread until you brought it up.

Open source software doesn't automatically mean secure code. See? You illustrate my point above.

I didn't pretend that Linux or even open source software is the "all-secure 'solution'" I was making a point that "higher use" is about as good an argument as closed source vs open source.

Re:Conviently...

[Overly Critical Guy]

Linux wasn't mentioned in this thread until you brought it up.

I didn't state otherwise.

I didn't pretend that Linux or even open source software is the "all-secure 'solution'" I was making a point that "higher use" is about as good an argument as closed source vs open source.

Higher use is completely logical. Windows has complete market dominance. See how many exploits Linux would have if it were in +95% of the market.

Next.

Re:Conviently...

[grp]

Higher use is completely logical. Windows has complete market dominance. See how many exploits Linux would have if it were in +95% of the market.

Ok, lets talk about Linux then. Linux (lets assume we're talking about the OS including userland tools) had many more exploits during its earlier days than Windows 95/NT had at that time. Linux was known to be insecure and was a hackers playground. If you were running Linux and had it connected to the internet, you were practically asking for your system to be compromised. Now things have flip-flopped. Windows seems to have more exploits, and everyone pretty much assumes Linux is safer than Windows (I'm the paranoid type who won't believe any software is secure so I don't want to take either side).

My point is, Linux was certainly not in high use at the time, yet it had more exploits. This was probably due to the immaturity of the software. It has much higher use these days (than it did before), yet less exploits.

Windows is the opposite. It has much higher use these days, yet more exploits.

The relationship between higher use and number of exploits may seem logical, but its a bit too vague of an idea to really claim that it is one of the reasons for the large number of exploits.

Generalizations are difficult to make when it comes to security. A lot of the claims we can make are only theory. It is definitely an interesting area to watch, and will be interesting to see what patterns emerge over the coming years.

Re:Conviently...

[Overly Critical Guy]

My point is, Linux was certainly not in high use at the time, yet it had more exploits. This was probably due to the immaturity of the software. It has much higher use these days (than it did before), yet less exploits.

Windows is the opposite. It has much higher use these days, yet more exploits.

So what you're saying is, Linux was immature software and had lots of exploits, then time passed and it got better. And Windows has much, much, much higher usage, so there are obviously more exploits.

You haven't really offered a point here. What's the relevance of Linux's immaturity in the early 90s to this discussion? You still admit Windows has higher usage and therefore more exploits.

You and I both know that if Linux were 98% market share, Linux would be non-stop exploits. Ever heard of any major insecurity issues with old MacOS server? No? Of course not, because hardly anyone uses it.

The relationship between higher use and number of exploits may seem logical, but its a bit too vague of an idea to really claim that it is one of the reasons for the large number of exploits.

You're clearly an idiot. For the 98% or so market share that Windows has--think about how much usage that is--Windows does a pretty damned good job of security. It's painfully obvious that when the vast majority of computers in the world are running the same software, you get "many eyes" on it and therefore the targeting of hackers.

Generalizations are difficult to make when it comes to security. A lot of the claims we can make are only theory. It is definitely an interesting area to watch, and will be interesting to see what patterns emerge over the coming years.

Nice ambiguous backtrack.

Next.

Re:Conviently...

[grp]

What you are saying cannot be proven. Its purely theory.

You're clearly an idiot.

Calling someone an idiot -- the mark of a true a genius. Ha!

Nice job of trying to twist around what I say to try and fit it to your argument. Now I expect another personal attack of some sort and/or another attempt to try and prove something that can't be proven.

Re:Conviently...

[Overly Critical Guy]

Clearly you're upset that you offered no point. Declaring what my response will be is a convenient tact of a weak position. Get back to me when you attempt to actually offer anything.

Next.

Re:Conviently...

[grp]

Me upset? No. Disappointed with your weak response that didn't offer any substantial argument, yes. I may only be 17 years old, but I have more of clue than you in the area of security, obviously. Reply to me only once you've gotten a clue.

How many aren't?

[Anonymous Coward]

Such a common problem, that stack.

Re:How many aren't?

[Anonymous Coward]

thanks yoda...

More info and POC ...

[bigjocker]

More info here, here and here. Here internetnews.com state that 3 vulnerabilities (not 2) where patched.

Here is the report from the people who found the vulnerabilities (or at least one of them) which includes a proof-of-concept paper and code.

Re:More info and POC ...

[Anonymous Coward]

No it was only two. The third vulnerability was introduced with the fix for the second vulnerability, then patched.

That's how these security rollups work, right?

Re:More info and POC ...

[rritterson]

Yes, there was a third vulnerability patched, but it only affected win9X and not the newer NT kernal OS's

Re:More info and POC ...

[jorupp]

The 'paper' and 'code' links in the parent post are not to a paper and code that exploit this, they are to the tools they used to write the exploit.

Re:More info and POC ...

[Anonymous Coward]

Mod this reply up plz.. he is correct the link does not pertain to the article

Re:More info and POC ...

[Anonymous Coward]

This is the relevent link at lsd-pl.net not the link the parent posted.. as stated in the securityfocus.com (BugTraq) article proof of consept has been with held at this time here
Responsible disclosure sucks

Re:More info and POC ...

[bigjocker]

Yes, sorry, I stand corrected, the code and paper pointed in my previous post is not the "direct" proof-of-concept code, but tools that have been used by them to find the exploits.

Nontheless the link to the lsd-pl.net article contains a lot more info (technical info) than any other source

Re:More info and POC ...

[Anonymous Coward]

Even if you do learn to speak correct English, whom are you going to speak it to? -- Clarence Darrow

That's hilarious, especially considering that it's not grammatically correct. It ends with a preposition. I expect Clarence Darrow (?) must have done that on purpose.

winnuke all over again!

[sporty]

The vulnerability results because the Windows RPC service does not properly check message inputs under certain circumstances. This particular failure affects an underlying Distributed Component Object Model (DCOM) interface, which listens on TCP/IP port 135.

Sounds like we'll haev winnuke2003 sometime soon. :)

<disclaimer>I know that winnuke uses OOB data vs this which does something on the application layer. :P</disclaimer>

Re:winnuke all over again!

[netsharc]

Calling it win2003nuke would also be appropriate. Yeah, Flagship Server Product, but the rats are eating through the hull!

Re:winnuke all over again!

[AndroidCat]

Yet another bloody buffer overflow! Why can't a single company impose internal standards for checking and handling buffer overflows, especially on ports facing the Internet?

Re:winnuke all over again!

[interiot]

Yeah, except that whereas the original winnuke only breaks your network connection or crashes your machine, winnuke2003 can format your hard drive, set your computer up as a porn server, launch a DDoS against amazon, or any other fun stuff 12 year olds can think of.

Re:winnuke all over again!

[Anonymous Coward]

Nobody in their right mind puts Port 135 on the Internet.

Re:winnuke all over again!

[H310iSe]

This particular failure affects an underlying Distributed Component Object Model (DCOM) interface, which listens on TCP/IP port 135.

In a related story, the US Dept. of Defense today announced that since 'repeated threats to national security' have been associated with Ports 135-137 the Army has launched Operation Port Closure. Citing the same 'support for terrorists' clause they used on Afganistan, they are terminating with 'extreme predjudice' anyone who harbors this nefarious port and the terrorists it breeds. Once locations are found, cruise missles will be sent to ensure 'permenate port closure'.

The president told the nation 'these ports are used by terrorists who hate freedom.' When he was informed the first cruise missles fired hit the Department of Homeland Security he simply nodded his head knowingly. 'even here, we must forever be on guard against freedom-hating port 135 lovers. Even here...'

Re:winnuke all over again!

[AndroidCat]

Nor most of other ports that Microsoft opens up willy-nilly. SQL Server, messaging, file sharing, etc. Hell, I wouldn't open up IIS on port 80!

Re:winnuke all over again!

[corsec67]

Just wait until a remote exploit is discovered that goes through the power. Then simply removing the ethernet cable would not even be enough.

Really, there is a major virus infecting computer around the world, and it is called "Windows".

patch beat slashdot

[Anonymous Coward]

im just downloading the patch before reading the slashdot story even. microsofts possibly getting better?

Re:patch beat slashdot

[ergonal]

I received the Microsoft Security Bulletin mailing-list emails (with patch directions) 4 hours ago while I was sleeping. I still wouldn't say Microsoft is getting "better" though. They'd be getting "better" if the vulnerabilities didn't exist in the first place! :P

It's somewhat funny though that in a closed-source system how people are still finding vulnerabilities. Can you imagine how many vulnerabilities would be found in the first day of Microsoft releasing their source code to the world? I think the number would be staggering.

Re:patch beat slashdot

[Anonymous Coward]

it's not that microsoft is getting better.... it just means that you're not checking slashdot often enough....

shame on you! ;)

now go to slashdot.org and practice hitting that 'refresh' button

Re:patch beat slashdot

[Anonymous Coward]

"They'd be getting "better" if the vulnerabilities didn't exist in the first place! :P "

That's a paradox of almost Terminatoresque proportions!

"It's somewhat funny though that in a closed-source system how people are still finding vulnerabilities. Can you imagine how many vulnerabilities would be found in the first day of Microsoft releasing their source code to the world? I think the number would be staggering."

I would always expect there to be more bugs in closed source code, simply because only a limited number of people get to see it. You also have to take into account "wood from trees" syndrome. A lot of coders can work so close to a task that finding a bug or testing code adequately is usually best handled by someone else. I guess MS mainly do product testing, and I doubt a product tester could ever be technically competent enough to exploit a buffer overflow while testing Word 2006 or whatever...

MS needs to learn that bugs go way, way deeper than crashes.

Re:patch beat slashdot

[gotr00t]

Still, don't forget that the vulnerability was THERE, way before Microsoft revealed the nature of it. They didn't tell you about it until they releaesd the patch to it.

Would you trust a company that obviously hides the truth about the very foundation of your computer software base?

Re:patch beat slashdot

[Martin Blank]

Would you prefer that all of the vulnerabilities for any piece of software be made public before the company has a chance to fix it? Cisco, Oracle, Microsoft, Red Hat... Every programmer/software company likes to be notified of the vulnerability so it can be fixed prior to a patch being released.

Re:patch beat slashdot

[FuzzyBad-Mofo]

Ever consider that large portions of the Slashdot readership possibly have no need for the patch?

Re:patch beat slashdot

[Jord]

Actually in the open source world since everything is open EVERYONE is notified at the same time of a security issue. They "company" is not notified first since there is no "company" to notify.

This is opposite of what some closed source companies want to happen to them. They want to be the ONLY ones notified and then they will announce that it was fixed. Personally I think that they should be notified the same time that that the news media are notified so that people who are up on the security issues can protect themselves until a patch is made available. With this one it seems that people could have closed port 135 to avoid the vulnerability until MS fixed it. Now the question is, how many people for how many years have been victims of this exploit? Guess we will never know.

Re:patch beat slashdot

[MattCohn.com]

Hah! I've got Opera, automatically re-freashes the page ever 5 Seconds! Take that Slashdot! Take that E-Bay! No honney, I wont come to bed... I'm WORKING!

Re:patch beat slashdot

[Anonymous Coward]

wow i cant believe you work at one of those linux only employers... must be nice. not to mention have no realitives/friends that use windows ever. well it is slashdot the latter is probably truer than the foremer

Re:patch beat slashdot

[Anonymous Coward]

Every programmer/software company likes to be notified of the vulnerability so it can be fixed prior to a patch being released.

Everyone but Microsoft anyway. They usually seem happy enough to release patches before they (correctly) fix the vulnerability.

Re:patch beat slashdot

[Anonymous Coward]

That's not true. Most Open Source projects maintain private channels for security issues and don't disclose the bug until it's fixed. This includes Linux-Kernel, Apache, Mozilla, and so on.

Re:patch beat slashdot

[jdennett]

Whereas I read the slashdot story, and then attempted to use Microsoft's software update facility from IE6 to download the patch -- only to be told that my system was up to date. It wasn't, so I downloaded the patch and applied it manually.

For critical security updates, don't rely on the automatic update tools yet.

Re:patch beat slashdot

[H310iSe]

yea, but the post above (linking to technical info on the exploit, but not an actual exploit) was based on a paper from last November. I wonder how long this one has been just under the radar?

Re:patch beat slashdot

[cscx]

Automatic update downloaded the patches when I was at work, and they were waiting for me when I got home. ;)

Re:patch beat slashdot

[deranged unix nut]

Considering that Windows Server 2003 has been out for a few months, has been touted as being much more secure than any previous product, and these are the first security problems to be found, yes, this is progress!

Oracle's "Unbreakable" claims were shown up with dozens of major vulerabilities within a couple weeks of their Ad campaign.

Previous MS products have had required fixes within weeks of their release.

This, to me, looks like significant improvement. They seem to recognize that security is important, have made major improvements, and are looking at the places where they still need to improve and adding checks for those problems as well.

(Now, watch bugtraq and ntbugtraq and compare the Windows Server 2003 problems with the linux problems.) ...btw, MS source code is available to academia...

Re:patch beat slashdot

[bnet41]

better question....How many lay people would know how to close port 135? With out your local techie most people would never know about this. The release of these bug reports only really matter to people in the know. Not sure what we can do to help people out since even Linux has problems, and I know these same lay people wouldn't be any better off in downloading patches, turning off various things, or blocking ports.

Re:patch beat slashdot

[blueskies]

And academia is where all the l33t coders are? What are we calling MS source code here? Microsoft definitly keeps a firm grip on who has access to it's bread and butter. Besides I'm sure they have a clause that requires them to report any bugs they found to them and not the general public, so you're not going to hear about it.

Most of the "linux problems" are application problems and not the linux kernel. I mean anyone can write shitty code and release it as their new open source project.

Re:patch beat slashdot

[blueskies]

So you don't mind getting r00ted, oh, i mean Administrat0red by the people that do know about the bug until the patch comes out?

If you mean public as in no one in the world knowing about the bug then i agree with you. it would be awesome if the only people that knew about a bug were the developers.

But if the information is out there for other people, i need to know how to mitigate the damage until a patch does come out.

Re:patch beat slashdot

[deranged unix nut]

Most of the "linux problems" are application problems and not the linux kernel. I mean anyone can write shitty code and release it as their new open source project.

Yeah, and when was the last time a Windows security bug was found in the kernel? I can't remember ever seeing one.

Nope, academia is not where the "l33t coders" are, it is where students have tons of free time on their hands, where people actually study how vulerabilities work, where people know how to write the exploits instead of grabbing "l33t" scripts off the web, and where if the grad student can't demonstrate their vulnerability then they can't defend their thesis and don't graduate.

I haven't looked recently, but as of 5 years ago, you could get the source for NT 4.0 (at the time, their latest and greatest)...I'm guessing that at least the source for w2k if not w2k3 is available now. There is some sort of NDA, but I'm not sure if there are other restrictions.

Re:patch beat slashdot

[Anonymous Coward]

You have the temerity to sleep whilst running MS software?

You insensitive Beowulf cluster of clods

Re:patch beat slashdot

[linuxelf]

But, didn't Jim Allchin recently say that they (Microsoft) can't release their source code for many products because it is so bug ridden that releasing it would constitute a national security risk?

Re:patch beat slashdot

[Rip!ey]

I would have thought that relying on /. for Microsoft update notification would be even worse than using the automatic update system.

If you don't like automatic update, then try registering with Microsofts Security Notification Service.

Re:patch beat slashdot

[CowboyMeal]

Yeah, and when was the last time a Windows security bug was found in the kernel? I can't remember ever seeing one.

s/kernel/things\ you\ can\'t\ uninstall/g

Re:patch beat slashdot

[deranged unix nut]

That is like saying that X-Windows is part of the kernel because you can't uninstall it without breaking half of your applications.

Get your terminology straight, talking apples to oranges just feeds the flames.

Re:patch beat slashdot

[Ironica]

Considering that Windows Server 2003 has been out for a few months, has been touted as being much more secure than any previous product, and these are the first security problems to be found, yes, this is progress!

It would be progress, if this wasn't a problem that pre-existed Server 2003 by several years in prior Windows versions. Instead, it's evidence that even if they're more security conscious *now*, they have a tremendous amount of catching up to do.

