MS Critical Patch Fixes 8 Vulnerabilities

nandemoari writes "A hole allowing hackers to take control of Microsoft Exchange was just one 'critical' issue the Redmond-based company promises it has fixed with a patch correcting a total of eight vulnerabilities in its programs, including the Internet Explorer browser, Office, and its SQL Server. Three of the eight vulnerabilities patched yesterday were marked 'critical.' The most concerning is an issue with Exchange that would allow attackers to take over an Exchange server by simply forwarding a carefully crafted message to a corporate mail server. Microsoft has admitted that the vulnerability can be exploited when a user opens or previews an email in the Transport Neutral Encapsulation Format (TNEF)."

Comments

Doesn't Sound so Bad

[segedunum]

Many people would love to outsource management of Exchange server, and it's even better if someone wants to do it for free.

Re:Doesn't Sound so Bad

[Anonymous Coward]

I'd like a free message to Think about your breathing

Re:Doesn't Sound so Bad

[Anonymous Coward]

wat

Re:Doesn't Sound so Bad

[urbanriot]

Why? If a company with in house IT can't administer an Exchange server, there's something seriously wrong with their staff selection.

Re:Doesn't Sound so Bad

[gid]

Might not be a bad option for small IT shops--If you promise to keep our exchange server running smoothly, you can send all the spam you want.

Re:Doesn't Sound so Bad

[Anonymous Coward]

I breath with...*pshhhhhht*...a mechanical...*pshhhhhhht*...ventilator you...*pshhhhhht*...insensitive clod! *pshhhht*

Re:Doesn't Sound so Bad

[SatanicPuppy]

Maybe their budget doesn't stretch so far as to be able to employ 1 guy to do nothing but manage a mail server.

Exchange is a big pain in the ass, and it doesn't scale very well. I hate it, and all I have to do with it is keep it from ever touching the web directly.

Re:Doesn't Sound so Bad

[geckipede]

Until your mail server gets added to a load of blacklists and you find yourself unable to contact half of your clients.

Re:Doesn't Sound so Bad

[Anonymous Coward]

path of vector j:
==============>

* <-- your position relative to j

Re:Doesn't Sound so Bad

[Anonymous Coward]

Just use a different server for outgoing smtp. :)

Re:Doesn't Sound so Bad

[DarkOx]

E2k7 is a major leap forward in terms of scalability and touch requirement's. Its probably easier to architect correctly as well compared with e2k3. E2k3 and prior could actually scale pretty well but you had to be an exchange guru to do it right and spend a lot of energy managing the environment. They also worked ok for small single server shops out of box with little touch. It was the vast space in the middle they handled poorly.

E2K7 strikes me as something that would be a bit of bare for anyone not and IT professional to handle. Its architecture is much better and encourages better deployment design so a non expert can probably do a good job with it, even as things get pretty big. I doubt many part time admins in the small business would would have much success at all though.

Re:Doesn't Sound so Bad

[Anonymous Coward]

Son of a bitch.

Re:Doesn't Sound so Bad

[SatanicPuppy]

Let me start by saying that I never want to see the words "bare" and "it professional" in the same sentence. Ew. Ew. Ewwwwwwwwwwww.

That being said, I'll acknowledge that Exchange is actually improving pretty dramatically between releases. Even 2k3 is so far ahead of earlier Exchange releases as to be almost unrecognizable. We run about 300 users on a pretty small hardware footprint, and, provided you run everything through an antivirus before you send it to the users, it all works with little supervision.

I used to spend time trying to ween people off of Exchange, but it's practically impossible. Nothing else on the market compares...Even the big commercial competitor Lotus is a joke compared to Exchange.

Re:Doesn't Sound so Bad

[NatasRevol]

I run Mac OS X mail server (cyrus/postfix) with about 400 users on a small server with no problems, a simple interface(ServerAdmin), a complicated interface if you want it(CLI), and a shit load less cost than 400 CALs.

I'd say it compares quite nicely to what you have.

Re:Doesn't Sound so Bad

[Anonymous Coward]

There is a big difference between 'mail server' and 'exchange'.

Re:Doesn't Sound so Bad

[SatanicPuppy]

I've run it, and it doesn't. That you put them on the same page shows you've never run Exchange because Exchange is not about email.

I'll tell you what I tell everyone: you need to go use Exchange for a while. Sit behind some manager and watch them fuck with their goddamn calendars for a while. Watch how neatly the calendars integrate with the email. Watch how it integrates with Office for document collaboration.

There is no one product that handles all those features so well and so seamlessly.

All those features can be had from a half dozen different OSS apps, and when you've laboriously cobbled them together into a working whole and presented it to management, they will give you a look like you handed them a plate full of dogshit, and then they will give you a list of things that aren't as good.

And when you go back to your office you'll go over the list and you will grind your teeth because the fuckers are right. You will never convince people to ditch exchange until you can provide a product that is just as good.

Re:Doesn't Sound so Bad

[NatasRevol]

Can I include on that list
  - send an email to the server to pwn it?

Exchange is good if you're an all Windows shop. If not, it's just as good as postfix/caldav/smb.

Re:Doesn't Sound so Bad

[subsoniq]

it isn't a pain in the ass if you actually have a *clue* to what you are doing, and as for scaling, we run 3000 users per exchange mailbox cluster, and we expect to be able to get well over twice that when we go to Exchange 2007.

Re:Doesn't Sound so Bad

[marafa]

grandparent post dint .. umm .. never mind

Re:Doesn't Sound so Bad

[SatanicPuppy]

Clearly you've never used the beauty and wonder that is Entourage. [/sarcasm]

You're right, and you're wrong. The assumption is that you just don't need fancy calendar apps, and mail server based collaboration and crap like that if you're a unix/linux shop. I know how it is. Even mutt is decadent to a hardcore unix freak, just grep the mail spool you pussy!

And really, the Exchange infrastructure is massive overkill if you're a small shop anyway.

But for a decent sized corporation it really helps to be able to manage all that crap. Where I am we have about 40 major business units, and we're forever passing off projects from one property to the next, so it makes for constant meetings and crap, and it's really nice to just have a massive shared calendar and scheduling system that works with your email.

