Slashdot Mirror
First Windows Vista Security Update Released
Bard Of Vim writes "Microsoft has issued critical security patches for beta testers running the Windows Vista December CTP (Community Technology Preview) and Windows Vista Beta 1, and warned that the new operating system was vulnerable to a remote code execution flaw in the Graphics Rendering Engine. The Vista patches address the same vulnerability that led to the WMF (Windows Metafile) malware attacks earlier this month. The recent out-of-cycle security update for the WMF vulnerability (see slashdot coverage) makes no mention of Windows Vista being vulnerable, but with the release of this weekend's patches it is clear that the poorly designed 'SetAbortProc,' the function that allows printing jobs to be canceled, was ported over to Vista."
Wonder what exploits there will be when its actually out?
What a hell is happening on Microsoft? They have a major Windows version upgrade and they don't even audit their portable old code for such things?! I would get a someone responsible about security in Windows Vista fired ASAP.
How they think will be migration from old versions of Windows if such things will countinue to happen? Yeah, I know, OEM will have Vista and that's all. But with Web applications my pick is that lot of enterprises will stick with their Windows 2000/XP.
No doubt that Microsoft will have hard time to make Vista as smash hit as they would like it to be.
user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
...they're fixing bugs before they release. M$ is doing something right and actually attempting to release a more secure Windoze than XP.
They ported some functional code to their newest project. I hope they don't get unfairly bashed for this, just because a few bits of said code were discovered to be vulnerable. Every halfway intelligent programmer reuses code - it would be far more stupid not to. This is semi-interesting as a landmark ("frist patch!") but not exactly news because of what it contains.
Rex is 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
that Windows Vista isn't going to be all the fresh, hot goodness that we've been promised? For their own sake, Microsoft should step away from their stale and horribly insecure old code bases. They've had enough time now to rewrite the OS a few times over but it seems they chose instead to shoehorn in their old crap. Now is as good a time as any to cut the Win 9x support cord.
The issue here is I think, that Microsoft continues to this day, to be rather sloppy and secretive about fixing their stuff. So if Gibson makes a big flap, so be it. Better that than a back door that MSFT doesn't bother to fix, because they don't consider it a "critical vulnerability" or some other excuse. As Gibson points out, no question this is highlighting one of the main benefits of open source - the source is there for all to see, no dickering about whether it was intentional or not, it gets fixed. Period.
Software Wars
/dev/random
.... will probably call itself 'Hasta la vista, baby!'.
Sorry, couldn't resist, please ignore...
A World in a Grain of Sand / Heaven in a Wild Flower,
Infinity in the Palm of your Hand / And Eternity in an Hour.
> Unpriveleged access will be the default, and it'll be damn near impossible to breach Yes, because of the hardware-level DRM chips it will be impossible. The next few Windoze OSes will be much more secure, not only from the outside, but from the user.
I find it completely amusing not that this is a security bug that lets someone compromise your computer, but that it's the "Graphics Rendering Engine". I wonder how good it is for doing things like, you know, rendering graphics.
Like I said once years ago, if edlin were written today, it would have direct access to kernel-level functions through scripting and be a vector for both viruses and remote exploits.
You are in a maze of twisty little passages, all alike.
--Rick "If it isn't broken, take it apart and find out why."
All operating system updates must of necessity borrow from their predecessors. My question is: Are the security problems in Windows so bad that Microsoft should dump it; are the problems bad enough not even microsoft can go through and patch it all?
I believe it is very likely so. It is time to dump this code and go to a new platform. Whether this is done my microsoft itself or by the many alternatives out there to the Windows operating system.
"Where have all the good people gone?" - Jack Johnson
"poorly designed 'SetAbortProc,' the function that allows printing jobs to be canceled, was ported over to Vista."
SetAbortProc is well designed. The problem is the code that handles the WMF. That code is allowing a payload to be placed on the stack and an incorrect pointer to be sent.
All set abort proc does is send an abort code to the print job and set a call back method to call when the abort completes.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
Don't people use firewalls anymore?
Firewalls don't help in this case. The flaw allows attackers to execute code of their choice on a system when the victim views a WMF file (on a website, for example).
All those who believe in telekinesis, raise my hand.
That is why this is such a dangerous vulnerablities. Since this is a vulnerability in the graphics engine (metafile playback) it can be exploited through a web page that contains a malicous graphic. That will come right in through port 80 on your firewall.
doesn't this type of thing happen in a lot of betas?
Yes, and Gibson is well known for *not* being an open source advocate, quite the opposite. So for him to start swinging towards open source is really a big thing.
IIRC, Gibson wasn't saying it was a back door that Microsoft hadn't bothered to fix. He was suggesting that it was a back door that somebody had put there on purpose.
Breakfast served all day!
... in the computing world that applies not only to many aspects of the evolution of technology, especially software.
"Garbage in, garbage out."
I wonder how much of Vista is actually based on new code. Is Vista going to be Windows XP in Mac OSX's clothing? And is it going to inherit the same piss-poor security it's predecessor had? I certainly hope not.