Re:patch beat slashdot

[jdennett]

Yes, relying on /. would be stupid, so naturally I don't do that. Relying on MS alone is also unwise. Bugtraq, automated updated (with supervision), slashdot, and warnings from clueful friends are better than any one source alone.

Bad

[The Bungi]

But if you keep port 135 open on your DMZ boxes, you deserve to be hanged with a piece of CAT-5 cable.

Re:Bad

[Anonymous Coward]

THat's right. And all/most attacks come from the outside, right?

I gotta firewall, no one can get to my 5h1t

Re:Bad

[Homology]

But if you keep port 135 open on your DMZ boxes, you deserve to be hanged with a piece of CAT-5 cable.

Consider the usual : A Windows client on the internal network is infected with a virus that may exploit this buffer overflow. Since port 135 is not firewalled on the internal network, your Windows servers are hacked. And the rest is history.

In addition we have all those home Windows boxes connected direct to the Internet with no firewall/virus-detection. Another playground has been opened for script kiddies.

Re:Bad

[Anonymous Coward]

But if you keep port 135 open on your DMZ boxes, you deserve to be hanged with a piece of CAT-5 cable

Not a reason not to patch though, as someone will probably break into your Linux box running Apache on port 80 and then launch an attack on all the Windows boxes from there, taking them over and using Samba to copy to their hearts content.

Re:Bad

[Sloppy]

It just takes one single MS Outlook or MS Internet Explorer user. Then the attack comes from inside the firewall.

Unless you're really smart: put all the Windows users inside the DMZ.

Re:Bad

[Anonymous Coward]

Yes, inside the DMZ where they will be the target of even MORE attacks. Good idea buddy. =P

Re:Bad

[Anonymous Coward]

ergo the end-security argument is good? security can only be 100% implemented at the end, which is application/os and not the firewall even if it runs on the end-machine itself.

jugling with ports is not somethink buffout joe would want to do, several calls to tech support "why cant any connect to my startcraft session" and "why cant i send my picture to BritneySpears14 on IRC."

Re:Bad

[Anonymous Coward]

If you aren't running some form of a real-time virus scanner software you should hang yourself as well. There is no excuse in this day n age to get a virus anymore. 10 years ago maybe but not today.

Re:Bad

[Anonymous Coward]

"we have all those home Windows boxes connected direct to the Internet with no firewall/virus-detection"

we do? perhaps we need a cheap firewall or router.

and for god sakes pirate norton!

Re:Bad

[CTho9305]

That is how we lost all network connectivity for about 8 hours a few weeks ago. Someone connected a slammer-infected laptop the the network, and pretty soon the slammer traffic brought the network to a standstill.

Re:Bad

[Anonymous Coward]

This is what happened to us with Nimda. None of our Lan people were in the least bit worried about it, saying our firewall protected us.

Then internet access started getting slow...

Then the firewall guys came in to reboot/investigate why the firewall wasn't responding...

Re:Bad

[EvilTwinSkippy]

But if you keep port 135 open on your DMZ boxes, you deserve to be hanged with a piece of CAT-5 cable.

Most network admins are too portly and would sheer CAT-5 cable. Better to use Fiber-Optic cable. It has a higher tensile strength.

Re:Bad

[SCHecklerX]

anti-virus software is pretty much useless. Viruses are a *SOCIAL* problem, not a technical one. In fact, I'd say that anti-virus software itself can be just as damaging to using your machine as any virus..note anybody whose virus scanning is set to paranoid, going through its thousands of hashes on every single file read/write.

Re:Bad

[Anonymous Coward]

Easiest way to infect a WHOLE COMPANY is to get a virus or trojan onto a home-based VPN system.

Unfortunately, many IT people are ignorant of passable security. Or (probably true in MORE cases), IT does what policies management dictates.

Managers want VPN? They got it! Any chance you can get DEDICATED corporate boxes for home for VPN use? No way!

End result is most people VPN in on the same "personal" (private) systems they use for Kazaa, Outlook Express, and their porn collection. Exactly the kind of things prohibited on the physical network.

Re:Bad

[Mostly a lurker]

Most network admins are too portly and would sheer CAT-5 cable. Better to use Fiber-Optic cable. It has a higher tensile strength.

Moderation: Informative

New /. feature request: I want the ability to moderate moderations as funny!

Re:Bad

[grp]

Unless you're really smart: put all the Windows users inside the DMZ.

Surely you can't be serious?

Maybe firewalling off your servers from your users is a good idea (if possible), but putting users running any OS inside the DMZ is a bad idea.

Re:Bad

[Sloppy]

Heh. Well, put 'em somewhere where they can't access the important servers. ;-)

Re:Bad

[Teh Bungi]

Hello. Guess who?

Bad One?

[blackmonday]

They hid this one until they patched it, but in light of the previous post about the US government relying so much on MS software, it makes me uneasy. This exploit let the attacker take control of the PC. Not good if you're running the bad guy database.

Re:Bad One?

[Anonymous Coward]

Let me give you a hint: the "bad guy database" isn't connected to the outside world. The only way to get at that (whatever you were referring to) is to have an account on that network, and the right passes and codes to get into the building where it's stored. That's standard operating procedure for many, many secure systems, and I'm sure the US gov isn't any different :).

Re:Bad One?

[Anonymous Coward]

Unfortunately it's impossible to simultaneously isolate the data and connect it without external databases. They may try to sanitize the data before it is transfered in, but there's always a chance for the data to be corrupted in such a way as to exploit a flaw.

Re:Bad One?

[datawar]

Just speculation, but it would make sense for the Federal government to have special agreements with vendors of software of they use to inform them of any potential vulnerabilities as soon as they are discovered, so that the government's SysOps can take proper precautions...

Re:Bad One?

[FLoWCTRL]

Yes... and there are probably lots of exploits that never get published, just used. Now do you want your government relying on this software to store data such as the Total Information Awareness Program, for example? (Oh, I see they renamed it...)

Would you want your business to rely on it? I find it utterly astounding that so many PHB's still think its a good idea. A German beaurocrat who was pitching open source insightfully quipped, "'Security through obscurity' is the model of yesterday. The model of the future is 'Security through transparency'". Thats a paraphrase, and I'm too lazy to look it up. Great point, though. Maybe this new vulnerability will lead to another "slammer" worm...

Re:Bad One?

[Anonymous Coward]

That's standard operating procedure for many, many secure systems, and I'm sure the US gov isn't any different

You don't want the truth. You can't handle the truth.

Re:Bad One?

[Aadain2001]

All it takes is a route into the internal network for a black hat hacker with any skills (that means not script kiddies) to dig his way to that database. And if the same vulnerablility exists on ALL the machines on the network, he can basicly go where he wants when he wants. Scary, isn't it?

Re:Bad One?

[andreMA]

I wish I had your faith that common sense and bureaucracy could peacefully co-exist..

Poll: Tinfoil hat mode ON!

[Atario]

Why does MS come out with patches so often?

1. To get you used to installing whatever they tell you to, you good little sheep
2. To appear to be constantly updating, just like all those punk kids with their Open Source and their Rock and Roll Music and such
3. To save money on testing costs

Re:FP TIME FUN QUIZ

[Anonymous Coward]

Can you hear me now?

Proof of concept?

[shinnyo]

Proof of concept? >:)

Dupe

[Anonymous Coward]

We just had a story about a security vulnerability in WIndows!

Windows is dying.

[Anonymous Coward]

Dragonfly BSD's corpse will crush it!

Last Stage of Delirium Research Group

[Peter_Pork]

The guys that found this vulnerability have an amusing web site. It looks rather professional for the underground (?) community. I bet the wear white coats while they hack.

Re:Last Stage of Delirium Research Group

[netsharc]

For the underground community maybe. But someone there has an arrows >>> <<< fetish, pointing at every direction.. the bottom of the page even has one ">>>", but clicking it gets you to the top of the page.. wtf?!?

To be more of the topic, why the hell do people love it so much to put links that "Go back to the top of the page"? Tell the users to press "Home" damnit!

Re:Last Stage of Delirium Research Group

[AKnightCowboy]

Tell the users to press "Home" damnit!

Because pressing Home takes you to www.msn.com!! ;-)

Re:Last Stage of Delirium Research Group

[netsharc]

D'oh! Good point.

And nowadays Multimedia keyboards come with a "Home" button that opens up your browser and default home page, so even telling them to press the "Home" key on the keyboard will not get the desired effect. At least Logitech calls it "My Home", it opens a "Buy more Logitech products!" page.

Re:Last Stage of Delirium Research Group

[EvilTwinSkippy]

Now all we need is an ANY key.

Technet article

[Anonymous Coward]

Article

nt4

[denthijs]

so finally the first unpatchable bug for NT4 is here.
i know i'm not the only greyhat who smiled when they heard of the patching-stop for NT4
aaaah, the joys of an nonsupported, yet still heavily used platform
happy cracking y'all

Re:nt4

[PDHoss]

weird, I just patched this very bug for NT4 from Windows Update. YMMV, I guess.

Re:nt4

[Anonymous Coward]

Posting without reading yeah?

Its here http://www.microsoft.com/technet/treeview/?url=/te chnet/security/bulletin/MS03-026.asp.

Re:nt4

[Anonymous Coward]

Happy Birthday to You!
Happy Birthday to You!
Happy Birthday dear denthijs!
Happy Birthday to You!

Happy 13th Birthday from all of us here at Slashdot!

Re:nt4

[interiot]

I know this is slashdot, but please read the article that you kindly provided a link for. Support will be provided for NT4 up to December 31, 2004.

Re:nt4

[isn't my name]

I know this is slashdot, but please read the article that you kindly provided a link for. Support will be provided for NT4 up to December 31, 2004.

NT 4 Server, not NT 4 client. NT 4 client support, according to MS, was supposed to disappear at the end of June. If you look at the MS Technet article for this problem, you see that they mention NT 4 as being affected but in the patches section they list the following:

Download locations for this patch

* Windows NT 4.0 Server
* Windows NT 4.0 Terminal Server Edition
* Windows 2000
* Windows XP 32 bit Edition
* Windows XP 64 bit Edition
* Windows Server 2003 32 bit Edition
* Windows Server 2003 64 bit Edition



Don't know if the NT 4 server patch will work on an NT 4 client machine.

Re:nt4

[figleaf]

Have you looked at the technet article for this patch?
Patches are available for NT Server as well as NT workstation.

Re:nt4

[isn't my name]

Figleaf wrote: Have you looked at the technet article for this patch?
Patches are available for NT Server as well as NT workstation.

I don't know if you can download an NT 4 client patch, but from the technet article linked in my first post, here are the systems affected:

Affected Software:

Microsoft Windows NT® 4.0
Microsoft Windows NT 4.0 Terminal Services Edition
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server(TM) 2003

Not Affected Software:

Microsoft Windows Millennium Edition

And here is the list of available patches:

Patch availability
Download locations for this patch
Windows NT 4.0 Server
Windows NT 4.0 Terminal Server Edition
Windows 2000
Windows XP 32 bit Edition
Windows XP 64 bit Edition
Windows Server 2003 32 bit Edition
Windows Server 2003 64 bit Edition


It may be that MS has an NT 4 client patch. It may be that the NT 4 server patch works on NT 4 client, but I do not see anything in the TechNet article that indicates a patch for NT 4 client.

Re:nt4

[figleaf]

click on the 'Windows NT 4.0 Server' patch link.

Re:nt4

[isn't my name]

They certainly don't make it easy to find do they?

Does this mean that all NT 4 Server patches will work on client and that the Client support really extends through the end of next year?

Why do that?

port 135 um...

[Anonymous Coward]

why would anyone not block this port on their firewall? ive had it blocked for years. i think you can also find out peoples shares with this port but am not 100% sure.

blocking this port should be as common sense as password protecting shares.

Re:port 135 um...

[Homology]

It's also common sense to have patched up boxes, but still old exploits works because this is not done.

Re:port 135 um...

[interiot]

Yup, I'm still getting hit (on an apache server so it doesn't bother me) with Code Red probes, like 2.5 years later. And one of the main reasons Nimbda was successful is that it piggybacked on unpatched still-infected codered machines.

I would patch

[Anonymous Coward]

It's a shame. I really like using windows, and I would like to patch my machine, but I don't trust Microsoft anymore. Their 'patches' come with new licensing terms and spyware. :(

Re:I would patch

[Anonymous Coward]

This is what passes for +5 insightful these days?!

Re:I would patch

[malakai]

Their patches come with SpyWare? Are you kidding me?

Are you sure these 'patches' you are applying weren't annoymously sent to you in an e-mail message? You know the mail message, where every sentance has a gramatical error in it ("I give you these patches in hopes that we protect your system together"), and the From line simply says "Microsoft Support People".

Then I could believe you got spyware from a patch. But otherwise, you're just full of FUD.

-Malakai

An apropos blast from the past

[sigelman]

From: Bill Gates
Sent: Tuesday, January 15, 2002 5:22 PM
To: Microsoft and Subsidiaries: All FTE
Subject: Trustworthy computing

"Every few years I have sent out a memo talking about the highest priority for Microsoft. Two years ago, it was the kickoff of our .NET strategy. Before that, it was several memos about the importance of the Internet to our future and the ways we could make the Internet truly useful for people. Over the last year it has become clear that ensuring .NET is a platform for Trustworthy Computing is more important than any other part of our work. If we don't do this, people simply won't be willing -- or able -- to take advantage of all the other great work we do. Trustworthy Computing is the highest priority for all the work we are doing. We must lead the industry to a whole new level of Trustworthiness in computing."

They are right to attribute such great importance to trustworthy systems -- and I do believe they are trying -- but 30,000,000 lines of code necessarily lead to opaque semantics. Good luck, MS, I think this will be one of many such deficiencies in Server 2003. Repeated claims of security and "trustworthiness" from their higher-ups will place the company in a boy-who-cried-wolf marketing scenario; at that point they're up a creek.

Re:An apropos blast from the past

[FLoWCTRL]

And by "Trustworthy", what Gates means is that "Microsoft, Sony, the RIAA and other content producers can trust that our fiendish users won't pirate our goods". It is a campaign of control and profiteering, and has little to do with improving the security situation for M$ users.

Re:An apropos blast from the past

[Rob Simpson]

Hmm...does "Trust" have the same relationship to "trust" as Truth has to the truth?

wrong

[Anonymous Coward]

the answer is in the post

Re:Poll: Tinfoil hat mode ON!

[Xerithane]

Why does MS come out with patches so often?

Probably similar reasons as to why Linux-contributors release patches so often.

Because software has bugs. That's what software is for.

Re:I patched this one a long time ago

[Anonymous Coward]

Too bad you installed an entirely NEW set of vulnerabilities!

Download Patch

[Anonymous Coward]

Wholesome patch can be downloaded by ftp from your closest mirror: The Windows Fix

Re:Poll: Tinfoil hat mode ON!

[x136]

Not that any of your possibilities are necessarily wrong, but you left out the obvious. :)

4. Because Windows is a piece of shit.

Here we go again

[coolmacdude]

Thank you Microsoft. I was beginning to feel for a minute there that the security holes were becoming less and less frequent and that Windows might not be such a dangerous platform after all. I really thought that trustworthy computing was starting to live up to its name. I was sure that I was getting a sincere vibe from Redmond that ol' Stevie boy had really decided to make a genuine effort to not have his users' data be preyed upon by script kiddies and cracker freaks. I would like to express my deepest gratitude to you for shaking me out of this delusional reverie, bringing me back to reality, and reinforcing my intention to never to use your operating system ever again.

Re:Here we go again

[FLoWCTRL]

I really thought that trustworthy computing was starting to live up to its name.

The motivation behind Trustworthy Computing is all about Digital Rights Management and copyright enforcement - it has little to do with fixing the seemingly infinite number of buffer overflow vulnerabilities that lead to total system compromise in Micro$soft's operating systems.

Here's some links about it if you want more information.

Re:Here we go again

[coolmacdude]

Yeah, I'm not up on all the latest MS terminology. I just used a few things I remembered randomly for my rant. :)

Re:Here we go again

[Anonymous Coward]

So by your definition "Trustworthy Computing" means all the bugs were fixed the day they announced it? Get a clue here. Be happy they are announcing and attacking security flaws aggressively. Would you rather they always wait till the latest and greatest virus is out for an exploit they haven't fixed? Wake up to the real world.