Even the subset (of which I am a member) of the corp that does only linux/unix stuff gets a lot of mileage out of Exchange. We hate to admit it, but it's impossible to coordinate it on a traditional mail system, and our various message boards are too crowded for that crap, and it doesn't manage groups well, so you have to know everybody you want to talk to at 40 properties, etc.

I guess I'm saying, it can still be nice, even if you're all about the unix.

Re:Doesn't Sound so Bad

[NatasRevol]

Good to know. What do you think the break point would be? >1000 users and it's worth the cost, time & effort?

Also curious if you think taking the money spent on CALs, licenses, etc and spending it on infrastructure & setup for a more unixy back end would result in something close. Like using the stuff from 37 signals.
http://www.37signals.com/

Re:Doesn't Sound so Bad

[tubeguy]

Whew. Forgot about that.

Re:Doesn't Sound so Bad

[Anonymous Coward]

Hear hear!

I used to basolutely *despise* Exchange and anything around it, since I had used it in version 5, and it was a total POS back then, with unstable mailbox storage and so on.

I used to try to mash together postfix/mysql/courier/squirrelmail/whatever with some half-assed approximation of server-side mailbox storage using IMAP, but really, it was terrible, now that I've moved to a mostly MS shop, with Outlook 2003/2007 and Exchange 2003 (and soon 2007).

I actually had a thought about MS products the other day, a sort of quip - Microsoft is the language of Getting Stuff Done in Business. Seriously - if I want to have a meeting with someone, it's as easy as click "New" -> "MEeting Request", type in teh name and select the date, and we're done. It is then synch'd with my Blackberry and OWA sees it immediately.

Nothing compares to Exchange, and you are absolutely right, it is not about email. There are still lots of weird things about exchange and some things I still despise about the lock-in, but really, at the end of the day, it's about me having the time and the freedom to spend my life being productive with the things I want to do and to have more time with my kids, since I spend less time #@!&)* around with some stupid IMAP server.

Re:Doesn't Sound so Bad

[SatanicPuppy]

Who knows? The thing is, once you have 1000 people, the critical mass of pointy-hairs will make Exchange a requirement.

Still, 70 bucks a seat sounds expensive when your budget is in the hundreds of thousands. When your budget is in the millions, that's like 1 manager's salary, so you fire the guy you like least, and buy exchange for the company.

I am often at a loss to explain business decisions though. We use this huge proprietary design system, and for years we were shackled to the old version of the system by costs of the hardware upgrade (old solaris mainframes). I sat down one day and took the new version of the system (which we had for free, since we were paying support), and made it work on open solaris on x86 hardware.

Took it to my boss expecting a raise, and maybe, you know, some appreciation. Got told off because my solution didn't account for the need to buy ~40 CS3 licenses (around 30k, for some new copies, and some upgrades).

Fast forward 6 months, and we went out and bought a NEW system to do the same thing for more than 10 times what my upgrade would have cost. The new system only replaces half of the old system, so we still have half a crappy old system to maintain, and, AND, we still had to buy the fucking CS3 licenses!

Front to back it cost us probably half a million dollars and the new system is universally hated for its crap speed and crap stability (it's running, I shit you not, on virtualized win2k boxes...I could fucking weep).

The thing is, my solution was impossible because it couldn't be put on the capital budget because it was over the max budget for an in-house upgrade. But the much more expensive system could because it was under the budget for a purchased system. Penny wise, pound foolish.

Re:Doesn't Sound so Bad

[Anonymous Coward]

Father, is that you? It's me, Luke...

Re:Doesn't Sound so Bad

[joemod]

Is your boss the owner of the company? I am asking because here where I live many managers don't like solutions like the one you provided since purchasing new hardware/software systems may result to hidden gifts from the sellers. You know, "Your purchase cost 100.000, here is 5.000 for your efforts"

Re:Doesn't Sound so Bad

[Anonymous Coward]

I recently started working at 'bigcorp' with no prior knowledge of Exchange. Compared to the nice web and dedicated mail and calendaring solutions that I had been using, Exchange is a dinosaur. Exchange email search is absolutely useless. UI is poor. Calendar works but is tedious compared to something like Google calendar. We also have Sharepoint which seems to be designed to hide information and make it difficult to use collaboratively. Google docs blows it away. I can't believe that 'bigcorps' actually function using this Exchange/Sharepoint pile... oh, wait... this organization doesn't actually function very well.

yes and update deletes files

[Anonymous Coward]

it seesm the updates delete some critical files from the reports I have seen

Is it that easy?

[UnknowingFool]

I don't know anything about Exchange but you mean to tell me that someone sending an email to an Exchange server can allow it to take over the server? It's one thing for hackers to rely on social networking and fool a user into executing an attachment. It's another thing to be able to takeover simply by sending a message.

Re:Is it that easy?

[Anonymous Coward]

Like sendmail has never had critical vulnerabilities in its address parsing code?

The irony is that the error is in MS's proprietary TNEF format. This is a binary format so it should be easy to parse.

Offtopic, but why can't slashdot link to the meat rather than some ad-laden rehash?

Re:Is it that easy?

[gzipped_tar]

It is possible... this is usually the symptom of buffer overflow error in the server code. An attacker discovers the hole, takes advantage of the vulnerable buffer to "smash the stack", and dupe the process to execute the shellcode (concise machine code that does whatever an attacker wants) planted in the "specially crafted" mail text.

There are other possibilities but buffer overflows are among the most common ones. I didn't RTFA and neither do I know whether this is one but yes, taking over the server by malicious input *is* possible without social engineering, provided the service code is bad enough to be exploited.

Re:Is it that easy?

[MightyMartian]

Thank goodness my Exchange server is behind a firewall *and* a Postfix SMTP proxy running on a Linux box. There's no direct exposure of Exchange to the outside world.

Re:Is it that easy?

[RiotingPacifist]

yeah but qmail hasn't :p

Re:Is it that easy?

[lukas84]

Unluckily for you, this vulnerability will still affect you. If you read the security announcement by Microsoft, a possible workaround is to block all TNEF / winmail.dat attachments, which will break all incoming RTF mail. Depending on what your business exactly does, this might not be a viable workaround.

Re:Is it that easy?

[DiegoBravo]

> this is usually the symptom of buffer overflow error in the server code.

I really don't understand much about MS technologies, but why their Exchange server is not rewritten in C# so at least buffer overflows can be avoided?

Re:Is it that easy?

