Slashdot Mirror
Three New Microsoft Bulletins
Jimmy M writes "Microsoft has released three security bulletins for January, which correct vulnerabilities in the handling of Icon and Cursor files, Indexing Services, and HTML Help. Bulletin MS05-001 (HTML Help) is the Extremely Critical vulnerability (Demonstration) that Secunia warned about last week - nice to see a quick move from MS. All updates are available from Windows Update."
The extremely critical exploit was listed on 2004-10-20! It took nearly three months to fix.
It should be noted that those with XP SP2 are only affected by MS005-01.
- AMW
It would also seem microsoft released "Malicious Software Removal Tool" on WindowsUpdate
It finds and fixes some common worms.. They plan on releasing a new version every second Tuesday of each month, and each new version will continue to clean worms from the previous versions.
Wonder what the antivirus companies think about this
[an error occurred while processing this directive]
This page has more technical information about the tool.
[an error occurred while processing this directive]
Bad policy: Accept all, but let people turn things off.
Worse policy: Accept all, but let people turn fewer things off depending on four arbitrary "zones" something falls into.
Worst policy: Make sure the "zones" in question have nothing to do with TCP/IP, netmasks, DNS, or any other networking concept, but make sure they're supported by a proprietary application you've embedded deeply into the OS to facilitate an embrace/extend/extinguish business model.
Then act all surprised when everyone ends up running at least one of these "zones" (namely the "local" one, which ought to be the most trustworthy) with their proverbial pants down, thereby creating a guaranteed 100% available target for Worm/Spyware/Virus authors.
Can someone please find the creature responsible for "Internet Zones" and beat him to death with a large wooden mallet?
I don't normally stoop to Microsoft Bashing, but security vulnerabilities in icons and cursors?!?!?
Wanted: witty unique signature. Must be willing to relocate.
``How many will reply to me saying I'm out of my mind?''
At least one. The vulnerability was updated on 2004-10-21. That means it existed at least about 3 months before the fix. I don't know about you, but I don't call that quick.
Please correct me if I got my facts wrong.
Fixes available via Windows Media Player ...
I find this part of the security bulletin especially interesting:
"Windows 2000 is not affected by this vulnerability. However the additional security-related change does affect Windows 2000 and we recommend customers install this update."
The old adage usually goes "if it ain't broke, don't fix it". Why would they ask people to patch something that isn't broken? Does this indicate that they expect to find a similar flaw in the indexing service on Win2K?
First, Secunia released the advisory for Windows security update 890175 (MS05-001) back in 2004-10-20. Secunia linked to a workaround for the flaw 8 days after this, that was posted by Microsoft. Secunia increased the severity rating in 2005-01-07, and 4 days later, Microsoft has now posted an actual fix.
Now, the story, unfortunately for Windows users, and fortunately for e.g. open source evangelists, it seems like there is some things to be aware of if needing to uninstall the fix, for example due to possible problems caused by this fix, which are mentioned here, under the "Known Issues" heading.
In other words, we're talking about one issue that may appear as a direct consequence of installing this (my first link) and another one if you then decide to uninstall this fix (my second link).
Of course, if you aren't subject to the first problem, you don't need to do a thing and you are indeed living in the environment Microsoft was crossing their fingers for that you would be in.
Beware: In C++, your friends can see your privates!
Perhaps the same way as the widely-used and open source libpng library had a number of vulnerabilities last year? (ref 1, ref 2)
Or the same sort or way the Mozilla XBM vulnerability arose? (ref)
This isn't a new thing, and it's not unique to Microsoft, either.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Totally OT, but you missed the repliers point. When you disagree with someone, you have at least two options. You could:
1) Submit a post that provides an argument, preferably backed up with some data.
2) You could call the original poster a "chump" (or some other disparaging remark) and use a meaningless comparison as your discussion point.
Guess which of these two options is better?
An attacker could entice a user to open a specially-crafted PDF file, potentially resulting in the execution of arbitrary code with the rights of the user running the affected utility.
That is not a linux problem. That is an Xpdf problem. Xpdf is letting the maker of a PDF file gain the rights that the Xpdf program normally has. Now, if this exploit allowed the user to gain root access (assuming the current user is not root) there would be a tad more going on as Xpdf should never have root access.
Now this isn't to say linux is perfect, but saying that every linux application security bug is the fault of linux isn't true either. However, this really comes down to the design differences between linux and windows. Running linux as root all the time can be just as dangerous as windows.
It is also a problem of monolithic vs. modular programming. Having IE, your window to the internet, being so deeply imbedded into your OS is only asking for problems.