Re:Here we go again

[coolmacdude]

Yes but the problem is no matter how many they fix there will always be more. Who knows how many more are still in there just waiting for someone to discover and exploit them, dozens? hundreds?

What do you know...

[GMFTatsujin]

The only thing that works correctly in Windows ME has finally been discovered.

Re:What do you know...

[200_success]

No, it just means that the exploit doesn't work correctly on Windows ME. =)

Re:What do you know...

[GMFTatsujin]

Damn. I wish I'd thought of that :)

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

Why does the open source movement come out with patches so often?

1. Because they're all unemployed amateur hobbyists churning out sub-par code in the first place?
2. To appear to be constantly updating, because their products are so laughably inferior and dated.
3. Because they have no money to spend on testing.

And this is a suprise?

[felonious]

How many major flaws can winOS's have? They know they can patch it to death and the weak outcry from the public fades in a couple days.

Since we have to pay out the ass for most of their software how about a rebate system for serious exploit/holes/flaws? I say for every exploit/hole/flaw found that can give the bad user on the other end total control of the box Microsoft should issue a "I'm Sorry" rebate check in the amount of $50 or an instore credit for some other piece of shit software they sell that I have no use for. They can afford to do this and it might make them go over the code a little better and possibly employ some people to try to hack the shit out of it to find the weaknesses. It always seems to be the same type of exploit just done in a different manner.

WTF do I know I'm just a customer...

Re: I don't want to start a holy war here,

[TheOnyx]

Oh, I dunno. I guess I just like the fact that I can play something other than TUX RACER on a WinBox. All joking aside, I've used both Linux and Windows, and if there were more native applications and driver support for Linux, I'd switch to it. So, like, go hound developers and stuff.

Vulnerability

[Jason_says]

*News Flash!! A new vulnerability through buffer overflow has been found on computers. The new vulnerability does not appear to affect Unix, Linux, BSD, or Mac users. This of course only leaves very few commercial operating systems left, but we will not tell you right out which OS that this buffer overflow directly relates to. Thank you and have a nice day.

Turnaround time...?

[seldolivaw]

Much as I hate to give MS any ground on security, it does seem their lag time between vulnerabilities and patches is getting shorter recently. Amazing what some fear of competition will do :-)

Re:Turnaround time...?

[Anonymous Coward]

Patches have been in the works for 6 months or more. There is a extremely serious DC bug that was not announced until SP4 that can kill(DOS) any DC internal to a network in minutes via BSOD. Kudo's to Microsoft for ignoring the author and leaving millions vulnerable.

Re:Turnaround time...?

[toddestan]

Lets see, this vulnerbility has been in Windows since NT was released, and it's now July 2003 and they are just getting around to patching it?

Oh, you mean the turnaround time until it is *discovered* and the patch.

I guess the point is, with open-source software such as Linux, the chance of big gaping security holes hanging around for years is much less. People look in the code and get them fixed up fairly quickly. This hole had been in Windows for years, and thus virtually every Windows server on the planet could be a victim. I doubt that could happen in Linux.

Re:Turnaround time...?

[freeweed]

You mean like the remote Samba root exploit that was in the code for something like a decade?

Not a troll, just figure I'd point out that this cuts both ways.

Having said that, Linux beats Windows hands down in my books, for one big reason: I don't even know how to close port 135 on a Windows machine, without killing other services. AFAIK the RPC service is pretty much tied up together, and many applications won't work without it.

Stock Linux install leaves maybe 2 ports open.. oh wait, 0 if you let IPtables do its thing. In Windows, I'm still busy playing whack-a-mole trying to close the 15 or so ports XP insists on listening on.

Or maybe it's easy in Windows, and I've just given up learning how to lock a machine down with every release. Anyone ever figure out how to *permanently* close those idiotic admin shares?

Re:Turnaround time...?

[swissmonkey]

Oh yeah, like wu_ftpd, sendmail, bind and openssh which have been around for years, and we still have day 1 security vulnerabilities in these.

Re:Turnaround time...?

[rusty0101]

Anyone ever figure out how to *permanently* close those idiotic admin shares?

Um, overwrite the disk and put [Open|Free|Net]BSD on it?

No, I don't happen to use any of them either. I happily converted over to Linux some time ago, and don't see any good reason to switch back to a Microsoft product. At the moment I don't see a good reason to switch to BSD either, as my systems do pretty much exactly what I expect of them.

-Rusty

Re:Turnaround time...?

[Anonymous Coward]

Ok, let me get this straight.

Linux is better for you because you are a moron and don't know how to admin a Windows machine?

Uhh, like turning on the built in firewall in XP is that difficult for you?

Thank you for the clarification.

Re:Turnaround time...?

[Fallen_Knight]

Actualy it seems it was discovered in november and was sat on untill a patch was ready.... so same old slow microsoft.

Re:Turnaround time...?

[kahei]

Suggests that THEY found the vulnerability a year ago, made a patch, and then waited to see if anyone ELSE found it before releasing the patch.

That'd be standard practise in the commercial IT world. Of course, in open source there's always someone who wants to look real important and expose vulnerabilities as soon as possible, so you don't get the same pattern developing.

Not that I give a shit about the whole open source / microsoft thing.

Re:Turnaround time...?

[Anonymous Coward]

You mean like the remote Samba root exploit that was in the code for something like a decade?

Yeah, let's have that cut both ways. That Samba exploit was covered on Slashdot, as well as an interview with the developer of that code. In it, he mentioned that a number of vulnerabilities in Windows had been discovered during the development of Samba. Although he informed MS about them, he said that many of them HAD NOT BEEN DEALT WITH! ...after "something like a decade" when they had first been told of them.

So:
1. It took a decade to find the hole in Samba, but as soon as it was found, they fixed it.
2. MS has known about problems in their code for 10 years, but as long as nobody exploits it, they aren't gonna fix it.

Which OS would you rather have running on your machines?

In other news....

[jinglecat]

....Reports confirm that the sun does, indeed, rise and set everyday.

....Reports show that tomorrow with be Thursday the 17th of July.

....Reports illustrate that humans need Oxygen to breath.

....Reports describe that this is OLD Microsoft news and is something to be expected and is not front page news-worthy.

Re:In other news....

[myz24]

Actually, I like that it makes front page, it's just that much less reason to have not patched your system. I had no idea this had come out with out slashdot. Then again, I do live by if it's on slashdot, it must be true!

Re:In other news....

[Anonymous Coward]

....Reports show that tomorrow with be Thursday the 17th of July.

Where I'm sitting *todays* Thursday the 17th of July.

Well that's better than...

[Anonymous Coward]

Creating brand new bugs with every "stable" Linux kernel release! Anyone even LOOK at the issues lists for releases or pay attention to the kernel mailing list? If the contents of those "documents" were made public, Linux would lose every corperate/government contract they had! The file system/hardware/security bugs that get INTRODUCED as well as patched with each version is frightening.

This article is so completely pot/kettle/black that most regulars here should be getting pretty tired of it by now.

Re:Well that's better than...

[Valar]

If the contents of those "documents" were made public

Well, I'll assume they are, seeing as you are OBVIOUSLY not a kernel developer yourself and yet you seem to be talking about those very contents...

Re:Well that's better than...

[brunorc]

If the contents of those "documents" were made public

Yes, if the content of every memo in M$...

The file system/hardware/security bugs that get INTRODUCED

So if every new version of Windows has less bugs than previous, imagine, how buggy was 95! :-P Microsoft has no "unstable" or "developer" versions. And you may think that installing Service Pack will make you happy and secure. This is not true. First of all, your system will be "updated" with a lot of stuff you don't need. Second - sometimes new patches introduce new bugs, over and over again. Every system has some bugs, holes etc. But they should be patched, not claimed to not exist.

Re:Well that's better than...

[Anonymous Coward]

Obviously I mean if some Microsoft evangelist group started waving them around the way you guys wave every shred of anti-MS propiganda around. Or couldn't you figure that out?

Glass house?

Throwing stones?

Come on. This is all just going to be blown back in our faces. It's very irritating to hear 100x as much apology as progress. Stop apologising, start admiting, start fixing the problem!

Re:Well that's better than...

[Valar]

There is a microsoft evangelist group that does that. It's called microsoft. And if you just look at their ad campaigns in publications aimed for sysadmins, you see numerous examples of microsoft marketing they mud slinging rather talking about the benefits of their own products. Clearly, there are bugs in microsoft software. Clearly, there are bugs in linux. There are bugs in *BSD, etc. The difference between the open source and closed source examples is I can DO something about the bugs in open source software, whereas my solution for bugs in closed source software is to wait for a patch or write a less bug open source replacement.

Re: I don't want to start a holy war here,

[Tharn]

goatse, GGNA, and now this clown. Getting harder and harder to browse at -1, damnit!

Re:Poll: Tinfoil hat mode ON!

[lostindenver]

Take you ha off and deal ALL (yes ALL) Software has bugs, Exploits or problems. Before you show your Ignorance compare how many realeases your favorite distro has had and compare it to MS. No I am not a ms Zealot but dude Chill out and reasearch. I really hope you do not have anything to do with ANY network i deal with.

Trustworthy Homeland

[Eberlin]

I see this as a cross between trustworthy computing and homeland security. Now that the deal has been set, I figure there's not much else to be said there.

We now need on ensure that our homeland is trustworthy. Whether that means full disclosure and a decrease in FUD, I don't know. (political implications intended)

As for operating systems and security vulnerabilities, holding back information regarding possible security threats until they're fixed (knowingly exposing systems in the meantime) DEFINITELY isn't trustworthy.

Re:Trustworthy Homeland

[Anonymous Coward]

As for operating systems and security vulnerabilities, holding back information regarding possible security threats until they're fixed (knowingly exposing systems in the meantime) DEFINITELY isn't trustworthy

^^^^^^^^^^^^^^^^

So you'd rather they release the information regarding the exploit with no fix so dumbasses can start working on a virus now? You look completely incompetent using this approach.

This isn't some small software company like Adobe where an exploit will effect a small amount of users. This is an OS. You WANT them to have a fix in hand before reporting the problem. Otherwise you're saying "Hey everyone, come fuck me in the ass...and don't forget the lube, please!"

Re:Trustworthy Homeland

[Eberlin]

The whole point is so that Joe User can device a workaround until a fix happens.

If someone knew that my systems had the potential of being screwed over, I'd want to know so that I can do something about it...or at least watch out for it instead of being blindsided while waiting for a patch to something I didn't even know I had a problem with.

Also, in some cases, alerting the vendor does nothing. They figure they could take their sweet time creating patches. Of course when the vulnerabilities are fully disclosed, there's extra pressure to come up with a solution.

hah!

[kritikal]

"allow an attacker to take control of computers running any version of Windows except for Windows ME."

all you people who said i was stupid for running windows me, look who's laughing now!

Re:hah!

[0rbit4l]

"allow an attacker to take control of computers running any version of Windows except for Windows ME."

all you people who said i was stupid for running windows me, look who's laughing now!

Well, umm, everybody? Besides, everyone knows the real reason there isn't a risk of anyone taking control of a Windows ME box is because nobody wants to take over a Windows ME box. ;) Cheers.

Re:hah!

[Anonymous Coward]

You're an idiot anyways. But if you say you [love ME], then you're a liar too.

• Olbilgatory Breakfast Club reference. I don't really know enough about WinME vs. other flavors to be qualified to have an opnion, but it was too good a shot to pass up. No offence intended.

Re:hah!

[Anonymous Coward]

Yeah, we're laughing alright. At least ME's got a perfect track record. This is yet another thing that doesn't work on Windows ME.

Re:hah!

[Anonymous Coward]

Haha :) Good one! But shouldn't that read:

All you people who said i was stupid for running windows ME, look who's laughing CRRRRRRAASSSHHHHHH!

WTF?

[istartedi]

No Borg icon? No wise cracks? What gives?

Re: WTF?

[Black Parrot]

> No Borg icon? No wise cracks? What gives?

The cracks are in the software; don't know about the other stuff.

Re:WTF?

[El_Ge_Ex]

NEWS ANNOUNCEMENT:

The Famous 'borg' icon of Bill Gates was replaced today with Darl McBride.

You may go back to your regualrly scheduled Microsoft ^C^C^C^C^C^C^C^C^C SCO rants now.

Re:WTF?

[dzym]

No Borg icon? No wise cracks? What gives?

It wasn't michael who posted the story.

Re:WTF?

[iendedi]

No Borg icon? No wise cracks? What gives?

The Borg icon is reserved for things that small and soft do on purpose and wise cracks are really not needed when talking about Windows security...

You really need this play by play?

Re:WTF?

[FattMattP]

Out little baby Slashdot is growing up. [sniff]

Re:Conveniently...

[Anonymous Coward]

Discloded? That sounds painful.

Re:someting is wrong with this picture

[tarquin_fim_bim]

4) ????

5) PROFIT

Will someone start modding this down

[Anonymous Coward]

Yeah, yeah we know, you can't configure any system you use. Everything takes 20 minutes to copy. This same post (different OS) keeps coming up and keeps its 0 rating.

Re:nt4... continued

[PDHoss]

Products Affected by This Update
The following products require updating:

Microsoft Windows NT® 4.0

http://www.microsoft.com/security/security_bulle ti ns/ms03-023.asp

Re:OH NO! Not Windows 2003!?

[Oriumpor]

Then again, the gap between responsible Redhat techs, and responsible Windows techs is still widening... Ease of use = ease of stupid.

Not that there can't be 2k&2k3 admins who patch frequently, but there's sure a lot more of em who just don't care or don't have time, whatever.

Slightly OT, how to apply updates

[yamla]

This is slightly off-topic, I apologise. I have several Windows machines (specifically, Win2k and several XP machines). They are all set to download updates automatically and notify me when they are ready to be installed. However, despite me clicking to install the patches, none of them ever do.

And when I go to windowsupdate.com and try that way, I see the updates and tell the system to go ahead. The updates are downloaded (though some are obviously already in the cache) and the install starts. Part way through, it aborts and I'm told none of the installs were successful and to try again.

Now, this worked in the past. I currently have 'only' 5 critical vulnerabilities to patch. But it's not working now. I've tried removing the download cache area and that didn't help. Is it really time to reformat?

Re:Slightly OT, how to apply updates

[Anonymous Coward]

Part way through, it aborts and I'm told none of the installs were successful and to try again

You've already been hacked. This is a common symptom.

sorry.

Re:Slightly OT, how to apply updates

[andreMA]

MOD UP.

While the author claims that it's "slightly off-topic" that doesn't mean that moderators need to blindly mod it so. If the poster is having issues applying patches, that's certainly a valid and relevant post in the context of this thread.

Regardless of how others might feel about the platform he or she finds themself in the position of supporting, it's best that everyone run as secure a system as they can given their circumstances. Ignoring someone who is making a sincere effort to be responsible with that they have (perhaps because an employer requires it, or perhaps because they genuinely prefer it) is disingenuous at best, no?

I happen to run OSX and linux -- and am rather bigotted against Microsoft in general -- but I applaud anyone who gives a damn and tries to be responsible as a sys admin.

Re: I don't want to start a holy war here,

[Anonymous Coward]

Given that no one else has this problem, you might consider that you or someone else hosed up that machine. I can site an example where a version of OpenOffice when opening a MS Excel file crashed a Sun machine running solaris such that it rebooted consistantly. To fix the problem we had to install a new video card.

Re:Poll: Tinfoil hat mode ON!

[quantaman]

Because software has bugs. That's what software is for.

Hmm, and all this time I thought software was for doing work, silly me!

one step ahead

[fihzy]

10) find big remote vulnerability in product
20) perfect the exploit
30) have fun with it for months
40) find another big hole in same product
50) perfect exploit for hole
60) alert vendor about original hole
70) have fun with new hole
80) goto 40

Re:one step ahead

[Eberlin]

71 REM Program Edited on 7/16/03
72 REM Looked a bit like BASIC but if it doesn't compile
73 REM Then whoops.
75 if $vendor==$microsoft then GOSUB 100

100 REM Rip Vendor A New Hole...Implementation Pending
110 Print "Send Vulns to bugtraq with proof of concept code"
120 Print "Send MS a link to bugtraq article"
130 RETURN

Re:one step ahead

[Anonymous Coward]

There's an error in you loop. You'll just be telling them about the first hole you found.