[Just Some Guy]

yeah but qmail hasn't :p

Of course, it has about 5% of the features of Exchange or Postfix or Exim or Sendmail or...

Re:Is it that easy?

[SatanicPuppy]

Wow, you have a firewall that stops email from getting to a mail server! I gotta get me one of those...It would reduce my workload by 95%! Since I don't answer any of my phones, the only way people could contact me with problems would be by ambushing me on the way to the bathroom.

It would keep the CEO from ever contacting me, that's for sure. God knows he'd never be caught down here with people who do work.

Re:Is it that easy?

[Low Ranked Craig]

It's not that scalable now, wait until it's written in .Net...

Properly written C and C++ code can and should trap all exceptions. There is no excuse for untrapped buffer overflows in mature commercial code.

Microsoft's method is to wait until a vulnerability is discovered, then patch it, as opposed to rigorous code reviews to proactively identify potential untrapped errors.

It's not like the cause of overflows is a complete mystery. Well... maybe it is to Microsoft.

Re:Is it that easy?

[GooberToo]

Sendmail is infinitely more configurable and complex than Exchange Server's SMTP MTA. Don't get me wrong, I'm not defending sendmail's history, but using flaws in something as complex as humans to justify flaws in unrelated bacteria doesn't cut it.

Re:Is it that easy?

[MightyMartian]

No, I have a Postfix server exposed on port 25, while the Exchange server sits unexposed behind the firewall. The Postfix server receives, processes (if necessary, to turf spam, etc) and then passes on mail to the Exchange server. The Exchange server then passes mail off to the Postfix for outgoing transmission.

Re:Is it that easy?

[gzipped_tar]

Properly written C and C++ code can and should trap all exceptions. There is no excuse for untrapped buffer overflows in mature commercial code.

Buffer overflows are programmer errors, not program exceptions that signal some kind of event. They can't be "handled" -- they must be eliminated from the source code.

Re:Is it that easy?

[thePowerOfGrayskull]

If your exchange server will handle this message in the routing chain, you're vulnerable.

Re:Is it that easy?

[DarkOx]

Well the firewall won't help you with this vulnerability because even after the message is handled though the other mail gateway it can still be a threat. It is however very common to not let exchange speak directly the the outside world. I for one block all smtp at my edge firewall except to and from a cluster of Barracuda Spam filters. They also used to be configured as a smart host in the E2K3 world. In 2k7 i simply don't use the edge transport rule and let the hub transport server treat them as a send connector, for * address space.

I know lots of other people with the same setup.

Re:Is it that easy?

[SatanicPuppy]

I was more referring to the firewall aspect; struck me as funny. I once went to a property to do a security audit, and found that their firewall literally blocked EVERYTHING. No ports open at all inbound OR outbound. They paid for a broadband connection, but the individual computers were all on dialup, because they thought that's just how teh interwebs worked.

We run a secure proxy for OWA, sendmail proxy for DMZ'd email handling, a SAV gateway for virus scanning, and upstream of our internal systems we pay for Postini to handle spam and other virus stuff.

We run really anal rules on top of that. Haven't had any virus problems in a while.

Re:Is it that easy?

[Anonymous Coward]

Yes and no. Buffer overflows are programming errors, but how the OS deals with/allows those errors to effect things are fundamental design decisions that the programmer has no control over. For an example of an OS that dealt with overflows that were less catastrophic look at VMS. The languages and OS worked together to use "guard" pages to prevent just such issues. You could "crash" a poorly designed program, but nothing else with a buffer overflow.

Fundatmentally, Unix/Linux and Windows are vulnerable to buffer overflows, but they don't need to be.

Null terminated strings were always a bad idea...

Re:Is it that easy?

[__aagmrb7289]

Or, you know, you could install the patch, and not worry about the workarounds...

Re:Is it that easy?

[lukas84]

Or, you know, you could install the patch, and not worry about the workarounds...

That's much too direct. You have to think about job security when doing IT work.

Next thing you're going to recommend installing service packs and updates in general. ;)

Re:Is it that easy?

[toxygen01]

Yeah, that's why yahoo uses it and why it's second most popular MTA. http://www.qmail.org/top.html

Re:Is it that easy?

[Anonymous Coward]

You have no idea what you're talking about. You can't "handle" a buffer overflow with a try/catch. The very definition of a buffer overflow implies the stack has been corrupted by the bug -- hence traditional exception handling (see SEH on Microsoft platforms) will bomb.

In fact there is a whole nother class of similar security vulnerabilities based on overwriting SEH information on the stack.

Furthermore, your hyperbole about the performance of .NET further exposes your lack of experience and intelligence.

1) Nearly all algorithms will run as quickly ontop of .NET as compiled to native code with C/C++.
2) Large enterprise applications like Exchange are typically IO-bound, *not* CPU bound.

Please go shoot yourself and never post here again.

Re:Is it that easy?

[lukas84]

You don't have to use the Edge Transport if you have an appliance like the Barracudas.

Also, SBS 2008 also connects a hub transport directly to the internet, so for smaller businesses this is actually a recommended configuration.

I run Exchange 2007 Edge + ORF + Forefront for Exchange in the DMZ. It works well enough. And as an MS Partner, it's a lot cheaper than buying a decent antispam/av/etc. appliance.

Re:Is it that easy?

[ozric99]

Yes, many other people have that exact same setup, I know I do. The thing is, unless you configure Postfix to drop any application/ms-tnef it's totally irrelevant to this discussion considering Postfix will simply forward the offending e-mail to Exchange. This isn't about spam, and good luck if you're waiting for your AV to get updated with a fix for the as yet unknown mail.

Besides, what happens when someone combines this with, say, a flash vulnerability and causes a machine inside your network to send the attack e-mail to your Exchange server? Postfix isn't going to do a damn thing about that.

Just patch the fucking server.

Re:Is it that easy?

[__aagmrb7289]

I knew there was a reason! Thank you so much! I'm going to go "secure" my job right now! (thank goodness for uninstall options with MS patches!)

Re:Is it that easy?

[DiegoBravo]

> They can't be "handled" -- they must be eliminated from the source code.

Apparently, there is never enough expertise nor allowed time (specially at Microsoft) for this kind of debugging, so why not use some tools (albeit less optimal) that avoid creating those errors from the start? That's one of the original purpose of these higher level languages (or managed environments if you want.)