It's been speculated that the WMF vulnerability was there intentionally for whatever reason, or so GRC reported: http://www.grc.com/SecurityNow.htm#22 . Now if it was a rouge programmer or part of MS's plans for world domination, we don't know, but if it was indeed placed there intentionally, it wasn't a bug. If it's not a bug, then of course it would survive the code auditing several times over. Because of the recent discovery of it by the public, of course, MS had to fix it on all OSes, and the Vista patch was just later than the others because it wasn't as critical.
This says more about Redhat FC than Microsoft, in this case. Just about weekly there is discovered a new local root vulnerability in the Linux kernel, and having dozens of those in the last year or so does not speak well of Linux security.
entertaining. Google "beta" products that are used by millions have huge security bugs that let malicious persons read anyone's email and nobody says much and it is swept under the rug. Microsoft's "beta" products that are only in use by testers/developers have a security issue and everybody's shaking their head and talking about how horrible MS is. It's just amusing to me.
Isn't this just a little too much? Do the people who accept these sort of stories have ANY introspection at all?
Humor from a Genetically Molested Mind
Say what???
- 2005-3257 Date? 2005-10-17
- 2005-2490 (and 2492, both with sendmsg) Date? 2005-09-09
- 2005-1768 Date? 2005-07-11
Just about weekly? I beg to differ. Last local root exploit:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE
The one before:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN
How about the one before?
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN
Perhaps you'd like to backup your claim?
Dozens? No. Several? Yes. Dozen? About that. How many would M$ products have if as many eyes analyzed it relentlessly? A metric assload. Take the partial 2k source code for an example.
...that Longhorn (now Vista) is completly new design... from scratsh... none of the earlier flaws would be ported to it ? ...or are they full of shit as usual ?
Do I remember wrong ?
From the Microsoft Security Center Blog, facts about "the recent WMF issue" and SetAbortProc.
4 17431.aspx
Now that the monthly release has passed and people are deploying the updates I wanted to take a moment to discuss some things related to questions we've been receiving on the recent WMF issue. (Which was addressed in MS06-001).
http://blogs.technet.com/msrc/archive/2006/01/13/
Actually, .NET 2.0 runs on everything short of Win95 AFAIK. Vista isn't about .NET 2.0 whatsoever, it's about a bunch of other new technologies:
.NET 2 and that people don't care about that is uninformed at best...
WPF: Windows Presentation Framework ("avalon"; using XAML): what WinFX and the new AERO Shell are based onto;
WCF: Windows Communication Foundation ("indigo": an enhancement to Web Services, MSMQ, etc);
WWF: Windows Workflow Foundation, to help take care of scenarios like the one that was asked on "ask.slashdot.org" just yesterday. Something that's becoming increasingly common/important nowadays.
People like to just dismiss Vista like it has nothing new or worthwhile, ignoring all the new stuff that actually IS there, not just the previous 3 things mentionned, but there's a great deal of other changes (video drivers not in kernel mode anymore, new audio and printing (both work quite differently), GUI rendered by the
There are differences. It may not be worthwhile to everyone, but as a programmer I'm looking forward to many of these advances (WCF seems really nice). Saying Vista is about
///<sig
Well I kinda summed it up a bit too much but my point is that *users* won't care about such technologies. I, as a developer, think they might be nice (but as I'm switching over to Linux I don't care too much); users won't. I was not saying Vista is stupid or limited; I was saying users will not perceive it as worth much more than XP. Then of course if developers force them to use Vista, that's another story...
Global warming is a cube.
But going forward MS is going a whole new outlook on security.
That's funny. Outlook was one of Microsoft's first major security problems.
Microsoft is to software what Budweiser is to beer.
Now, any good sysadmin knows that he shouldn't be running 2.6 yet, which renders most of the 2.6 vulnerabilities moot for gauging the security of a linux box. When 2.4 was riddled with holes, we used 2.2, and so on.
Another thing good sysadmins should do to minimize threats is to chroot all of his daemons as well as not provide them with logon shells and huge 100+ character pwgen'd passwords - effectively negating the vulnerability from a server standpoint.
Those are just two of the things Linux offers us that M$ software does not. To say that local exploits on the newest kernel should be humbling to the linux community because it's no better than Microsoft's latest "stable" OS is ignorance in just about every way.
Now people are making fun of microsoft for porting this over to vista! Do any of you know what it is. If you are a graphics designer you probably should know what it is. Look it up graphics designers and web designers love vector graphics. This is the file that allows windows to draw vector and bitmap images on pre 2000 systems, though it is still included for backwards compatability.
A metafile is a list of commands that can be played back to draw a graphic. Typically, a metafile is made up of commands to draw objects such as lines, polygons and text and commands to control the style of these objects. NOTE: Some people equate metafiles with vector graphics. In most cases this is fine; but, strictly speaking, a metafile can contain any mix of vector and raster graphics. For example, a metafile could contain just one command to display a bitmap! Unless the distinction is important, we will consider a metafile to be a kind of vector graphic.
The reason it was still included is cause it is technically a file format! Do you rewrite everything in linux? Was php totally rewritten from the ground up from php4 to php5 i don't think so.
Just my take on things!
I am giving away 2000 premium accounts on my new dating website myfantasyromance.com check it out!