Re:one step ahead

[Burpmaster]

90 ???
100 profit

Re:one step ahead

[barton]

90) PROFIT!!!

Re:OH NO! Not Windows 2003!?

[Anonymous Coward]

How many of those RedHat vulnerabilities were remotely exploitable (no client action needed)? How many of them were in the operating system instead of applications that you may or may not run on that operating system? My count show RedHat up by one.

MOD PARENT DOWN!

[Anonymous Coward]

this guys deserves to have his karma set at -1, mod down plz

In other news...

[Anonymous Coward]

Debian issued security patches many times this month. What's so newsworthy about a MS bug?

Windows Vulnerabilities Revealed, Patched

[teamhasnoi]

Tonight on Fox! Right after "That 70's Show", You will learn the secrets Windows developers don't want you to know!

Jonathan Frakes explores the seedy world of Windows Vulneralbilities, on Windows Vulnerabilities Revealed, Patched!

Tonight on Fox!

Re: Windows Vulnerabilities Revealed, Patched

[ejaw5]

Fox is no match for:
too hot for TV... ..from the streets of Redmond, WA,

Windows Gone Wild!

Re: Windows Vulnerabilities Revealed, Patched

[Anonymous Coward]

Fox eh? Well it would be more like.

Unknown terrorists have hacked and mamed the patriot American operating system, Microsoft Windows, and tried to bend our resolve and our commitment to this greatest of all American operating systems by Lord Gates III.

In other news, Lord Bill Gates III vowes to defeat the feral threats of the viscious terrorists who plague his noble and holy OS. He said, that the government is now ready to lauch a preemtive strike against the breeders of such threats, included in this list comes anti-American names such as Linux, FreeBSD and strangly SCO's OpenDOS.

Linus Trovalds, the father of Linux (1 through 2), retalited against these words by Lord Gates, by claiming that every ounce of code that ever went into the Linux mother code repository was checked and rechecked for naked and terrorist bits. He further refuted Lord Gates holy assocaition of Linux with FreeBSD, by claiming the fifth.

Not so fast.....

[isotope23]

Remember Panama and/or Iraq?

We couldn't extradite Noriega so we invaded. What's to stop the US from just grabbing people?
Sure it would piss off governments but at the moment we don't seem to care too much about that.
In addition we can now class hackers as terrorists, and refuse to even admit they are in our custody.
Plus we can now hold them indefinately or prosecute them via secret court proceedings.

Thus noone will ever know their fate......

Re:Not so fast.....

[Anonymous Coward]

"noone"??

You mean Peter Noon? Wasn't he a Monkee or something?

No one will probably get it.

Re:Not so fast.....

[number6x]

Are we totally off topic yet?

He was Herman, he hung with the hermits.

Peter Tork was a monkey.

Oh Fud! Now I've got that 'Mrs. Brown, You've got a lovely daughter' tune in my head =)

Re:OH NO! Not Windows 2003!?

[Anonymous Coward]

two patches that fix how many things again? Clumping all of your patches together and releasing them all at once doesn't mean your software is better than someone elses...but if everything is tied together it does make upgrading less buggy.

Re:OH NO! Not Windows 2003!?

[Flower]

Two patches rated by MS as critcal and both OS related vs an admittedly large number of patches, some very serious, but mostly non-os related.

Is this bit'o'news overblown? Probably. Will a lot of /.s generate a bunch of banner ad hits posting a lot of noise over it? Definately. But your example does not compare apples to apples.

Re:Poll: Tinfoil hat mode ON!

[Martin Blank]

https://rhn.redhat.com/errata/rh9-errata-security. html

33 patches and counting since March 31.

http://www.microsoft.com/technet/treeview/defaul t. asp?url=/technet/security/current.asp

18 patches and counting since March 31.

Nobody's immune. Even the BSD distros send out the occasional notice.

and this is news?

[b17bmbr]

please. windows vulnerabilites are commonplace. we've all grown to know, love, and expect them. like death and taxes, if you will. are you shocked? not me?

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

Spoken like a true TacoBell lobby cleaner. Hey pal, you wouldn't know good code if it jumped up and bit you on the ass. Know why? It's 'cause you're a fucking idiot, understand? No, I'm sure you don't with that single digit IQ of yours.

Poles exploiting MS now!

[markclong]

From the article here

But four Polish researchers, known as the "Last Stage of Delirium Research Group," said they discovered how to bypass the additional protections Microsoft added, just three months after the software went on sale.

Even the Poles are able to exploit Windows now! What is the world coming to?

DISCLAIMER: I love Poles, I married one! I love the Polish jokes too!

This is very surprising

[dtjohnson]

Windows seems to have some security issues. Well, I'm sure that Microsoft fixed it.

Aren't we being just a little hypocritical here?

[neko the frog]

You know, when Apple spots a vulnerability in OSX and updates fairly promptly (and this isn't exactly a rare occurance), they're commended on their quick turnaround time for a patch. When Microsoft does the same thing, they're demonized as fixing Yet Another Bug(tm). Is it really impossible to give them credit where credit's due?

Re:Poll: Tinfoil hat mode ON!

[Jord]

How many of those are OS level? At the redhat site I counted 3 at the OS level. The rest are for add ons like Apache, MySQL, etc.

Could not check the MS one but I am guessing more than 3 of them were OS level patches since there were three just today.

Every one has security vulnerabilities but lets compare apples to apples here.

Yes, I run Windows!

[coene]

Yes, I run Windows on my desktops. And yes, I've stopped patching. I refuse. What's installed is exactly what comes off the CD. Got a problem with that, Microsoft?

*hides*

Re:Yes, I run Windows!

[valkraider]

What was your IP again?

Re:Yes, I run Windows!

[coene]

I run Windows on my *DESKTOPS*.

UNIX in front, two when wireless.

Re:Yes, I run Windows!

[interiot]

Look in your apache logs for Code Red probes, his IP is probably there several times.

Re:Yes, I run Windows!

[Anonymous Coward]

99% of all these "holes" are of no concern if you are not sitting completely open on the net. Which of course you're not, right? Anyone that had their machine in a state where this exploit was useable over the net pretty much deserves to get rooted. Any Linux box in the same place would have been rooted 10 ways from sunday as well.

Re:Yes, I run Windows!

[dJCL]

I run unpatched windows, behind a firewall... I just plain don't trust windows to do it's own security. I trust 3rd party software to help some, but more often I trust linux to help secure my windows systems. It is a solution that I have found works and covers a lot of holes right there.

I have a linux firewall locked hard, but I still have firewall software installed on all my windows machines and virus scanners... But not microsoft patches. That and the fact that they often just don't want to install...

Re:Yes, I run Windows!

[pair-a-noyd]

Wait until they reach their EOL code.
You can be certain that NT4 will begin to malfunction, as will the other OS's as they reach their "End Of Life"

They will become so unstable that you'll have to patch them to keep them up. I have a customer that is trying what you are trying.

On a brand spanking new box. It will run Linux rock solid for weeks at a time without crashing or rebooting or any other problem. Rock solid. (and it gets an *extreme* workout!)

But that very same box will not stay running more than 15 minutes with a fresh install of Windows 2000 and no patches or service packs installed. Just sitting there doing nothing at all other than waiting for input, you can stare at the screen and not touch the mouse or keyboard and it goes BSOD on you while you look at it.

We've reinstalled 2000 on it numerous times, reformated the hdd and still the same thing.
It will NOT stay running. Well, out of desperation we downloaded and installed service pack 4 (v.666) but no other patches. It stablized now but it's also r00ted and 0wned by M$ now.

One other thing to note. When it was crashing, there was NO SOFTWARE installed on it at all. Absolutly NOTHING. It was a stock, clean, naked install from a hologramed, licensed, factory original CD and there were NO applications of any kind at all installed. It booted up, sat there for a few minutes and went BSOD without a human being touching it..

Re:Yes, I run Windows!

[Anonymous Coward]

Microsoft might well not have a problem with it, but I'm sick of my apache error logs being polluted with requests for default.ida and cmd.exe coming from (mostly, it appears) clueless folks who probably don't even know they're running IIS...

Some day I'll write a script to parse that log and mail each entry to Microsoft, one byte at a time...

Re:Yes, I run Windows!

[dJCL]

One note is that I am doing this on a set of test systems.. (with windows 2k uptimes in the months) that are running old hardware, right at the bottom of the specs for win2k... my win2kserver box is running on an amd k6-2 333 and my win2kpro box is on a Celery 400 that is a scrounge from a collection of KNOWN UNSTABLE systems, it has good long uptimes too, but apps freeze and lock all the time on it...

I suspect it is running the latest and greatest that really kills you on things like that. Linux often has people testing it right from the first day the piece of code is written on the latest hardware, but windows probably does not in the same way. Plus, with building on the prior code base, both of them are rock solid on older hardware.

If you ever need a rock solid system, go get someone's old server and install the latest code base on it. Trust me, from experience, these things will NEVER die! They have known good hardware and the code that is running them is built on known good code, try it.

Anyway...

Re:Yes, I run Windows!

[SN74S181]

Slackware 3.6 didn't prompt you to generate a root password during installation. It didn't inform you in any way that you should install a root password.

A friend of mine found that out from me, after I logged in her box (after reading a fresh mail header to get her IP). She wasn't happy.

Richard Stallman was part of a protest group at MIT who refused to install passwords on their accounts. They viewed it as a civil right to have unencumbered access to UNIX.

The era of little hoods on the 'net isn't part of the classic UNIX world.

Re:Yes, I run Windows!

[SN74S181]

But that very same box will not stay running more than 15 minutes with a fresh install of Windows 2000 and no patches or service packs installed. Just sitting there doing nothing at all other than waiting for input, you can stare at the screen and not touch the mouse or keyboard and it goes BSOD on you while you look at it.

Duh. Have you considered that it might be a hardware problem?

Please don't spread FUD.

Re:Yes, I run Windows!

[MrMr]

Well, looking in my apache log entries of today it may be:
218.109.221.243
or
80.51.77.8

Re:Yes, I run Windows!

[Anonymous Coward]

"But that very same box will not stay running more than 15 minutes with a fresh install of Windows 2000 and no patches or service packs installed. Just sitting there doing nothing at all other than waiting for input, you can stare at the screen and not touch the mouse or keyboard and it goes BSOD on you while you look at it."

Hardware, more than likely a bad DIMM. I'll bet that all the BSOD error codes were different each time, that's IF you bothered reading them to find out why Win2K is going belly up.

No Support for Windows ME yet ?

[EqualSlash]

" a critical security hole that could allow an attacker to take control of computers running any version of Windows except for Windows ME. "

So When will they upgrade Win ME ?

A really bad week for MS!

[Anonymous Coward]

First, MS has it's DRM defeated on yet-to-be released WM9 using it's own freely available tools for developers. Now this . . . sheesh!

Re:A really bad week for MS!

[SN74S181]

The 'MS DRM defeat' sounds like it's lossy. Somebody figured out how to grab the blinking lights on a Media Player control. It's by no means a 'defeat' that is a clean tap to the media stream.

Who marked this post as Insightful?

[figleaf]

The patch for nt4 is here: http://microsoft.com/downloads/details.aspx?Family Id=2CC66F4E-217E-4FA7-BDBF-DF77A0B9303F&displaylan g=en

lsd-pl

[Anonymous Coward]

lsd-pl are the most elite motherfuckers in the world

Oh no

[Anonymous Coward]

Do you really want to bring apple into this?

Sure.

[foobario]

"The software giant issued a patch Wednesday morning to plug a critical security hole that could allow an attacker to take control of computers running any version of Windows except for Windows ME."

Hell, even legitimate users of Windows ME can't take control of their computers...

Re:Aren't we being just a little hypocritical here

[Jord]

Your new here aren't you?

Unpatchable? Microsoft said so, but don't take it

[Anonymous Coward]

... from them. They only said so. And obviously changed their mind.

Curious security side effect

[UnknowingFool]

that could allow an attacker to take control of computers running any version of Windows except for Windows ME.

As if hackers would want anything to do with ME.

Windows Update

[heli0]

Buffer Overrun In RPC Interface Could Allow Code Execution
Security Update for Windows XP (823980)
Download size: 1.2 MB, ~ 1 minute
A security issue has been identified that could allow an attacker to remotely compromise a computer running Microsoft® Windows® and gain complete control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.

Unchecked Buffer in Windows Shell Could Enable System Compromise
821557: Security Update (Windows XP)
Download size: 5.1 MB, ~ 1 minute
An identified security issue in Microsoft Windows could allow an attacker to compromise a Microsoft Windows-based system and then take a variety of actions. For example, an attacker could execute code on the system. By installing this update, you can help protect your computer. After you install this item, you may have to restart your computer.

Could someone get them a copy of Secure Programming and highlight all of chapter 6 Avoid Buffer Overflow.

Re:Windows Update

[kahei]

Yeah, what bothers me here is not that there's a vulnerability -- in 30 million lines of code I'd expect a good few thousand vulnerabilities. What bothers me is that it's the same damn buffer overrun problem again.

Thank You For Not Using Fixed Length Buffers Like You're Programming C On System V in About 1978.

don't kill me...

[ravenousbugblatter]

At the risk of offending the many *nix users on slashdot, i'm wondering just how often patches come out for the different *nix systems? I wouldn't doubt that windows is just that bad, probably confirmed by the above article, (I use a mac and the BSD based OS X, having switched last year), but i'm curious if the *nix patches just don't get as much press coverage or if they really just don't happen nearly as often?

P.S. I know enough about UNIX (but still not much) to know that I would switch to a *nix machine before I EVER went back to a windows machine.

Re:don't kill me...

[Anonymous Coward]

Then you still don't know enough about UNIX...

Re:don't kill me...

[Kchuck]

Windows is closed source. Linux/various Unix's are open source. Without looking at the code, ppl are forever finding security holes in Windows. Open source OS's are cleaned up pronto, because anyone can look at the source and fix it. Hard to exploit open source software when hundreds of pairs of eyes are racing to be the first to patch a problem.

Re:don't kill me...

[SN74S181]

The open source software that lives on the servers of major distro vendors gets cleaned up pronto. However, since there are 35,000 different permutaitons of Open Source OSes out there, layer upon layer of versions of everything, it's a big weaved-together mess to update anything to an absolutely known state/version. That's part of why Linux isn't formally 'security certified' anywhere. They'd have to actually freeze the code to formally test and certify it.

You can feel good if you're a 'community member' of one of the contiuously updated OSes and you continually update to the tip. Otherwise you're no better off, and probably worse off, than someone who runs one of the 'monoculture' OSes.

What does Independent Security Consultant Mean?

[McDiesel]

The Cnet story mentions that a group of independent security consultants discovered the problem and worked with Microsoft to resolve it. Can this be interpreted to mean that they negotiated with Microsoft for financial compensation for resolution of the problem?

Does that mean that we now have a class of professionals who act as freelance quality assurance for popular commercial software? (Or less charitably as software kidnappers?)

Mod parent down.

[Anonymous Coward]

RTFA.

Mod parent down.

Re:someting is wrong with this picture

[Anonymous Coward]

What's wrong is it's 2003 and people are still writing software, in C, that does not check buffers.

Re:OH NO! Not Windows 2003!?

[Anonymous Coward]

Definately. But your example does not compare apples to apples.

Even if we compared apples to apples, Linux would still lose.

Why does slashdot post this to the front page, but ignores all of the Linux vulnerabilities listed there? That is the question that you fear answering.

I've already been affected...

[ugly_a]

Yeah. What is wrong with my computer!!!!! I'm getting headaches from all this patching over and over and over and over and... Oh wait.., It's not my computer, it's my windows 98 that's sitting on my head.

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

Could not check the MS one but I am guessing more than 3 of them were OS level patches since there were three just today.

I don't see how, they all releated to subsystems outside of the kernel.