Re:Is it that easy?

[Amouth]

i do the same thing with sendmail - and guess what? unless you are sure to strip everything of all possiable TNEF data then if one of the "special" e-mails passes your spam filtering it will go right on to the exchange server where it will be proccessed and you will be screwed.

this isn't someone sending a malformed SMTP message that effects only exchange's SMTP MTA.. this is specialy formatted content inside a perfectly ligit e-mail. no normal or even abnormal spam filter would catch this if it was directed and intentional.

Re:Is it that easy?

[UnknowingFool]

From what I understand the more recent sendmail vulnerabilities involved attacking the server. While it wasn't fully divulged the bug noted:

This requires creating very specific timing conditions using SMTP connection layer commands and delivering specific email payload. Someone with specific network programming skills would be required to create a successful exploit.

My reading of this is that it took a specific email and an active attack at the same time. The Exchange vulnerability only requires specifically crafted messages.

Re:Is it that easy?

[legirons]

Thank goodness my Exchange server is behind a firewall *and* a Postfix SMTP proxy running on a Linux box. There's no direct exposure of Exchange to the outside world.

yeah, thank goodness it doesn't get any emails, otherwise you might be vulnerable...

Re:Is it that easy?

[ConceptJunkie]

Offtopic, but why can't slashdot link to the meat rather than some ad-laden rehash?

I think you answered your own question.

Re:Is it that easy?

[Just Some Guy]

Yeah, that's why yahoo uses it [citation needed] and why it's second most popular MTA [citation needed].

If it supports their specific needs, why not? I'm not going to advocate Notepad just because Yahoo! uses it in some specific situation, though.

Re:Is it that easy?

[Anonymous Coward]

That's, er, kind of the point ...

Re:Is it that easy?

[stevey]

Qmail has had security issues - but DJB just ignores them.

(In practise they're unlikely to bite, but Georgi Guninski has reported multiple real security issues with Qmail which DJB happily ignores.)

Re:Is it that easy?

[stevey]

Indeed there are many companies like mine selling spam filtering which works via SMTP-proxies.

It is a neat architecture that allows you to off-load spam/virus/junk filtering from your mail server and scale horizontally.

Re:Is it that easy?

[stevey]

The downside is that the barracudas often contribute to back-scatter, and are not as thorough as some other solutions.

Still as a "service in a box" they're not bad for the money.

Re:Is it that easy?

[Anonymous Coward]

I don't know anything about Exchange but

... I'm going to comment anyway :)

Re:Is it that easy?

[Vellmont]

Like sendmail has never had critical vulnerabilities in its address parsing code?

I find it extraordinarily funny that Sendmail... probably the most insecure example of a popular open source program, is what you've chosen to compare to Exchange. Years ago there used to be a sendmail vulnerability every week!

Hell, even sendmail is more secure these days. I still won't use it though, mostly because it's a bear to configure and postfix is far better for anything I've used it for.

Re:Is it that easy?

[dltaylor]

In Microsoft's world, buffer overflows are not always errors. They are also part of deliberate back doors. Classic example is the "we'll execute a correctly-formed MP3" in DX9, which was NOT a buffer overflow, and which was patched in a day when discovered (because they knew exactly where to look). There's no reason, other than a back door, to execute data from a stream. It's a very convenient way to get the DoJ keyloggers, for example, installed.

The back doors are designed in, not purely errors, so all the crackers have to do is find them, and that is why no M$ operating system that is not utterly isolated should ever be considered secure.

Re:Is it that easy?

[profplump]

It will only break incoming mail that uses TNEF attachments. It's perfectly possible to send rich-text mail without TNEF.

And since we don't use Outlook as a mail client, I actually filter all incoming messages to extract the actual attachments from those stinking winmail.dat file before the mail is delivered. You could do the same thing at the postfix server so that Exchange never sees TNEF files.

Re:Is it that easy?

[afidel]

It's not the SMTP MTA that's doing the bad thing here, it's the auto-decode of TNEF that's doing it hence why the email has to be viewed to invoke the bug. The interesting thing is that this is done server side instead of client side. I knew TNEF was decoded server side if you had your MTA preferences set correctly and are sending to a foreign (to the system) address (gets rid of the stupid winmail.dat attachments), but had no clue that the same code was invoked when a message was opened. My guess is the decode is done server side to support clients like OWA and POP3 that might not have a TNEF aware message parser.

Re:Is it that easy?

[shutdown -p now]

Apparently, there is never enough expertise nor allowed time (specially at Microsoft) for this kind of debugging, so why not use some tools (albeit less optimal) that avoid creating those errors from the start? That's one of the original purpose of these higher level languages (or managed environments if you want.)

MS dev tools have some things to make it more likely to catch such errors in native code as well - starting with VC2005, the compiler generated "overflow check" code by default, which involves generating a cookie on a stack, and checking its value before returning to ensure that we return to where we came from (and not to where the exploit author wants us to). Of course this isn't anywhere near 100% proof, but it helps.

Re:Is it that easy?

[Anonymous Coward]

Are the mods running out of Troll ratings? This is stupidity in a can.

Re:Is it that easy?

[Anonymous Coward]

The 80's called, they want their comparison back.

Stop spreading FUD

[Fred_A]

It's all closed source, so there aren't any real vulnerabilities. Even the certified professionals say so. They're certified what more do you need !

As if you could spread havoc through email on a proprietary system. Bah.

Re:Stop spreading FUD

[Anonymous Coward]

Closed source is better, at least in Microsoft's case. We DON'T want to know what runs Windows. We DON'T want to know what demonic code is stored in the source files on some secure Microsoft server up in Redmond.

Re:Stop spreading FUD

[Fred_A]

We DON'T want to know what demonic code is stored in the source files on some secure Microsoft server up in Redmond.

Hmmm...

Did you know that if you boot Windows backwards you can hear satanic APIs ?

Re:Stop spreading FUD

[shutdown -p now]

Did you know that if you boot Windows backwards you can hear satanic APIs ?

Careful there. A little-known side effect is that, while you're listening, it actually quietly formats all Linux partitions on your hard drive.

I love the small of hot-fix patches in the morning

[Anonymous Coward]

And I love a parade! Go Microsoft!! I don't see any of you linux lusers getting patches each and every month!!

