Slashdot Mirror
Security Vulnerabilities Discovered in WinXP SP2
SoTuA writes "Few months after SP2 hit windowsupdate.com, Finjan Software reports that security flaws have been found in WinXP SP2, including malicous code execution without user intervention. Finjian has turned over the findings, along with proof-of-concept, to Microsoft."
It was only a matter of time until a major vuneribility was found in SP2. I'm sure there will be others, but at least they are being found before they are taken advantage of.
At what point does a story become so routine that it no longer counts as news?
Technology, the cause of and solution to all of life's problems.
What they said: By exploiting all vulnerabilities discovered in SP2 by Finjan, attackers can silently and remotely take over an SP2 machine when the user simply browses a Web page"
What they meant: By exploiting all vulnerabilities discovered in SP2 by Finjan, attackers can silently and remotely take over an SP2 machine when the user simply browses a Web page with Internet Explorer
Using these vulnerabilities to shill it's products.
This isn't to say that the vulnerabilities aren't real, they might be.
But this is a marketing ploy for Finjan
I tend to find that extremely competent programmers, with a lot of experience, tend to make nearly bug-free software...
:), the vast majority of programmers out there simply suck, bad. Judging by most faults I've seen, and despite what so many people say: MS programmers suck.
Unfortunatly (or fortunatly for some of us
Yeah, and of course we all criticize MS for releasing buggy software. The counter-argument always that of course MS can't fix every single bug. Supporting that, people point to vulnerabilities in apache, mysql, etc.
The problem with the latter is that most Linux-based software is open-source, nonfunded. Whereas Microsoft is the largest business this side of Alpha Centauri.
I'd like to say pshaw, no big deal, but the amount and severity of MS bugs/exploits is deplorable considering that Windows is the flagship product of one the largest corporations in the world. Stop entering new markets and release a stable, secure product in the next millenium please.
Flame on.
P.S. I'm going to establish a charity for those who believe using a dollar sign in Microsofts name does anything other than diminish one's argument.
-- I have fans? Wow.
The more complex the plumbing, the easier it is to stop up the works!
My rights don't need management.
I believe that with Linux's usability improving each and every year, and Mac OS X's increasing appeal to computer users, sooner or later, Microsoft will be in deep trouble. No OS is completely secure, but Linux and Mac OS X doesn't suffer from the one main problem that faces Windows security: the integration of web browsers (Internet Exploder), media players (Windows Media Player), and e-mail clients (Outlook Express). Windows has a lot of other security issues too, due to huge amounts of legacy code, a horrible system of user management (why must a user be logged in as Administrator to play a game?), insecure services running, and more.
Windows needs a rewrite. The kernel is fine, but there should be a new set of APIs (get rid of legacy stuff), a better command line (with the option of booting into it), disintegration of IE, WMA, and OE (make them separate programs that can be uninstalled), better user management (similar to Unix's user management), and finally, a secure "blue box" that runs "classic" Win32 and Win16 programs (similar to Mac OS X's classic mode). If Microsoft does this, they'll finally have a secure and stable OS, and who knows, I might even recommend Windows to users. But until then, I'm sticking with FreeBSD.
I find it disgusting that Microsoft has plans to sell anti-virus software to plug up the holes they stupidly left in their OS. Shouldn't developers be forced to make secure products?
If it's discovered my model of car has a set of brakes that have a chance of not working after a certain gear shift combination, the car company issues a recall - they don't tell everyone "oh it's not a big deal, if you want go to a mechanic and buy a new set of brakes."
We get patches for free (well kinda...after paying for the software) but they only seem to fix one problem *at best) for a hole found in the wild by people outside MS anyway. That doesn't even begin to cover spyware and viruses.
As far as you know.. We really wont know if somone has taken advantage of something 'secret', unless they either get caught, or boast about it..
THOSE are the scary ones..
---- Booth was a patriot ----
Its an interseting dillema, because they very likely would _not_ be a $40bil if they didt release awfull software .