I just patched my machine...

[Anonymous Coward]

I just patched my XP machine.
Now Norton fails on startup, and I can't seem to access System Restore to roll back my system to the point before the patch.

Thanks Microsoft....

Re:I just patched my machine...

[SN74S181]

My experience, going back years and years, is that when you start putting Norton stuff on your Windows system, you're bound to have 'interesting times' ahead.

It's a bit more sophisticated than the woman I once heard about who 'deleted all those files in the C:\ drive that she didn't know what they were there for' but it's similar in ways.

I try to tweak a Windows box as little as possible. Sucks if you're a third party dingle-doo utility vendor. But oh well.

Re: I don't want to start a holy war here,

[TheOnyx]

Yes. Every program I run now and will ever want to run. ...and before you suggest it, The windows emulators for *nix are not the answer. I like my framerates, thankyouverymuch. This is probably why my next box will be a WinBox, and this one will become a *nix server.

Re:Poll: Tinfoil hat mode ON!

[dirk]

This is comparing Apples to Apples for the most part. Saying Apache doesn't count, but IIS does is not comparing correctly. One reason MS appears to have so many more bugs is that their OS includes a lot more components that are thought of as part of the OS. Whever there is a problem with anything that ships with Windows, it is considered a Windows bug by most people. Yet when there is a Linux bug, people tend to saying it's an X bug (be it Apache, or Sendmail, or FTP, etc).

Also updated NT4 right now.

[Anonymous Coward]

Mod parent up!

I also updated NT4 just now. Right before I read about it on slashdot.

A sad day for the internet

[Anonymous Coward]

Torrentse is gone:

The site torrentse.cx recieved a cease and desist letter during the day of Wednesday, July 16, 2003 for copyright infringement. The entire website has been removed and will not return.

Shed a tear...

What about Windows 98?

[Jaycatt]

So... I notice Windows 98 isn't mentioned anywhere.

Does this mean it's not affected, or does it just mean that since Windows 98 is no longer supported they wouldn't make a patch anyway, so mentioning it would be moot?

Just wondering if I would need to upgrade some old PCs on my home network to be safe... Any idea?

Re:What about Windows 98?

[Anonymous Coward]

I just updated by Win98SE laptop with this "security update" released today. Didn't even need to reboot, either, which I found rather surprising.

You're overlooking stuff

[Anonymous Coward]

I don't think you noticed that MS Patches are only for Windows itself, internet explorer and outlook while RH patches are for the whole system, wich includes many window managers, browsers, and other software. So really you're trying to compare apples and oranges.

Re:You're overlooking stuff

[Anonymous Coward]

Uh... Windows also has a window manager and a LOT of other software (WMP, WMM, and tons of untilities, file viewers etc..) too you know... So yeah, it's pretty much apples to apples, as much as you would like to think it's not.

The grandparent post, rewritten

[Anonymous Coward]

My good sir, of course this was for the backend and not for the desktop. In the future, kind anonymous gentleman, I ask that you prove your assertations. If you cannot do that, please do not participate in this educated discussion.

Yours,

A. Coward.

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

Which you counted as part of Red Hat...

Red Hat has _far_ more software bundled into it then any version of Windows... far many more lines of code...

Which was the point he was trying to make.

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

Alright, let's do it your way, take the ms bundled software patches and compare it with the linux equivalents patches, and then you also count the unpatched bugs. And then you'll see that comparing apples to apples isn't what was in the parent post in first place.

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

firebird. fucknut.

Re:Poll: Tinfoil hat mode ON!

[kien]

Take you ha off and deal ALL (yes ALL) Software has bugs, Exploits or problems. Before you show your Ignorance compare how many realeases your favorite distro has had and compare it to MS.

I agree. I subscribe to BugTraq and the ratio of free/opensource software submissions to proprietary software submissions is something on the order of 10:1. I have no problem telling people this because, if the same ratio were applied to units of time for a response and a fix, the inverse seems to be the case.

Of course all reasonably sophisticated software has bugs; it's an indisputable fact. The problem with proprietary software is that their business depends upon (downplaying|denying|obfuscating) this fundamental fact. It's like the caretakers of the Hoover Dam denying cracks that are pointed out by obsvervant visitors because they're paid to keep it solid.

I have a theory about why free/opensource software gets fixed so much more quickly than most proprietary software: I think that when someone's reputation is on the line, they strive harder to fix their code but when their paycheck (and perhaps even future employment) is at stake, the same pressure doesn't exist because they are shielded from public scrutiny and are probably busy earning their paycheck writing more propietary code at the behest of their employer.

In other words, I think the actual programmers at companies like Microsoft are really talented, clever people but the business droids make them look bad. I have never met a real programmer that was able to look at code they wrote weeks/months/years ago and say "Wow, that is truly perfect." I doubt proprietary programmers at the bigger firms have the freedom to peruse and improve their code like those who do it for fun. And, since they're nameless and shielded, I suppose it would be easy to become complacent and shrug off all but the most serious complaints. So when it comes to Microsoft, I have some respect for their coders and reserve most of my vitriol for the people that manage them.

--K.

Re:Aren't we being just a little hypocritical here

[Anonymous Coward]

If Microsoft release a patch it's them being sloppy and realizing there's a problem with xyz code. They will be patronized for not having the foresight to fix the problem 3 years ago even though an exploit is not written yet.

If Linux releases a patch it's them taking the initiative to fix a problem before it's a problem. This somehow makes Microsoft look bad in the eyes of a delusional *nix user. No one would ever think that a patch for a *nix OS was fixing a nasty exploit. It could never happen.

Welcome to the biased world of Slashdot.

Re:Poll: Tinfoil hat mode ON!

[Eberlin]

I guess a fair breakdown would be:

1) vulns that can be exploited remotely
2) vulns that get you 0wn3d
3) vulns that get you DoS'ed
4) minor annoyances

Sure, a bug is a bug...but severity has to count. I doub't you'd disagree that a bug in XMMS's ability to play .ogg files shouldn't count the same as a bug that enables remote control of a SQL Server...or a Media Player buffer overrun that can allow code execution.

Re:OH NO! Not Windows 2003!?

[Anonymous Coward]

If your best argument to save face for MS is Redhat's General Advisories list, you truly are sad, pathetic and unejimacated!

douche.

Re:Poll: Tinfoil hat mode ON!

[the eric conspiracy]

Saying Apache doesn't count, but IIS does is not comparing correctly. One reason MS appears to have so many more bugs is that their OS includes a lot more components that are thought of as part of the OS.

Actually it is comparing correctly because of the way the different systems are architected.

Apache is usually run in userland with limited privledges on a Unix machine while IIS.sys is a kernel mode device driver on a Windows machine. There result is a compromise in IIS presents a system wide security issue while a similar security issue in Apache only represents a user level security issue.

This sort of thing is very common in comparing Windows vs Unix/Linux security. The Windows code runs with admin level access or as part of the kernel, while the Linux application runs with much more restricted access.

I've Got NT Workstation 4.0

[Anonymous Coward]

Microsoft Security Bulletin MS03-023 says just the server versions of NT are affected. I'm home free, safe as a bug in a rug, right? WRONG! NT Workstation is out of support as of June 30. We're on our own! No security warnings from MS. No security patches.

If they stalled announcing this for a while, that would likely be the number 1 reason -- to give us a reason to buy a newer version of their faulty products. If anyone comes up with a patch, let us know. Of course, copyright owner has absolute control of modifications to his work, so it would be illegal to distribute a patch without their consent. Jeez.

Props for Microsoft

[jonabbey]

It'd be easy to denigrate Microsoft for all of the security announcements they've had, but it really does seem like positive fruit of their new focus on security in their products. The more of these things Microsoft catches and fixes, the happier I am.

Re:Props for Microsoft

[Anonymous Coward]

Ah, yeah, except MS didn't catch this one...

Re:Props for Microsoft

[andreMA]

Is it really Microsoft catching the bugs, or third parties reporting them? I honestly don't know... certainly security-related bugs are often first discovered by outsiders on other platforms -- and I assume that holds true for MS as well.

Perhaps you meant to say that you were happy that MS was more responsive recently to demonstrated bugs, regardless of who first reported them?

Re:OH NO! Not Windows 2003!?

[Anonymous Coward]

Responsibility has nothing to do with the OS itself. Attention to detail is something born within you and will never improve based on your job function.

The problem is most Windows admins make less than half of a Unix admin. This is feeding from the bottom of the pool so no shit they aren't going to patch their systems. If you aren't getting paid they won't care. They get fired and you hire another worthless bum who just joined the IT industry because they heard it pays well! The problem isn't windows or redhat. It's the dedication to your job to do the right thing!

Where I live...

[nefele]

it already is the 17th of July, you insensitive clod!

In short, check for updates frequently!!

[MtViewGuy]

I think it's obvious that people should sign for for official email notifications from the OS vendor of the latest patches and updates or at least monitor the OS update site at least three-four times per week. I think people will be surprised how many people need to update their OS for security reasons because they haven't bothered to check for such updates on a regular basis.

Re:In short, check for updates frequently!!

[Martin Blank]

Having recently worked in a data center with many customers, I can verify this. Our own Solaris and Cisco systems were often months behind on even serious security patches, and customer systems were behind by as much as three years (we found a few people running Windows 2000 Gold -- no patches whatsoever).

We had good firewalls in place to minimize the initial entries, but it's very easy to fall behind.

Microsoft and Homeland Security

[RichiP]

This news item on the same Slashdot page as the news on M$ and Homeland Security. I'm glad I don't live in the US.

Re:Poll: Tinfoil hat mode ON!

[patbob]

[RedHat]33 patches and counting since March 31

[Windows]18 patches and counting since March 31

This actually worries me.. about Linux. Not only did MS have fewer patches, but there's more people trying to break MS than Linux out there. Even if one only considers the OS ones, and assumes that all of MS's are OS patches (doubtful) and only 3 of the RedHat ones are OS patches, we still need 6X more people looking for MS holes than Linux ones. That still seems too low a ratio to me.. but what do I know... maye even the bad guys are switching to Linux :-)

LART!

[AnotherScratchMonkey]

But if you keep port 135 open on your DMZ boxes, you deserve to be hanged with a piece of CAT-5 cable.

No, beat them with the CAT-5 o' nine tails instead!

Didnt take long...

[angst7]

I checked my incoming logs and am already seeing quite a few more tickles at port 135 than usual. Where from, you ask? Somewhere in china mostly.. ips in the range 218.15.192.xxx coming from somewhere beyond blahblah.gd.cn.net. Here's one of the ips (its a phony drug sales place) 218.15.192.84... nice little e-com site :)

Ugh, isn't the net fun?

From the MS technical info

[hayden]

Best practices recommend blocking all TCP/IP ports that are not actually being used.

I would have thought best practice would have been not to use Windows?

Re:From the MS technical info

[SCHecklerX]

Blocking? How about just not running the shit in the first place?!? Oh yeah, I forgot. Microsoft. You're lucky to even know what you are running at any given time, let alone even be ABLE to turn off the 'unnecessary' service that 30 other pieces of windoze seems to require, only on localhost, mind you, but by golly lets open it to the world for kicks!

Buffer Overruns - this sounds familiar

[sempai]

The news.com article had one interesting quote that is different than the usual "time-to-patch-again" article, from Jeff Jones at MS:

"It was primarily a process issue," he said. "We will be updating our automated scanning tool to make sure this type of issue is detected in the future."

Last week, there were two patches released - both termed "buffer overruns". Nice semantics, because it's not made clear whether one could call this a buffer overflow, or an UNDERflow. It was just two weeks ago when the details about getting Linux to run on the XBox were released, and how the buffer underflow trick was used. Makes me wonder if MS took notice of that trick, and is now busy scanning the rest of their code looking for underflows, as opposed to the overflows they've already had their automated tools earmarking?

Re:FP TIME FUN QUIZ

[Anonymous Coward]

DING DING DING

Re:Aren't we being just a little hypocritical here

[Aadain2001]

It's because MS has shown in the past that they would rather have security through obscurity, and have intentionally not released information about existing vulnerablilities to the general public. While some would say that this prevents hackers from using the exploit, most here would say it prevents administrators from protecting themselves from the few smart hackers that already know about the exploit. Do we really know how long MS has known about this bug? They could have released information saying "Hey, block port 135 on all machines until we finish working on a patch". But they didn't. And this is a bug that has been in their OS's since NT! It would be equivalent to finding a bug in Linux that has been around since the 1.0 days.

Linux has a history of being VERY open about their problems. The practically advertise them! This allows users of Linux to know exactly where there are problems and what to avoid.

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

hahahaha! it seems, 'pal', you wouldn't know a good troll if it jumped up and bit you on the ass. because it just did. go back to cleaning taco bell lobbies or doing whatever the fuck you were rabbiting on about. fucking loser.

Redhat

[Anonymous Coward]

Why don't we see the exploits found in the software distributed withRedhat listed on the frontpage? Just yesterday Redhat sent out an Errata notifying users of a update for Mozilla. Here is a quote verbatim from the email:

"A heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL referencing a malformed .jar file, which overflows a buffer during decompression. This issue affects versions Mozilla packages for Red Hat Linux 7.1, 7.2, 7.3, and 8.0."

There where updates for nfs-util, VNC, Ethereal, WindowMaker, and Gnome released earlier this month as well.

It seems ironic that the Microsoft alerts generate news but other software does not.

THIS IS JUST CANDY - WHAT LOSERS!!!!!!!!!!

[Anonymous Coward]

MS has had the DRM defeated on yet-to-be released WM9 using it's own freely available tools for developers. Just a few days agom, too.

Re:Poll: Tinfoil hat mode ON!

[Psx29]

More patches doesn't neccesarily mean more bugs, but means more bugs that are fixed.

Re:Poll: Tinfoil hat mode ON!

[Feztaa]

One reason MS appears to have so many more bugs is that their OS includes a lot more components that are thought of as part of the OS.

That's the biggest load of hooey I've ever heard.

First of all, it is easily demonstrable that any open source distro has more reported bugs than MS Windows. This is for a number of reasons:

1. A Linux distro comes with so much more than a windows install does (windows comes with IE, linux comes with mozilla, galeon, konqueror; linux comes with koffice, abiword, openoffice, windows doesn't; etc etc etc. There's a reason that debian is 8+ CDs and Windows is 1 CD).

2. The whole bit about the code being open and easier to scrutinize, thus easier to find and report the existing bugs. The openness also makes it easier to fix the bugs.

Correct

[Sycraft-fu]

Like the BIND patch. Lest you forget there was, a year ago, that affected all versions. Somehow, despite the fact that it is open source, very old, very widely used and reviewed, a bug still managed to slip through.

When you must expose software to an infinently unknown amount of combinations (of OS, software, hardware but most important user input), you just cannot gaurentee that there will be no unexpected results. The biggest problem is the vairablity of user input. People will try and use things in unexpected, unapproved and malicious ways. Well, when this happens, it is possable an unforseen problem will crop up, despite your best efforts to prevent it.

What I find funny is how outraged people get about this in the computer world, when it is so prevliant elsewhere, with much higher stakes. For example: It is a known flaw with basically every consumer automibile that high speed impacts will result in sever injury or death of the operator. Now, this is an unintended method of operation, you are't SUPPOSED to slam into a brick wall doing 80, but it is a KNOWN problem, and remains un fixed. Further, they could fix, or at least improve, the problem in a large way. The first step would be to install an 8-point racing harness. Those little shoulder strap belts just don't cut it, you need to belt yourself in tighter and have more points of contact to dissapate the force over a larger area. Then there is the car itself. It needs a much better frame and much better break away points, as seen in race cars. Finally, there is other safety gear such as a helmet. Well, as race cars demonstrate, these do work. They make extremely high speed collisons, generally with only minor injuries to the driver.

So, why don't we have this? Two big reasons: Cost and inconvenience. Building a car to race car specs is EXPENSIVE, and not just because teh engine is high performance. That frame is NOT cheap. Then there are other safety measues that are a huge pain in the ass. An 8-point harness is an ordeal to get in and out of and noone want to wear a helmet inside a car. Thus, we consider it acceptable to allow the flaw to exist since it is one resultant of behavious that should not happen.