Re:I love the small of hot-fix patches in the morn

[El Lobo]

Don't worry. Here is the latest Ubuntu patch:

http://software.silicon.com/os/0,39024651,39275144,00.htm

"Ubuntu became the latest Linux vendor to patch a vulnerability in the open-source operating system's kernel that could have left the door open for hackers to find their way into users' machines."

The only "problem" here is that you don't read about this on /. (or any other place, for that matter). False sense of security is the worse security.

Oddly enough...

[smooth wombat]

the IE fix ONLY affects IE 7. If you're running IE 6 (or even 5) on any platform, you don't have a patch to install.

Could it be, *gasp*, that IE 6 is more secure than IE 7? The mind wobbles.*

*For you yungins, go look up Kelly Bundy and the above phrase.

Re:Oddly enough...

[slackoon]

mmmmmmmmmmmmmmmmmmmm.....Kelly Bundy. Rembmber that episode ehere she wore "The Belt"? Oh yeah, we're supposed to be talking about MS Exchange...sorry..sorry, got distracted

Re:Oddly enough...

[sakdoctor]

How about no.
http://secunia.com/advisories/product/11/

22 unpatched vulnerabilities, some of which are critical.

Re:Oddly enough...

[whyareallthenamestak]

*For you yungins, go look up Kelly Bundy and the above phrase.

I just did. The top result is your post!

Re:Oddly enough...

[QuantumRiff]

Kelly Bundy.. hmm, can't remember how I know that name....

Re:Oddly enough...

[TheThiefMaster]

Or it could be that they no longer support IE 5 and 6 and so won't release a patch even if they are affected?

The other possibility is that the bug is in the code responsible for the much better standards compliance in IE7, in which case IE5 and IE6 are only more secure because they don't support the feature, which doesn't really count.

Re:Oddly enough...

[Anonymous Coward]

And the next thing we will hear is that Kelly Bundy has been citing smooth wombat for all these years.

Re:Oddly enough...

[Amazing Quantum Man]

Oh geez, Peg, why can't you remember that? I'm going to the Nudie Bar.

Re:Oddly enough...

[smooth wombat]

That is both hilarious and scary. Thanks!

Re:Oddly enough...

[owlnation]

Could it be, *gasp*, that IE 6 is more secure than IE 7? The mind wobbles.*

Is a bear catholic?

Re:Oddly enough...

[iammani]

Yes, with more patches gone into IE6 than IE7, I would expect IE6 to be more stable.

And remember most of the code for IE7, did not come from IE6, most of it was rewritten.

Use Ninnle instead of patching!

[Anonymous Coward]

With Ninnle Linux, patching is never needed, thanks to the 1024 bit encryption available throughout. So why use Windoze at all?

Re:Use Ninnle instead of patching!

[Anonymous Coward]

That's at least as informative as most of the other comments here...

Re:I love the small of hot-fix patches in the morn

[Anonymous Coward]

OH Heavens! A local vulnerability which could leave to privilege escalation!

The exchange bugs in question were remote hole mr troll.

Re:I love the small of hot-fix patches in the morn

[Anonymous Coward]

Oh! hey! Someone got mad :P

Why can't Microsoft ever get this right?

[msblack]

Why in the world would an e-mail delivery system ever consider executing external code? Exchange should simply look at the delivery address. If it is a local address, place the message in the user's mailbox. If an external address, forward to the next hop. What's so difficult with that task?

CommuniGate Pro has never had this problem. IronPort appliances don't have this problem. Exchange should stick to its sole job as a delivery agent and stop trying to be so smart.

Can't we live without OLE?

Re:Why can't Microsoft ever get this right?

[Anonymous Coward]

Why in the world would an e-mail delivery system ever consider executing external code?

Exploits such as the ones mentioned aren't because the system is executing external code intentionally, rather, a carefully crafted message will overflow a buffer and change the values of some CPU registers. If the values change in such a way that a pointer moves execution to a part of the carefully crafted message, that message is now external code that is being run.

Re:Why can't Microsoft ever get this right?

[lukas84]

Exchange is a Groupware Server, not just an MTA.

Re:Why can't Microsoft ever get this right?

[operagost]

Why in the world would an e-mail delivery system ever consider executing external code?

It's not intentional.

Re:Why can't Microsoft ever get this right?

[quickOnTheUptake]

I read the article a while ago, but I think it had to do with previewing or viewing the message. Not just delivering it.

Re:Why can't Microsoft ever get this right?

[Anonymous Coward]

If you actually understood the vulnerability, you would know it is just another typical buffer overflow. It has nothing to do with "external code", "delivery addresses", OLE, etc. This vulnerability exists far below any of those layers. It's actually pretty slick in that all it requires is sending a specially crafted email to the server, but this is how a lot of buffer overflow exploits work (sending a specially crafted object to a service). For God's sake, when will people learn to validate external input and internal buffer lengths?

Re:Why can't Microsoft ever get this right?

[ACMENEWSLLC]

Exchange needs to be so smart so that it can open up the TNEF document and scan it for content which would route it depending on a user rule, an Antivirus scan need, or a content filter the admin may have.

And yes, CommunicateGate PRO has had it's share of serious problems just like almost any software;
http://secunia.com/advisories/search/?search=CommuniGate

One of these allows file access as root.

Re:Why can't Microsoft ever get this right?

[Just Some Guy]

Exploits such as the ones mentioned aren't because the system is executing external code intentionally, rather, a carefully crafted message will overflow a buffer and change the values of some CPU registers.

But that overflow would be impossible if Exchange wasn't trying to act on the contents of messages flowing through it. For instance, it's impossible to make Postfix choke on an attachment since it doesn't try to process them (with the minor exception of filtering on the headers of encapsulated emails if you specifically enable that functionality).

Re:Why can't Microsoft ever get this right?

[legirons]

Why in the world would an e-mail delivery system ever consider executing external code?

Ignoring for a moment that's probably not what happened, remember this is from the same company which wrote Internet Explorer and Outlook (Express), both of which go to some lengths to search for untrustworthy code to run. If they can't find any malware in the web page or email, they'll go looking in CSS files, XSLT files, images, stylesheets of images...

Re:Why can't Microsoft ever get this right?

[msblack]

They need to isolate those functions away from the MTA agent. MTA should do MTA and punt the rest to a wholly separate program that has to re-establish trust and re-validate the input data.