If they were to follow a very strict engineering process similar to what defense, nasa, and energy depts follow, their software would cost more then it already does, be years behind on "features", and make it very difficult to have the knee-jerk reactions to market desires it currently does.
I would argue that their success, aside from their edgy, sometimes illegal business practices, came from focussing more on UI and integration (or lock in depending on perspective) then on things people didnt understand at the time (security, stability, standards, interoperability, etc.).
Software has thus far been treated and behaved very differently from traditional engineering and manufacturing as there is no entity like UL (Underwriters Lab), FDA, FCC, DOT, etc. enforcing standrds of safety and allowing users to sue them for selling sub-par products. MS could move quick with a shoddy product and say they clicked "agree" on the EULA, security or stability be damned.
I was just wondering if you saw the implicit contradiction in your statements.
and
I'm going to establish a charity for those who believe using a dollar sign in Microsofts name does anything other than diminish one's argument.
Your whole post drives at the point that Microsoft is in the business of making money and not making good software, yet you come along and decry those who would say the same thing in a much more concise form, "M$".
< Mode flaming = "off" >
-- The morphemes of your disquisition are ascertainable, but they have eschewed an ambit of transpicuous exposition.
...and its not the fault of Agilent LogicWave logic analyser because?????
rewriting history since 2109
Per its usual policy, Finjan has no plans to go public with details of the flaws until Microsoft has patches available for them
and
Our early analysis indicates that Finjan's claims are potentially misleading and possibly erroneous regarding the breadth and severity of the alleged vulnerabilities in Windows XP SP2
Why should people who are trying to help just get insulated? It's time to release the exploits to all of us after all, so that we can decide for ourselves who is making erroneous statements.
If this software is some expensive corporate software and you are paying big licensing money for it, you should just request an update from Agilent. If this is not an option, just isolate the systems running this software from the net, in a secured area. A lot of systems in the world are unpatched and old for various reasons, but they do their job without being breaked, just because they are isolated well enough. If you require internet access, just put a second PC on your desk, with SP2 and no Agilent.
With all the service packs you have to do an "all or nothing" approach, which causes lots of wasted time and money because you have to test, test, test before deploying a SP.
On Linux, when there is a problem with package X version y, I can just upgrade to version y+1.
I also don't need to set up a test machine because I can go back to version y if version y+1 doesn't work for some reason. (ha, try to go back a service pack. You can't, it's reinstall-time)
"Tools">""Options">"OpenOffice.org">"General">" H elp Agent">"Activate" (uncheck the little box)
.txt files to open as csv in spreadsheets AND set default delimiter to tab AND default text entries to not be delimited with quotes? I'd be happy solving just the first two.
You got me there. Honestly, I never tried to turn of the lightbulb. But could you inform me on the following: How to not not capitalize the first letter of an entry in a spreadsheet field AND default
Aside from that, I love OO and linux, I use them near 100% of the time. My comment was really more a jab at people who love to hate Microsoft but are blind to obvious faults and failures in OSS.
You don't play multiplayer PC games, do you ?
...then carefully remove as much Microsoft software from your machine as possible.
Start with MSIE and MS Outlook, then MS-Office (replace them with FireFox, ThunderBird and OpenOffice, respectively). Really dig in and make sure every trace of them has been removed, don't stop at believing what the MS uninstaller tells you about MS Outlook.
Don't offer any shares, even to the LAN (get people to dump stuff elsewhere on the LAN and you pick it up from there), connect to the minimum number of shares (zero if possible) and for the shortest reasonable time.
Run a good firewall.
Pray a lot.
One more option: if you have a modern Linux box around, throw LogicWave at WINE on that and see how far it gets. If it doesn't work outright, maybe you can hack up an interface to the actual analyser in WINE. That'd be a lot of effort for one workstation, but if you have 20 or so it might be worthwhile.
Got time? Spend some of it coding or testing