This is also akin to the computer siutation in that we could drasticly increase reliablity, but only by sacraficing cost and convienece. The cost would come form needing a verified design. Thing would move slowly because each part would need to eb extensively tested to insure there were no problems. This appiles to hardware and software. Kiss $1000 computer goodbye and figure on $10,000 or up. Then there is the inconvienence. They can't have you fiddling with this verified design, so you are going to be able to run only the apps tey ahve preapproved on the hardware they preapprove.

Unless you are willing to accept that (and people do make systems like that, contact IBM) then unforseen bugs and exploits WILL happen. And please don't act like it doesn't happen to OSS, go read SANS or Security Focus some time. There are more than plenty of exploits for both closed and open software.

Re:Correct

[drewness]

To reply to your car thing though, in the past 50 years great strides have been made in reducing injury to the occupants of the vehicle. Off the top of my head I can think of shoulder belts (a big step up over lap belts, which were a big step up from having nothing), head rests (the aren't there to rest your head on; they're there to keep you from snapping your neck when your head flies back in an accident), safety glass, crumple zones (first seen on Mercedes in the 60s I believe), and collapsable steering wheels (introduced by Audi in the 80s). You could also count airbags, but that seems to be more debatable than the rest. And ABS and traction control systems have certainly helped prevent people from getting into loss of control situations. But, you're right. Race cars do have a lot more safety tech and it's too expensive to deploy on passenger cars, but a lot of safety tech trickles down into consumer vehicles over time, once the cost has gone down.

Re:Correct

[Anonymous Coward]

The solution to the car problem is to build cities that don't need cars. See, for example, arcosanti.

Re:Correct

[Sycraft-fu]

Thing is, some things will just never make it. The biggest being the 8-point harness. It really isn't expensive to implement, not in teh scheme of a car. Also, it (combine wiht a good seat) is some of the best things you can do for sollision safety. A good 8-point harness secures you to the seat very well, ensuring that you won't move around much and that any impact is distributed over a wide area.

To give you some idea, I was in an accident about a year ago, a near headon collison at about 40mph on his side and about 10 on mine. The safety features of the cars were good enough to keep anyone from sustaining other than minor injuries, but minory injuries were still sustained. Mine were the worst, not having an airbag. I had a nice red mark across my chest and stomach where the lap belt was. Reason was two fold. First, teh cutout didn't engage immediatly (none do) so I was allowed to fly forward slightly before hitting the belt and second because that single belt had to stop all 200 pounds of me. Had I been in an 8-point harness and a seat that accomadated it, I doubt I would have even been bruised.

However, we'll never see them because people aren't willing to put up with teh inconvenience. They are hard to put on and are not comfortable to sit with for long periods.

Well likewise one can install a firewall and thing like wrappers for HTTP servers. These will preemptively get rid of 99.9% of new exploits. However they require setup work and are somewhat inconvenient. So most epople don't do it.

I just find it funny how whiny people get about computer companies and security bugs, espically MS. They address and solve them, also they are things you can generally address and solve yourself before they are a problem. Yet, people whine and bitch because they happen at all.

Comparing apples and coconuts

[Glamdrlng]

There's a major difference here: two of the three vulnerabilities were in 2000 and NT as well as 2003. As long as NT4 has been around (since '96 IIRC) people are still finding bugs in it. They clearly know the software is crap, but they're still making new operating systems based on said crap, i. e. "Built on NT Technology".

Sounds kinda familiar actually:

"Listen, lad. I built this kingdom up from nothing. When I started here, all there was was swamp. Other kings said I was daft to build a castle on a swamp, but I built it all the same, just to show 'em. It sank into the swamp. So, I built a second one. That sank into the swamp. So, I built a third one. That burned down, fell over, then sank into the swamp, but the fourth one... stayed up! And that's what you're gonna get, lad: the strongest castle in these lands!"

Re:Comparing apples and coconuts

[Anonymous Coward]

Are you telling me 2.6 contains no line of code from 2.4 or 2.2?

Windows uptime

[Gyorg_Lavode]

My friends tell me, "a win2k/XP can stay up as long as a linux box." I told them, "only if you don't patch it." This is the 3rd time in the last 2 weeks I think I've brought down my windows boxes to patch critical vulnerabilies.

Re:Poll: Tinfoil hat mode ON!

[deranged unix nut]

Why does MS come out with patches so often?

Seriously, because:
1) University Grad students think that Microsoft security problems are good Thesis topics.
2) It is the most prevalent OS on desktop machines, so it gets more attention.
3) Unlike other software vendors, they actually fix issues and distribute the patches instead of forcing customers to sign a NDA to get the known flaw in their enterprise class machine fixed (SUN).
4) They create complex software to provide the user with a better experience, but complex software is hard to test.

future-dupe

[Anonymous Coward]

And we'll keep seeing more. Film at 11:00

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

It's not a bug, it's a feature!

I feel better now,

[pair-a-noyd]

"Windows Vulnerabilities Revealed, Patched"
With M$ handling 'Homeland Security (tm)' this latest newsflash
gives me a warm, fuzzy feeling, knowing that M$ is protecting me from
evil terrorist by keeping the super-duper Windows based,
global spy computers up-to-date and all patched up...

(lays head on pillow and closes eyes in peaceful bliss)

Yet another SCAM ?

[stock]

oh my goodness : " Microsoft admits critical flaw in nearly all Windows software "

"The announcement came one day after the Department of Homeland Security announced that it awarded a five-year, $90-million contract for Microsoft to supply all its most important desktop and server software for about 140,000 computers inside the new federal agency."

http://www.sfgate.com/cgi-bin/article.cgi?file=/ne ws/archive/2003/07/16/national1725EDT0732.DTL

that last quote is on the bottom..

Robert

Re:Yet another SCAM ?

[stock]

here's a fixed link :

San Franciso Gate article

Robert

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

Okay let's do a side-by-side comparison, show its Linux analog and see if your argument holds water:
MS03-028 : Flaw in ISA Server Error Pages Could Allow Cross-Site Scripting Attack (816456)
ISA Server is like Squid. Not OS level.

MS03-027 : Unchecked Buffer in Windows Shell Could Enable System Compromise (821557)
OS Level, WinXP SP1 only.

MS03-026 : Buffer Overrun In RPC Interface Could Allow Code Execution (823980)
OS Level.

MS03-025 : Flaw in Windows Message Handling through Utility Manager Could Enable Privilege Elevation (822679) Not OS Level. Must be running the program locally to exploit.

MS03-024 : Buffer Overrun in Windows Could Lead to Data Corruption (817606)
OS Level. Windows Server 2003 not affected. You must be authenticated by the server to exploit this.

Side note: "Microsoft thanks Jeremy Allison and Andrew Tridgell, Samba Team for reporting this issue to us and working with us to protect customers." Holy crap did I just read that?

MS03-023 : Buffer Overrun In HTML Converter Could Allow Code Execution (823559) Yes. See below about gtkhtml.

MS03-022 : Flaw in ISAPI Extension for Windows Media Services Could Cause Code Execution (822343) Not OS level. The flaw is actually in an IIS ISAPI DLL (think "Apache module" or CGI scipt) that's used for multicast loggin.

MS03-021 : Flaw In Windows Media Player May Allow Media Library Access (819639) Not OS level.

MS03-020 : Cumulative Patch for Internet Explorer (818529) Nope.

MS03-019 : Flaw in ISAPI extension for Windows Media Services could cause denial of service (817772) Nope.

MS03-018 : Cumulative Patch for Internet Information Service (811114) No.

MS03-017 : Flaw in Windows Media Player Skins Downloading Could Allow Code Execution (817787) Nope
Now let's look at the Redhat one:

2003-07-14 RHSA-2003:206 Updated nfs-utils packages fix denial of service vulnerability
Could be considered OS level just like SMB is on Windows.

2003-07-03 RHSA-2003:203 Updated Ethereal packages fix security issues No.

2003-07-02 RHSA-2003:204 Updated PHP packages are now available No.

2003-07-01 RHSA-2003:199 Updated unzip packages fix trojan vulnerability I'm gonna say no.

2003-06-25 RHSA-2003:173 Updated ypserv packages fix a denial of service vulnerability DEFINITELY OS LEVEL.

2003-06-18 RHSA-2003:196 Updated Xpdf packages fix security vulnerability No.

2003-06-03 RHSA-2003:047 Updated kon2 packages fix buffer overflow No.

2003-06-03 RHSA-2003:187 Updated 2.4 kernel fixes vulnerabilities and driver bugs Yes.

2003-05-30 RHSA-2003:181 Updated ghostscript packages fix vulnerability No.

2003-05-28 RHSA-2003:186 Updated httpd packages fix Apache security vulnerabilities No.

2003-05-27 RHSA-2003:171 Updated CUPS packages fix denial of service attack Yes, CUPS is the print spooler.

2003-05-20 RHSA-2003:175 Updated gnupg packages fix validation bug No.

2003-05-16 RHSA-2003:169 Updated lv packages fix vulnerability No.

2003-05-15 RHSA-2003:174 Updated tcpdump packages fix privilege dropping error No.

2003-05-14 RHSA-2003:172 Updated 2.4 kernel fixes security vulnerabilities and various bugs Yes.

2003-05-13 RHSA-2003:160 Updated xinetd packages fix a denial-of-service attack and other bugs
Uh, yeah, xinetd is providing necessary services to every linux box.

2003-05-12 RHSA-2003:002 Updated KDE packages fix security issues
If the Windows Shell is OS level, this is OS level too.

2003-05-02 RHSA-2003:093 Updated MySQL packages fix vulnerabilities No

2003-04-24 RHSA-2003:112 Updated squirrelmail packages fix cross-site scripting vulnerabilities No.

2003-04-24 RHSA-2003:142 Updated LPRn

Re:Poll: Tinfoil hat mode ON!

[dirk]

1. A Linux distro comes with so much more than a windows install does (windows comes with IE, linux comes with mozilla, galeon, konqueror; linux comes with koffice, abiword, openoffice, windows doesn't; etc etc etc. There's a reason that debian is 8+ CDs and Windows is 1 CD).

You are correct, but when was the last time you heard someone refer to a Mozilla bug as a Linux bug? If there is a bug in IE, it is usually considered a windows bug (even ones where you must be actively running and surfing with IE). No one ever says "there is a bug in IE, but that shouldn't count against windows", whereas every Mozilla bug is counted as completely seperate from a Linux bug. A true comparison would be to take everything that comes with windows and compare it the most popular version of the same app that runs on Linux. That means Windows would include IIS, IE, mail, ftp, etc, but that Linux would also include Apache, Mozilla, Sendmail, ftp, etc. That would be a fair comparison. To compare every app that comes with Windows versus only the base Linux install isn;t a fair comparison at all.

Irritating

[dze]

Not that this is big news, but apparently you can't access Windows Update if you're using Mozilla Firebird like me... Back to IE...

Re:Irritating

[EvilTwinSkippy]

That would be because IE is part of the OS. Kind of like those Active X controls...

And people look at me like I'm wearing a tin-foil cap.

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

windows comes with IE, linux comes with mozilla, galeon, konqueror; linux comes with koffice, abiword, openoffice, windows doesn't; etc etc etc

Yeah, it's a shame isn't it? What a mess.

The whole bit about the code being open and easier to scrutinize, thus easier to find and report the existing bugs. The openness also makes it easier to fix the bugs

This is completely theoretical and doesn't actually make tiddly-squat difference in reality.

A lot of good that does me.

[Fizzlewhiff]

Since I use Linux and apparently many others here too, wouldn't stories about critical Linux bugs be nice to have? Last time I ran up2date I had 10 patched applications to download but I don't know how severe they were or if I really needed to bother.

Re:A lot of good that does me.

[Anonymous Coward]

I'm not sure what you're trying to say.. if you're saying they should post linux bugs AND windows bugs, I agree..but if you're saying they shouldnt show windows bugs because linux users use slashdot, you need to check the slashdot IRC conference logs, or OS polls because the majority of slashdot users are running IE on Windows.

(im running opera, on windows.)

not trying to be a troll or anything, just wanted to inform you.

This is truly emblematic of my day...

[Zarquil]

Doing a quick scan through /. just to see what's up...

Windows vulnerability... Yadda Yadda Yadda... I better do my laptop because I need it hang it behind someone else's firewall. Okay, nothing really new. I keep a minimal install on my laptop for just such occasions - there really isn't much (other than the data) that can get buggered by adding the patch anyhow.

So since I'm on a patching spree anyhow, I might as well check my Mandrake box.

"The list of updates is void. This means that there is either no available update for the packages installed on your computer, or you already installed all of them."

WTF??

C'mon, Mandrake... Throw me a few bugs here!

Seriously, I EXPECT to have a bunch of small updates from Mandrake and to have few and far between major updates for my Windows systems.. I'm most disappointed with this ratio today...

(sigh)

Posted from the only computer that isn't rebooting.

- Zarquil

Playing that game

[SuperKendall]

If your car had a 30% chance of bursting into flames while you were driving it, would you rather know about it now or wait for the recall?

Knowing about a problem even if no solution exists allows you to take measures, like perhaps blocking outside access on certain ports for some time or filtering traffic in specific ways.

Information always beats no information when you are trying to keep something secure.

Re:Playing that game

[bm_luethke]

If your car had a 30% chance of bursting into flames while you were driving it, would you rather know about it now or wait for the recall?

This would be more like "If your car was touched in a certain way it will automatically explode, but normal everyday operations work fine, would you want everyone to know about it until a fix is made?" probably not - as long as they are activly working on the patch. I, for one, would not like to have "code red" worms working around the internet for all windows boxes (not just IIS) simply because of the bandwidth used. This seems to be dealt with correctly.

This would be true of any software system I have - I would rather the programmers be contacted directly - if possible - to fix the vulnerability before going public. Now if they sat on it I'm all for full disclosure to force thier hand.

Re:Playing that game

[Martin Blank]

The auto industry does things no differently. They are notified of a potential problem, they research it, and if necessary they will issue a recall notice, or at least issue a service bulletin. They generally don't release information on what reported problems they're researching until a fix is complete.

Time to patch Windows, must be Thursday

[dheltzel]

Oh wait! This week's security flaw arrived a day early.

I had my Outlook Calendar set to sync on the Windows patches, now tomorrow's schedule will be all messed up. I wonder if I can convince my boss that tomorrow is really Friday?

Re:Aren't we being just a little hypocritical here

[ch-chuck]

The real hypocracy is the fact that what made the 'richest man in the world' has a proven track record of being the 'world lousiest software products', over and over and over. Then they tell us their market dominance came thru 'free consumer choice' and not pc monopoly leveraging, illegal bundling, tying and overbearing anticompetitive terms with pc vendors.

Yeah, right.

About all those consumers stuck in the Windows trap, it like a customer told me once about a deal gone sour: "I didn't buy it, you sold it to me".

Bugs in software != Cruddy software

[dsr9996]

I've gotta call this post what it is: Unfair.

Yes, this is /.
Yes, hardly anyone here likes MS and people here love to bash MS whenever they can.
That's fine with me. But almost all software has bugs, and in particular bugs that could be exploited to breach the security of the program. Just because MS has a bug in the RPC code doesn't mean that no one should use their software, or in particular the federal gov't should not.

If this same criterion were required of any software the gov't bought, they would have NO software. Linux is not bug free. Software written for Linux is not bug free. The main difference is, Windows is a much bigger target of attack by every hacker and "security group" in the world because it is the most popular operating system in the world. How would any Linux distribution fare if it and its components were used as widely as Windows, and people spent hours every day _trying_ to pass garbage strings of data to all of its external functions in order to find a buffer overrun? I bet it wouldn't do so hot either, and even if it didn't, that doesn't mean that no one should by that Linux distribution, does it?

PROGRAMS HAVE BUGS. And the more complex the programs, the more they interact with other components, often in ways the original programmers never thought of _or intended_, the more likely bugs will be found. My opinion is, taking cheap shots at MS is easy, but writing good code yourself is hard. We're all human beings here, and the developers who work on Linux and open source programs are no smarter than most who work at MS. People make mistakes. Sometimes people don't think about every possible bogus string parameter someone could pass in just to screw up their program. Most of the time the bugs I find in my and other's code is from components trying to _correctly_ use our code!