Re:Why can't Microsoft ever get this right?

[Anonymous Coward]

For instance, it's impossible to make Postfix choke on an attachment since it doesn't try to process them

That's wrong. Postfix may be invulnerable, who knows, but it does indeed "process them" as soon as it reads them, stores them and forwards them. All those actions gives opportunity for a buffer overflow or other programming error, and it "processes" the entire contents of the message.

Re:Why can't Microsoft ever get this right?

[pmarini]

Let me be the first to laugh at this one...

the only built-in groupware feature that I've seen people using in Exchange (without shelling out xBox credits for half a dozen other additional applications like SharePoint, SQL Server, BizTalk, InfoPath, etc) is the one allowing to click on predefined Yes, No, Maybe buttons to reply to a message...

Re:Why can't Microsoft ever get this right?

[Just Some Guy]

but it does indeed "process them" as soon as it reads them

Nope. It treats them as a block of data to be moved about and makes no attempt to interpret the data beyond what's necessary for mail delivery. Exchange is getting nailed by examining TNEF attachments. Postfix (or Sendmail or qmail) couldn't care less what, if any, attachments are embedded in an email.

A valid analogy to Exchange would be if ClamAV fell to a buffer overflow while trying to scan attachments.

Re:Why can't Microsoft ever get this right?

[kybred]

A valid analogy to Exchange would be if ClamAV fell to a buffer overflow while trying to scan attachments.

You mean like this?

Its really time to spread the word:

[mlwmohawk]

To all you Windows users, we feel your pain. Seriously, you don't even know how bad you have it. What's worse, you have been sucked into a mind set that, on one hand, you hate your computer because of all the problems you have with it, but think you *need* windows because of all the programs you feel you can't live without.

You don't need Microsoft Office, you can go to http://www.openoffice.org/ and download a fully functional office suite that, in many ways, is better than Microsoft Office. What's even better, is that it runs on system other than Windows!

Linux is a system, more similar to the macintosh than it is to Windows, and it will run on your PC. It replaces Windows completely. Not only that, out of the box, it is slick, beautiful, and easy to use, and if you like to tinker, there is absolutely no limit to what you can change.

Best of all its free! That's right, free!

Go to http://www.ubuntu.com/ and look around. (There are other vendors for Linux too, so you are not stuck with only one.)

I know, you ask "How can it be free?" Well, you know how your friends who know about cars will sometimes fix your car as a favor? That's because they enjoy working on cars. Well, with the internet, millions of guys who know about computers started working on a system in the '80s that was eventually called Linux. The software comes from places like IBM, Sun, U.C. Berkeley, MIT, HP, and a whole list of other companies and organizations. It is a collaborative system that is put together, not to make money for Microsoft, but to make computers more usable for everyone. In fact, a lot of the web sites you visit every day run Linux.

So, if you are fed up with your computer and Windows, now is a great time to start a new adventure. Try something new, learn something new! It won't be hard, but not too easy either, as a lot of things are different than what you are used to, but once you get the hang of it, you'll realize that sometimes "different" is the only to get "better."

Re:Its really time to spread the word:

[Anonymous Coward]

when i can play every game i've purchased in the last 15 years out of the box NATIVELY without having to run it in wine, cedega, crossover or whatever the fuck the new "emulator" is these days, then i'll consider switching to linux. but until then, kindly shut the fuck up. your OS is not for everyone. especially gamers. not everyone gets a chub from compiling the newest unstable snapshot of your OS' kernel. :)

Re:Its really time to spread the word:

[techamed]

Hang on I'll send an email

Re:Its really time to spread the word:

[lukas84]

You realise that the topic is about Exchange.

None of the products mentioned provide the functionality Exchange has.

Re:Its really time to spread the word:

[Volante3192]

One minor quibble, though: there is still no full fledged open source replacement for the entire Exchange+Outlook functionality suite.

Crackberries and other PDAs sync with Exchange and Outlook. BES requires Exchange. You can make public and personal calendars shared across the company.

There just aren't open source equivalents yet for all the bells and whistles these sales guys and CxOs have come to rely on and until you do, Exchange will not get replaced.

Re:Its really time to spread the word:

[Anonymous Coward]

My time is valuable. I don't have all night to sit up recompiling to get the thing to work. Oh, and don't forget the legions of friendly, helpful Linux users who will be glad to listen to my problems and recommend a solution.

Re:Its really time to spread the word:

[lukas84]

BES supports all three major groupware suites:

http://na.blackberry.com/eng/services/server/

Re:Its really time to spread the word:

[mlwmohawk]

My time is valuable.

So is everybody else's.

I don't have all night to sit up recompiling to get the thing to work.

FUD alert FUD alert FUD alert.

Oh, and don't forget the legions of friendly, helpful Linux users who will be glad to listen to my problems and recommend a solution.

There are legions of helpful companies who will charge you money to support you and it will still cost less than Window$

Re:Its really time to spread the word:

[operagost]

As others posted, there is no open source application that has the features of Exchange.

Well, with the internet, millions of guys who know about computers started working on a system in the '80s that was eventually called Linux.

No, it was called Linux very early on, somewhere around 0.9, by one person, in 1991 (not the 80s); and the number of developers involved is still quite short of "millions of guys".

Re:Its really time to spread the word:

[mlwmohawk]

You realise that the topic is about Exchange.

None of the products mentioned provide the functionality Exchange has.

The topic is about patches to Windows and its services, and this indirectly about the piss poor reliability and quality of Windows.

Re:Its really time to spread the word:

[CannonballHead]

OO.org is pretty cool. Some parts of it are definitely NOT as good, definitely ont better, than MS Office. MS Office is actually, in my opinion, a pretty good product. Impress vs. PPT, PPT wins hands down. Writer vs. Word ... well, writer is actually pretty good, though Word 2007 has some default nice-looking document stuff going for it. Me personally? I use OO.org. But I can definitely see how it isn't for everyone.

Slick, beautiful, and easy to use. Let's see, I just installed openSuSE 11.1 on a Dell E1505. It works pretty well (had 10.3 before that, by the way). First problem: knetworkmanager and WEP: fail. It wouldn't put in the write key; had to use iwconfig to manually configure it. Has never worked for me. Windows could do WEP fine. (note: I use WEP just to keep my neighbors off. I know it's easily cracked, I've cracked WEP myself). Second problem: ATI Mobility x1400 drivers. Downloaded ATI installer; fail. Tried various things. Finally installed RPM, that worked. I think what happened was the kernel source wasn't installed, thus the ATI installer didn't compile the driver, etc. But all I got was a black screen. Oh, you want users to dig through logs in random directories? Easy to use... Windows drivers worked fine.