Flamebait, troll, whatever. Just because you don't like MS for all the /. reasons doesn't justify what you say.

Peace,
Devin

Re:Bugs in software != Cruddy software

[khuber]

But almost all software has bugs, and in particular bugs that could be exploited to breach the security of the program. Just because MS has a bug in the RPC code doesn't mean that no one should use their software, or in particular the federal gov't should not.

You're missing the point.

Microsoft has been bragging up their Trustworthy Computing [sic] and talking about how much better their efforts have been then open source projects. Meanwhile OpenBSD (for example) has had a much, much better security record.

If you brag about your secure code, yet continue to have ridiculous security holes, the technical community should have every right to call you on your unjustified haughtiness! There still appear to be systemic problems with Windows that won't be fixed in a year or two no matter how arrogant Microsoft is.

Where do you want to patch today?

-Kevin

Re:Bugs in software != Cruddy software

[Tackhead]

> Microsoft has been bragging up their Trustworthy Computing [sic] and talking about how much better their efforts have been then open source projects.

And the truly funny part is that when the rubber hits the road, it's still the Same Old Microsoft.

The bugs aren't in the software. THEY'RE IN THE CORPORATE CULTURE OF THIS PARTICULAR VENDOR.

Shit, look at today's hole - a cut-and-paste operation could 0wnz0r j00r b0x0r? Go ahead and secure your box if you like, but...

Note that there is generally a trade-off between ease-of-use and security; by selecting a high-security configuration, you could make it extremely unlikely that a malicious Web site could take action against you, but at the cost of missing a lot of rich functionality.

This is a security advisory? What the fuck? What the fucking fuck fuck?

(Shit, if they put that on the "cut-and-paste 0wnz j00, disable Javashit for a quick fix" page, I'm surprised they didn't put something like "Note that firewalling port 135 could cost you rich functionality and notifications of products and services in which you might be interested" on the remotely-exploitable SYSTEM hole.)

The mindset that values "rich functionality" over basic sane design is why MSFT is unfit to secure Steve Ballmer's head outside of his own ass, let alone HomeSec's b0x3n. That mindset starts at the top, and works its way down to every developer, even the poor motherfucker who has to write up the TechNet web pages on the weekly critical 'sploits. THAT MINDSET is the bug that needs to be fixed before MS crapware can even begin to fantasize about trustworthiness.

(/me goes back to pounding head on desk, repeating "WTFFF", over and over again.)

"WTFFF" - A New Mantra for a New Age of Trustworthy Computing.

Re:Bugs in software != Cruddy software

[simong_oz]

[...] But almost all software has bugs, [...] Linux is not bug free. Software written for Linux is not bug free [...] PROGRAMS HAVE BUGS. And the more complex the programs, the more they interact with other components, often in ways the original programmers never thought of _or intended_, the more likely bugs will be found.

slightly offtopic I know, and I don't mean to pick on your post but it always amuses (and amazes) me that the computer industry gets away with this programs-are-complicated-so-they're-bound-to-have- bugs attitude. I can't think of any other industry in the world that sells a product under the proviso that it may not work properly. Car manufacturers, airline companies, engineering firms, construction companies, NASA - the product better do what it's supposed to first time, every time and the designers had better think of every conceivable way someone might break or misuse (abuse) it.

Re:Bugs in software != Cruddy software

[TheNetAvenger]

You're missing the point

Microsoft has been bragging up their Trustworthy Computing [sic] and talking about how much better their efforts have been then open source projects. Meanwhile OpenBSD (for example) has had a much, much better security record.

If you brag about your secure code, yet continue to have ridiculous security holes, the technical community should have every right to call you on your unjustified haughtiness! There still appear to be systemic problems with Windows that won't be fixed in a year or two no matter how arrogant Microsoft is.


Stating that security has taken a new role in the development of all Microsoft software products is not bragging.

They are very quick to state that the level of security they want to provide is a process as their software engineers and the industry itself matures and is NOT and will NOT ever become a complacent issue.

They have been and are restructuring their development model by adding security experts to all development teams. If you think this is bragging or a bad policy, I suggest wish@microsoft.com to tell them to not have security consultants work directly in the development process.

I won't debate the security level provided by OpenBSD, as they have and do produce well respected products, but they also 'brag' about their security and they also are not impervious to security flaws.

For example...
OpenBSD believes in strong security. Our aspiration is to be NUMBER ONE in the industry for security (if we are not already there). (from OpenBSD.org)

This sounds a bit like bragging to me. .....

And then they go on to list a series of major flaws in the past year.

March 31, 2003: A buffer overflow in the address parsing in sendmail(8) may allow an attacker to gain root privileges.
March 24, 2003: A cryptographic weaknesses in the Kerberos v4 protocol can be exploited on Kerberos v5 as well.
March 19, 2003: OpenSSL is vulnerable to an extension of the ``Bleichenbacher'' attack designed by Czech researchers Klima, Pokorny and Rosa.
March 18, 2003: Various SSL and TLS operations in OpenSSL are vulnerable to timing attacks.
March 5, 2003: A buffer overflow in lprm(1) may allow an attacker to elevate privileges to user daemon..
March 3, 2003: A buffer overflow in the envelope comments processing in sendmail(8) may allow an attacker to gain root privileges.


So maybe you are missing the point, and if not, maybe you should write OpenBSD yourself to request they stop bragging about security on the same page they list several major security flaws (far more than Win2k or Windows 2003 Server) in the past year.

Apparently they are subjecting themselves to the same public ridicule that you suggest Microsoft should be subjected to.

Re:Bugs in software != Cruddy software

[rusty spoon]

Every industry has an acceptable failure rate. That's a fact. Cars fail (both hardware and software - that's why the AA and RAC exist), planes fail, bridges fail. Hell even toasters fail and mobile phones fail.

The difference, if there is one, is that software vendors have a higher tolerance to failure.

I suspect this is because their customers (users) also have a high tolerance for product failure. Fix the customers so they complain more when things go bad and the vendors will have to fix their issues or risk losing their customers.

(note: I am a software developer working on consumer software. I'm happy to fix bugs ;-) )

Re:Bugs in software != Cruddy software

[rhadamanthus]

Tackhead, your mantra is so beautiful it made me weep. WTFFF. I love it.

--rhad

Re:Bugs in software != Cruddy software

[someonehasmyname]

The lprm exploit is a local exploit, which requires having an account on the machine.

The Sendmail exploits could be executed remotely, but by default Sendmail only listens on 127.0.0.1, which would also make it a local exploit unless someone configured Sendmail to listen on an external interface.

Kerberos is disabled by default, and OpenSSL bundled with OpenBSD. It's not their code, although they do 'audit' it.

Re:Bugs in software != Cruddy software

[Anonymous Coward]

You have a good point, but bad examples. Those are flaws in software that is possible to install under OpenBSD, not part of the default install. There has only been 1 remote exploit (that I am aware of) in several years in the default install. Which is slightly less than MS windows...

Re:Bugs in software != Cruddy software

[TheNetAvenger]

Kerberos is disabled by default

And the irony is that Kerberos is a security authentication system.

I am not attesting that any company is perfect or that I don't respect OpenBSD.

I do bring contention to the previous post that said Microsoft was able to be subjugated to ridicule because they bragged about their security and were still producing un-secure software.

Which I still submit, this is about the silliest excuse to discredit Microsoft I have come across in the past few weeks.

Re:Bugs in software != Cruddy software

[Anonymous Coward]

Typically my problem isn't with microsoft or ms bugs, it is how Microsoft handles them. You tell microsoft they have a bug and they ignore you until 200,000 other suckers report the same bug. They they decide whether or not to fix it and downplay the seriousness of it. By the time it is all said and done it is usually months before they come up with and release a patch. This time has been slowly decreasing, but isn't on par with OSD.

In the mean time your ms web server has been comprimised and vandalized.

Example: the last sendmail bug was patched and the release happened 48 hours after the initial report.

>Yes, hardly anyone here likes MS and people here love to bash MS whenever they can.

Go cry into your microsoft mug. we don't want to hear it.

>but writing good code yourself is hard

not when you have a 500 billion dollar budget and unlimited resources. MS can't use this excuse.

>the developers who work on Linux and open source programs are no smarter than most who work at MS

wanna bet: ) 90% of ms coders are interns. 50% of vb coders have never been to college.
Out here in the real world we have to survive by being a good coder. To be a good coder you need to understand the fundamentals of how computers work, preferably down to the kernel level.

In MS it is ok for a coder to make mistakes since you have 32000 people behind you to wipe your butt and one of them is fairly likely to catch your screwup.

>People make mistakes
For the licensing fees they charge, and the resources they have, they have no excuse.

>Sometimes people don't think about every possible bogus string parameter someone could pass in just to screw up their program.

Typical. Anyone who doesn't filter input and check buffers, needs to consider a new line of work. This is the core reason MS products are shiite and insecure. Any idiot can program in vb and find a job doing it. Unfortunately it takes a modicum of talent and knowledge to do it correctly.

l8,
AC

Re:Bugs in software != Cruddy software

[Ironica]

And the more complex the programs, the more they interact with other components, often in ways the original programmers never thought of _or intended_, the more likely bugs will be found.

Excellent point, and one of the biggest problems with Windows. Why is the HTML converter a component of the *operating system*? Why can a web site give someone access to the system if I'm using Internet Explorer? The more "functionality" they pile into Windows, the more points of access there are to the system, and the more bugs are created.

Let's look at the first security hole more carefully: this vulnerability comes from a protocol that allows a program to execute code on a remote system. They derived it from the OSF version of the protocol, but added their own bits to it, and apparently badly. Buffer overflows are a really, really basic issue to handle.

But, furthermore, RPC is enabled by default on Win2k and XP when you install it. This is pretty stupid. A lot of the vulnerabilities that come out about Windows are much, much more serious because the default installation turns them on, even though 90% of the people installing the OS have no need of the function.

Your point that the more code you have interacting on a computer, the more likely you are to run into bad bugs, is well taken. One of the key problems with Microsoft's attitude toward development is that they do not seek to minimize that interaction. You might be able to find as many security issues with a given Linux distro as with a given Windows version, but the difference is that for the Linux bug, chances are it affects only a fraction of the machines running that distro. With a Windows bug, it more often than not affects every computer with that version installed.

Furthermore, it seems that upgrading or patching a Linux install is less likely to interfere with functionality than your typical Windows patch. Again, this is because there is so much interaction between components. As one poster mentioned, this patch broke OpenGL. There should not be interaction between these components. If there wasn't, the patch wouldn't be able to break OpenGL.

I don't like MS, but not "because of all the /. reasons." I haven't liked them since before I started reading /. I don't like them because they place control of the software market above making a good product. They actively make decisions that are designed to make users more dependent on their software, even if those decisions create greater security risks.

Re:Bugs in software != Cruddy software

[YrWrstNtmr]

Car manufacturers, airline companies, engineering firms, construction companies, NASA - the product better do what it's supposed to first time, every time and the designers had better think of every conceivable way someone might break or misuse (abuse) it.

Car manufacturers issue recalls and product updates all the time. Sometimes, the problem is so severe, people die. Sometimes, they have to take aa particular product off the market, before any more people die from it.
Airlines. Their products get hacked, cracked and taken over all the time, unfortunately with spectacular, flaming results. And rare is the flight that lands with zero writeups. Most minor, but still there.
NASA? Flagship product - 2% catastrophic failure rate. After every use, it needs to be completely torn down and rebuilt.

Toys, bridges, buildings, cars...all fail. Computers are no worse.

Re:Poll: Tinfoil hat mode ON!

[sqlrob]

You are correct, but when was the last time you heard someone refer to a Mozilla bug as a Linux bug? If there is a bug in IE, it is usually considered a windows bug

Yes, because MS stated, under oath, that IE is part of the OS. Why shouldn't the bugs count towards Windows?

If there's a critical bug in Mozilla, I can easily strip it out. Now try the same with IE.

Schroedinger's Re:Yes, I run Windows!

[rusty0101]

If you put the computer with Windows 2k on it, in a box, turned it on, and closed up and sealed the box while the bios was turned on, would you have two computers in the box, one running, one BSODed? Too bad the working one would not get anything done, it doesn't have any applications on it.

-Rusty

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

but whose fault is that? microsoft designed their systems that way, and should be held accountable for the problems caused by their designs

No NT Workstation patch

[Anonymous Coward]

Too predictable - NT 4.0 Workstation went off support June 30th, now there is a super-critical bug that they must have known before then, with no update for NT 4.0 Workstation. I guess everyone will just upgrade to Windows XP now...

OK, never mind - the NT 4.0 Server patch does support NT 4.0 Workstation. I guess MS is not absolutely as evil as they could be...

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

Wow. There's something entrancing about that post, and it makes me afraid. So tedious, so horribly wrong, so sad. Somewhat like counting the angels dancing on the head of a pin, where "angel" is defined as anything with more than one wing, and "on" is defined as "within on wingspan of". By which I mean you add pointless complications to an already complicated, and ultimately meaningless question.

It's like the poetry Vogon robots would write, if the Vogons made robots that could write poetry.

Re:Poll: Tinfoil hat mode ON!

[sqlrob]

Exactly what I'm saying. If it's an IE bug, it's a Windows bug. If it's a Mozilla bug, it's a Mozilla bug.

Bye Bye M$

[IdleLay]

I find it incredible that this 'vulnerability" have existed for so long without anyone noticing it sooner. Maybe someone has and kept quite... It is issues like these arises that you have to go through your firewall logs and account for every single byte of information that has gone in and out of any network you maintain if there is a Windows machine within it.

At home, I have one mchine in the house which the kids uses to play games on that still runs XP. After this latest "REVELATION" I think I will move them now to linux or FreeBSD. Anyone know where I can purchase some Linux kiddy games?

At work, well I guess I'm going to be busy going through more logs.

Re:Poll: Tinfoil hat mode ON!

[SCHecklerX]

If software were properly engineered, it would have far less 'bugs'. You don't see any other discipline like this. An engineer doesn't build a bridge/airplane/car/elevator/building any which way and then say "let's see how it works!" Oops, fell apart...repeat. No, they understand materials science, they do preliminary designs/tests/models, they analyze their design, they make sure their calculations are correct, and THEN they build. Computer programmers today do it as a totally backwards clusterfuck. It doesn't help that the tools they use are not properly engineered either (libraries, etc).

Just makes me more glad...

[mbourgon]

I'm still running Windows 95.

Ahhhh, This explains it

[l0ungeb0y]

I've been seeing overflows run against port 135 on my home network for awhile now. Typically, these requests seem to come from Korea. Fortunately, my pc never had that port open anyway, and port 135 is Samba on my mac, but that is not effected by this exploit, though linux had a samba BO exploit a couple months back as I recall.

So, it may be very possible this sploit has been around for some time now.

Did you read the microsoft page?

[Sporkinum]

It only affect you if you are using IE or Outlook, and it can be easily stopped without patching by renaming a file, HTML32.CNV.

You might loose some functionality.. like looking at RTF's with the browser, or moving text into frontpage.

I run Mozilla, and don't use frontpage, so I renamed the file and did not patch.

Remote Access

[randallman]

So how is this any better than telnet? I think I'll just stick with SSH.

Re:Aren't we being just a little hypocritical here

[rsmith-mac]

There is one big difference worth noting, and that is that the Apple hole was a flaw in the screensaver subsystem, which required physical access to exploit(at which point, you should be remembering that a computer is done for if you have physical access anyhow). This flaw on the other hand is a remote exploit, which makes it far easier to exploit than a local exploit, and can be used at any time(versus only when the screensaver is on). I still think we're a bit hard on MS, but something like this should be patched ASAP, even a day is too late.

BILL GATES

[Anonymous Coward]

Bill Gates is not Locutus of Borg. He is Q! All KNOWING ALL SEEING!! BOW DOWN BEFORE HIM.

Note: I'm referring to the old Q... BEFORE the whole Janeway/Voyager incident...

DCOM question

[Anonymous Coward]

Microsoft's knowledgebase mentions the dcomcnfg.exe utility that lets you turn on and off DCOM. Is there any reason why a regular home user would need DCOM enabled? Are there any other similar services that would be better turned off?