Third problem: can't turn off the annoying PC speaker. I could with Windows. Fourth problem: Suspend to Disk doesn't work with Compiz/XGL, it comes back up with a black screen and a mouse cursor. Have to kill X and start it again. It worked fine with Xorg but not with XGL. Unfortunate, too, since I kinda like suspending and have to do it to disk because the battery is completely dead. Windows worked fine.

It's working now, and I like it. I've always liked Linux. Interestingly, though, my wife said this (she is not a tech person): "I don't think I like Linux... it doesn't do what you expect it to." She can use it, when it's working. When it stops working, she has no clue what to do. When X doesn't boot up for whatever reason, she doesn't know the "startx" command. If that doesn't work, she doesn't know about the kernel bootoption "x11failsafe." Easy to use!

I haven't tried Ubuntu specifically on my laptop, so I can't comment on its compatibility.

All this to say: switching completely from Windows to Linux is NOT for the person who doesn't have time to fiddle with stuff (i.e., spends maybe an hour a day on their computer) and doesn't have someone that can do it for them/fix it for them. Me? I can use Linux, and my wife can, because I can fix it. My parents? Same thing. I can set it up and fix it. Other people may not be able to.

(*waits for mod -5 Doesn't support Linux in all situations. :) )

Last final note: I work with Linux all day at work, and I've used quite a few versions (including Puppy Linux, tinyMe, Mandrake, SuSE, RedHat, Ubuntu, Fedora, Knoppix, Slackware, and a few others that I tried out on some old hardware to see which ran best). I really like it. I have also used Windows 3.1, 95, 98, 2000, XP, XP x64, 2003, 2003 x64, 2008, 2008 x64, Vista, Vista x64, and 7 x64.

Lastly, Wine does not work for all applications, virtualization is not "easy" to use, and I have a few other gripes about the easy to use camp but this is long enough :) hehe.

I sound bitter. Oh well, I'm not. I'm happily using Linux+KDE4.2+XGL+Amarok as my cool little media center!

Re:Its really time to spread the word:

[mlwmohawk]

when i can play every game i've purchased in the last 15 years out of the box NATIVELY without having to run it in wine, cedega, crossover or whatever the fuck the new "emulator" is these days, then i'll consider switching to linux.

When you can do that in Vista or Windows 7, let us know. Most programs written in 1994 won't even run correctly on Vista or XP. A lot of programs written prior to 2002 for DOS Windows (95,98,98SE,ME) have difficulty on the NT kernel line.

Re:Its really time to spread the word:

[CannonballHead]

Hehe, after posting a negative response to your original post ... I have to say that not only are there helpful companies who will charge less than supporting Windows, but there ARE quite a few helpful Linux users. It seems to vary by distro.

Re:Its really time to spread the word:

[mlwmohawk]

No, it was called Linux very early on, somewhere around 0.9, by one person, in 1991 (not the 80s); and the number of developers involved is still quite short of "millions of guys".

What is now Linux started, possible as early as the lat 60s, but definitely by 1984 in the form of GNU. The Linux kernel didn't come on the scene until 1991.

Re:Its really time to spread the word:

[mlwmohawk]

OO.org is pretty cool. Some parts of it are definitely NOT as good, definitely ont better, than MS Office.

This is a subjective evaluation and very open do debate. Since the two products are not from an "identical" specification, it is impossible to evaluate how one is better than another based on a side by side comparison. We have to weight the features of one against another, factor in quality, and weight the feature sets. MS Office does have more features, but by and large, not features the 99% of the users will ever care about.

For me, the built in "Export to PDF" is a huge feature.

Re:Its really time to spread the word:

[SatanicPuppy]

Posting this sort of bullshit on Slashdot just comes off as being unbearably smug and condescending. Go take it to a windows forum or Expert Sexchange or wherever. Everyone here knows about Linux.

On top of that, like a lot of smug amateurs, you don't have any knowledge whereof you speak. Lack of Exchange is a deal breaker for a huge chunk of the business world.

Until there is a real Exchange/Outlook replacement that is available open source, people are never going to drop it, because, for them, the functionality outweighs the cost. Whining about viruses and crap is meaningless to them because they've been conditioned to expect viruses, and because the maintenance costs (and the blame for failures) are borne by the IT staff. Not management. Not users. Not microsoft.

Re:Its really time to spread the word:

[lukas84]

I'd prefer to have a non-optimal tool to fulfill a job than no tool at all.

But for those that see open source as a religion instead of a means to an end, they'll prefer to have no tool and just the moral high horse.

Re:Its really time to spread the word:

[SatanicPuppy]

You can debate it all you like, but the simple fact that the free product has practically no marketshare compared to the product that costs 500 bucks a license is pretty fucking telling.

Firefox proves decisively that the superiour product will make strong gains even against an entrenched monopoly. That OO.org is still languishing in obscurity has more to do with it's flaws than some gigantic conspiracy of users who just can't think of anything better to do with their money.

Re:Its really time to spread the word:

[ByOhTek]

You know what the difference between Wine and the layer in Windows that lets you use 9x applications is?

Most people who use Wine know it exists and what it does.

Aside from that, you can throw out any game made before 2000 or 2002 as it is not run natively on Windows 2000/XP/Vista/7 either.

Re:Its really time to spread the word:

[CannonballHead]

Export to PDF *is* a pretty good feature. Huge? Not so much. It's easy enough to print to PDF, do a postscript printer to file output and convert it to PDF, etc.

99% of the users will never care about most MS Office features? What was that about subjective evaluation? :)

What really has to be weighted is user usability/user usage efficiency, right? what is important in an "office productivity suite" is how productive a user can be with it. My own experience (no, I haven't done a double blind study of "never used productivity suite before" people or something, hehe) is that Office 2007 (and Office 2003 before that... I think it was 2003...) was easier to use and easier to create nice-looking documents right off the bat. It was also much more expensive. I found OO.org good for word documents and spreadsheets. I found Powerpoint far superior with presentations (and, ironically, faster and less jerky with far fewer quirks ... I am not at all impressed [pun not intended] with Impress).