Re:Poll: Tinfoil hat mode ON!

[Xerithane]

Hmm, and all this time I thought software was for doing work, silly me! ... Says the man on Slashdot ...

You aren't fooling anybody.

Quality isn't tested in.

[quist]

"We will be updating our automated scanning tool to make sure this type of issue is detected in the future."

Number 3 of Deming's 14 Points for Quality: "Quality is built/designed, not tested into a product."

Were some MicroSoftians sleeping in class?

Re:Turnaround time...- Turn off admin shares perm

[losttoy]

http://www.umanitoba.ca/campus/ist/security/scty_i nfo/desktop/windows/NT4_default_shares_off.reg http://www.lbl.gov/ICSD/Security/systems/windows.h tml

Don't Worry

[Lux]

That's not a bug. As long as DirectX still works, there's no reason to suspect the patch worked incorrectly.

-Lux

Re: yes... hmmmmmm..

[op51n]

Wonder how much coincedence there is in MS waiting to release this information til after they made their deal?

Re:Poll: Tinfoil hat mode ON!

[Tim C]

How many of those are OS level?

Well, I don't know about you, but if one of my machines was rooted because of an unpatched vulnerability, I really wouldn't care at what level the vulnerability was - OS or application, the result is the same.

Furthermore, if a Linux distributor packages an application with their distro, then to my mind, they are responsible for it. If RedHat's apache has a remote root exploit, that's RedHat's look-out, just as for IIS and Microsoft. They have access to the source, they have had ample opportunity to audit it. By including the application, that implies they are happy with it.

Don't think that's fair? Think that there's too much stuff in the average distro to be able to check it all? Well, then, include less stuff - get it down to the point where you *can* check it all.

Choices...

[haeger]

You are correct, but when was the last time you heard someone refer to a Mozilla bug as a Linux bug? If there is a bug in IE, it is usually considered a windows bug (even ones where you must be actively running and surfing with IE).

Ok. As soon as You show me how to remove IE from Windows altogether as I can do with Mozilla on a Linux box I'll agree with You.
A bug in IE is a windows bug since there is no way to remove IE (I don't cound win98lite) while a bug in Mozilla is a bug in Mozilla.

Choices You know...

.haeger

Re:Choices...

[TheNetAvenger]

Ok. As soon as You show me how to remove IE from Windows altogether as I can do with Mozilla on a Linux box I'll agree with You.

Sure, and then we will show you how to remove the font rendering system, the GDI bitmap APIs, and the File System drivers.

The basic ability to display HTML content is a core piece of Windows since 1998. Just as TrueType was added to Win3.1 in 1992, and the ability to show bitmaps and buttons was added in Windows 1.0

IE is just the pretty interface browser that Microsoft provides.

You seem to forget that developers actually like the idea of letting Windows draw the buttons, draw the font, display bitmaps, and display HTML by just telling Windows to do it instead of having to code it yourself.

Additionally, it is nice that these features are consistent in almost all Windows application that use any of these features for the end user.

I truly get tired of the 'remove IE' comments. IE is just a browser that uses the HTML engine in Windows - PERIOD.

The HTML core for Windows was Microsoft's original intention to allow developers and Windows itself to display the new (at the time) HTML standard natively, and IE was secondary.

Because it is a component technology built into Windows, you have seen it used in many mainstream applications, including AOL up until they finally rewrote Mozilla to be a 'HTML engine' much like the HTML engine that Microsoft built into Windows in 1998.

BTW - To remove IE (Open "C:\Program Files\" and delete the folder called "Internet Explorer") It will save almost a full megabyte of space on your hard drive. (Satire intentional)

Re:Choices...

[turnage]

Remove the right files and the right registry keys, and I assure you that you can get rid of IE. You may have to find another file browser, internet browser, and desktop, but IE is removable. I've never tried it to back this statement up, but IE is an application just like everything else. MS has just made it damn difficult to remove because of tight coupling with other applications.

And for this same reason, DCOM is also not part of Windows. It's an add-on. There are no kernel mode drivers for it, and Windows will work just happy without it. You're confusing tightly-coupled applications with OS features. Do you consider X11 part of Linux? How about sendmail? HTTP daemons?

While I agree that it's all put together on the facade to the end user, and MS is really responsible for it in that fashion, the parent poster is right.

Re:Choices...

[Anonymous Coward]

I've never tried it to back this statement up

Then keep your mouth shut.

Re:Choices...

[Feztaa]

I truly get tired of the 'remove IE' comments. IE is just a browser that uses the HTML engine in Windows - PERIOD.

I guess it's settled, then. A bug in IE is a bug in Windows.

Re:Choices...

[TheNetAvenger]

I guess it's settled, then. A bug in IE is a bug in Windows.

Depends on if it is in the browser interface itself or the HTML rendering components of Windows.

But, yes, you would be correct that if the bug is in the HTML core, then it is a Windows bug. I will not argue against that.

Take Care,
TheNetAvenger

Re:Choices...

[Ironica]

I truly get tired of the 'remove IE' comments. IE is just a browser that uses the HTML engine in Windows - PERIOD.

Then how come hackers and script kiddies are able to make it do so much MORE without asking my permission?

Your point is, they've built the browser functionality into the operating system. No one disputes this. However, most of us rational folks realize that, if there's a bug in a component of the OS, it's an OS bug. IE is a component of Windows as you've just reiterated.

You may like the fact that there's a web browser built into your OS, and that HTML code can change things on your hard drive without your permission. I'll keep using Mozilla, thank you.

Re:Choices...

[TheNetAvenger]

You may like the fact that there's a web browser built into your OS, and that HTML code can change things on your hard drive without your permission. I'll keep using Mozilla, thank you.

And what makes you think Mozilla doesn't have the same level of access to your computer?

Actually, not only does it, but the Sun Java you are using BOTH have full access to your system, and there have been bugs in both products that have allowed users to gain full access to a person's hard drive via HTML or JAVA.

So, go ahead and feel safer using Mozilla, it is a fine product, but you are misleading yourself into thinking it is any safer because its HTML core isn't a part of the OS.

We replaced Windows server long ago

[bigberk]

Back when our little organization had a Windows 2000 server (a couple years ago) I quickly realized that leaving the server unattended for a week was hazardous... some major exploit would undoubtedly be discovered.

We replaced it and are quite happy now. We don't pay anything for our new OS, and I go away for months and nothing bad happens :)

One Of These Things Is Not Like The Other...

[neuroxmurf]

There are more posts here than I can count (at +5, no less) ranting on about how since there have been bugs in open source software (including recent severe ones like BIND), Microsoft is no worse than the rest. Bullshit. The current vulerability is (stay with me, now) a remote root exploit in a component that can not be removed and thus is installed on every machine in the world that's running a vulnerable OS and that can't be disabled without rendering the machine worthless. When was the last time anybody but Microsoft had a bug that fit those three categories? Personally, I can't think of one. Does this mean open source software doesn't suck? Nope. Does it mean it doesn't have security problems? Nope. Does it mean Microsoft screwed the pooch? Yep.

Running Mandrake,

[ebbomega]

And using their free Security Update notification, I usually get about 4 or 5 package updates every couple of weeks...
Just letting you know. =)

What patch?

[Anonymous Coward]

I have the automatic notiifaction of updates turned on in my Win2K box, and have already downloaded and installed the patch.

Re:Aren't we being just a little hypocritical here

[Anonymous Coward]

You're just angry because your Amiga died, dude.

Please go away. Linux doesn't need a 'First, hate Microsoft' contingent.

I'VE GOT THE 0-DAY SPLOIT!

[InvaderXimian]

OK script kiddies, fire up your right click and Save As because I've got the batch file with the hacks! 0-day sploit

Microsoft Security Emails

[pommiekiwifruit]

Hey, I get them sent to me all the time! Complete with patch executable. What service! Although I previously didn't know Microsoft was based in Uzbekistan.

Re:Poll: Tinfoil hat mode ON!

[ColaMan]

Whilst I agree with you in principle, If we properly designed,checked,tested etc we'd be where NASA is now with their shuttles - using 5 programs on 70's era computers.

Those 5 programs would be the most robust, fail-safe programs money could buy, but they'd be the *only* ones you could get too, and the'd probably have all the functionality (and speed) of Pong.

(Please, pedants - spare me the gory details of NASA shuttle design - it's just an Arbitrary Example To Help Prove My Point)

In my company...

[Anonymous Coward]

They say they will wait a week to install the patch in all the servers. Meantime, the servers can be hacked at any momment... but apparently, if IT doesn't care, why should I care, being a developer?... :/

Wow... TheNetAvenger just got taken to school

[Anonymous Coward]

phaze3000 straight up knocked his ass out. Game, set, MIZ-ATCH!

Or, as the FPS playerz like to say,

gg

M$ Security problem.

[Anonymous Coward]

Film at 10.

Astounding!

[redelm]

I'm shocked senseless -- Microsoft actually is fixing bugs? Will wonders never cease! More seriously, I think they're feeling some heat from Linux.

Re:Poll: Tinfoil hat mode ON!

[Anonymous Coward]

Plus when you build a bridge, you over design by a factor of 5. This lets bridges not fall down when the strength of a few rivets are a SD on the weak side, or somehow the entire bridge gets filled with overloaded semis in bumper to bumper traffic, both ways.

Leaving aside software for a moment, in computer hardware, you'd need not only ECC RAM, but three sets that voted. Probably the same for each computation (hmm, Space Shuttle...)

Another factor is that people are likely to die if a bridge or building collapses. Your blood pressure might go up during a BSOD, but it's not likely to cause a death directly.

Ever notice how software licenses specifically prohibit life support use?

Re:Poll: Tinfoil hat mode ON!

[juhaz]

Point is, RedHat's apache CAN NOT have a remote root exploit because RedHat's apache is not running as root.

Of course they are responsible for software they package, but most of non-OS level software do not need to run with total control of host machine, like majority of microsoft programs seem to do.

So yes, I'd say its a fair to not compare, full "root" exploit on windows and someone getting hold of "apache" account on rh are way different on potential damage and other implications.

Yet Another Buffer Overrun

[Anonymous Coward]

How many times does this have to happen before soemone at MS realizes that there is a serious deficiency in their designs?

A large number of the vulnerabilities in Windows has been due to "buffer overrun". Isn't it time to fix this? Yeah, it's just stupid programming, but it happens a lot! Isn't it time to fix the underlying design so that stupid programmers can NOT cause vulnerabilties?

Linux/Unix/BSD has also suffered from this: a large number of vulnerabilties has been due to buffer overruns, also. There are specific groups doing something about it (STFW yourself, I gotta get back to work).

The point is this: there are known solutions to this specific problem and MS, if truly serious about security, should have made this a non-issue in Win2003, XP, etc.

Now, this in no way fixes ALL of MS's problems. Many, many, mnay of them have to do with underlying design philosophies and implementation. There are many other things they will have to do to make Windows what I would consider secure, but this is the place to start!

Face it dude, you lost

[Anonymous Coward]

Take your sorry butt to another thread and start over.

Tin Foil Bridges, maybe

[HiggsBison]

Plus when you build a bridge, you over design by a factor of 5. This lets bridges not fall down when the strength of a few rivets are a SD on the weak side, or somehow the entire bridge gets filled with overloaded semis in bumper to bumper traffic, both ways.

I was just reading an old article about how the millenium foot bridge in London was found to be "wobbly", and they had to engineer a very expensive retro-fit to make it safe.

Re:Poll: Tinfoil hat mode ON!

[epukinsk]

Apache only represents a user level security issue.

This is entirely true, but if we are talking about a machine which is a web server and only a web server, the kernel/userland issue is moot.

If a bank robber gets into the vault, what the hell does it matter that the restrooms are still secure?

Erik

Re:Poll: Tinfoil hat mode ON!

[DrDave]

Haven't many of the recent patches applied to InternetExploiter as? In the past MS has said that a web browser is an essential part of the operation system. Do these count as kernal patches or not?

MS Says URL you gave is for NT Server not Client

[isn't my name]

The MS TechNet Article lists the patch URL you provide above as being for NT 4 Server.

In fact, the TechNet article specifically does not list a link for NT 4 Client. Now, it may be that the NT 4 Server patch works on a client machine. I have no idea.

Yes, not reading the article carefully is bad

[isn't my name]

Posting without reading yeah?

Its here http://www.microsoft.com/technet/treeview/?url=/te chnet/security/bulletin/MS03-026.asp.

Actually, I think you are the one who didn't read.

The MS Technet article you link to has this to say about affected systems:

Affected Software:

Microsoft Windows NT® 4.0
Microsoft Windows NT 4.0 Terminal Services Edition
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server(TM) 2003

Not Affected Software:

Microsoft Windows Millennium Edition

And here is the list of available patches:

Patch availability
Download locations for this patch
Windows NT 4.0 Server
Windows NT 4.0 Terminal Server Edition
Windows 2000
Windows XP 32 bit Edition
Windows XP 64 bit Edition
Windows Server 2003 32 bit Edition
Windows Server 2003 64 bit Edition

Note the lack of a link for an actual PATCH instead of simply a notation in the TechNet article that NT 4 is affected. I think you are correct that the parent did not read the TechNet article, because if they had, they would probably have taken the time to clear up this confusion. I think that you did read it because you caught what you thought was a mistaken post by the parent. I just think that you didn't read it closely enough.

Now, it may actually be that MS has an NT 4 client patch, but they don't list/link to it from their Technet article. It may be that the NT 4 server patch works on NT 4 client, but I do not see anything in the TechNet article that indicates that.

But is that correct?

[SuperKendall]

That's just what Ford got lambasted for on the explorer dragging thier feet on notifying users they might just be flipping wiith no cause.

Just because that's what each industry normally does is not a reason to support the practice. Once more, if there is going to be a problem I want to be know about it as soon as possible so I can take steps to mitigate risk.

Companies are reluctant to devulge such information because they worry it makes them look bad. But that's protecting the company, not ths consumer. Since I am a consumer I would naturally sih for the behaviour that best suits my needs - I can't make Ford divulge know issues with cars before they are ready but I CAN subscribe to security alerts and get inside scoops on software security issues. That's why my stance is to release information as soon as something is found, any other behaviour is simply irresponsible.

Re:But is that correct?

[Martin Blank]

I think it is correct in some cases. If industries were required to make public every report of a product defect, they would become so mind-numbing that we would tune them out. Companies get a lot of reports of defects, and not all of them turn out to be legitimately so. Some of the time, they problems are caused by misuse. Sometimes its caused by some damage to the product. And sometimes it is a legitimate defect. Ignoring some of the higher-profile problems like the Explorer or the GMC fuel tanks, most companies are very good about issuing service bulletins or product recalls as needed, because they don't want to get hit by lawsuits or, worse, come under regulatory scrutiny, facing hearings, media exposure, and fines.

Re:Aren't we being just a little hypocritical here

[spruce]

Maybe you're a little of the mark, eh? I mean, when the started out they had 0% of the market. They have since climbed to 10%, later 50%, all the way up until they had a monopoly. You can't abuse monopoly powers until you have them, so 'free consumer choice' was exactly what got them to the top. So maybe, just maybe, you have a major bias against them, and it's not that they produce the worst software?

Re:Poll: Tinfoil hat mode ON!

[sanguine_shadow]

nope. Software is for playing Games.

Re:Poll: Tinfoil hat mode ON!

[the eric conspiracy]

If a bank robber gets into the vault, what the hell does it matter that the restrooms are still secure?

It's a big difference. The apache machine will not become an owned slave doing DDOS attacks, or start port scanning the rest of your DMZ, and if you are carefull you won't even get your site defaced. About all the attackers can do is shut your web server down.

But if there is a real defect

[SuperKendall]

I'm talking about the case where Ford KNOWS that the car will explode if you lean the seat all the way back - in the case of computers, there is no "maybe" about a vulnerability, if a computer is vulnerable then there is an obligation to reveal those details as soon as possible.

If Ford knew something real was up and help back, they would be subject to a class-action suit.

Re:But if there is a real defect

[Martin Blank]

Which is why recalls do get issued in many cases.