Re:Its really time to spread the word:

[Anonymous Coward]

Out of the 5 pre-2000 games I have cared to load up on my Vista x64 box, 4 have run natively w/ very minimal tweaking.

Re:Its really time to spread the word:

[nomadic]

You know what the difference between Wine and the layer in Windows that lets you use 9x applications is?

The Windows layer actually WORKS? Wine doesn't work well. It has never worked well. There are millions of people who will tell you that it works well. They are liars.

Re:Its really time to spread the word:

[Volante3192]

Gah, I edited out part of my post... I originally had "(or those...other two)" in there.

What I was aiming for was that it'd take more than sendmail to get blackberry users happy.

Re:Its really time to spread the word:

[mlwmohawk]

But for those that see open source as a religion instead of a means to an end, they'll prefer to have no tool and just the moral high horse

It is easy to paint someone's position as "extreme" in order to make yours more reasonable. It is a isotope of ad-hominem.

The opposite is true, of course. We open source/free software people are very practical by nature. We see and understand that "better" software isn't just an arbitrary and subjective feature set comparison. It is quality. Flexibility. Durability.

Having used Microsoft office, WordPerfect, WordStar, Quatro, 123, Hollywood, Applix, OpenOffice.org, and so many others, I can honestly say that OpenOffice.org is a better over all system for anyone who cares about their content.

Re:Its really time to spread the word:

[ByOhTek]

Actually, they aren't running natively. They are running in an API translation layer similar (but more compatible) to Wine. That layer just happens to come pre-installed in your OS.

I'll grant you it's more refined and works better, but it is still there.

as I said above:
Most people who use Wine know it exists and what it does.

Re:Its really time to spread the word:

[lukas84]

If you run a Groupware server, you're not running it for yourself. You're running it for the users.

It doesn't matter if you think that Evolution or whatever beats Outlook/Exchange, it matters if everyone else in your company does the same. If they do, good for you.

Re:Its really time to spread the word:

[Rockoon]

And ffter using it, they quickly learn what it doesnt do...

...which is run most windows applications

Re:Its really time to spread the word:

[ByOhTek]

Most, applications have issues, but mainline apps tend to work rather well. Lame as it seems to say so, the compatibility has skyrocketed in the last 6 months. 6 Months ago, I'd have agreed with you. There weren't many applications that worked well. Now, between what does work well, and what is freely available, Linux and FreeBSD offer access to pretty much whatever you need from Windows.

Re:Its really time to spread the word:

[mcrbids]

That OO.org is still languishing in obscurity has more to do with it's flaws than some gigantic conspiracy of users who just can't think of anything better to do with their money.

What rock have YOU been under?

Gross market share moves slowly. Great change takes years or decades, and if you see change where the majority product becomes a minority in 10 years, that's very rapid change. There's every sign that this is, in fact, happening. It's by no means comprehensive, but it's pretty clear that OO.o is making some pretty serious headway. Whole nations are standardizing on Open Office!

And on a related note, OO's document format, ODF, is now a recognized international standard, is a mandatory standard for NATO, and is also being adopted by governments around the world.

It may not be all that visible where YOU sit, but the impact is both real and international in scope.

Re:Its really time to spread the word:

[ozric99]

I guess it's changed a lot then. The last time I tried to use Wine I was able to bring up the Internet Options control panel and... that's about it. After hours of pouring through how-tos and mailing lists I gave up. That was about a year ago.

Re:Its really time to spread the word:

[ByOhTek]

IE is tricky, but most MS apps that are tied to the core of the OS and undocumented APIs are.

Surprisingly, MS Word and Excel work pretty well. There are a few games, but to my knowledge, nothing particularly new.

Re:Its really time to spread the word:

[SatanicPuppy]

I first used OO.org in 2002, which is before Firefox even existed as anything other than Mozilla bloatware. Since then OOO has managed to pull what, single digit marketshare? And since then Firefox has topped 20%!

Open Office has HAD a fricking decade. To have to have a government mandate to drive adoption for a FREE product? You think that's a good thing?

Every new release of OO I load it up, play with it, then never use it again. It's not that I love MS Office, it's that there are other OSS products that do a better job.

Re:Its really time to spread the word:

[Anonymous Coward]

Sorry forgot the quotes on native... Everything runs through APIs.

If you want to get overly semantically anal, 4 of the 5 pre-2000 games I've loaded in Vista run w/o resorting to compatibility mode, not to mention a good deal better than in Wine under Ubuntu.

Re:Its really time to spread the word:

[WuphonsReach]

You can try being an apologist for OO.org all you want. Unfortunately, there are still some large glaring holes in their product (even as of v3).

The latest one that I've run into is the Base component. Which doesn't offer any simple way to import/export data from CSV, XLS, tab-delimited or other external data files. For some of those data file types, you have to go through the spreadsheet component of OO.org, which is extremely convoluted. The equivalent in MS-Access is pretty much "File, Import" or "File, Export" (depending on the version of MS-Access).

Or say that I want to link to some MDB file. I have to create a registered data connection in order to do so. So for each MDB that I work with, I'm going to have to create at least one registered connection. Which is going to be damn ugly about the time that I start working with my 500th MDB file. On the MS-Access side, they've chosen to simply make that file-specific and if you need a global, permanent, registered type connection, you create a user/system DSN.

Now, that's not to say that OO.Base isn't getting better. But there are still some really really sucky UI choices that simply make getting work done harder then it has to be.

Re:Its really time to spread the word:

[Vancorps]

I don't know how you can write that and be serious. OpenOffice is not a very well developed product, is not very flexible, and durability is in question because a lot of people end up throwing it out.

I'll give you a classic example which actually happened to me recently when I had way too many windows open on my Ubuntu setup. I opened my document with Openoffice, made some changes, hit save. Then went about doing other tasks. At that point I had probably 30 windows open so I couldn't see that I had left the document open so I just opened it again and started documenting more about our network. It was really more of a spreadsheet if I recall. Long story short, I hit save on the new document, at some point ended up editting the original that was still open and lost all the work in the second window.

MS Office would have opened it in read-only mode telling you the file was already in use which would have given the user a clue of what happened. Autosave is also a feature that is not on by default for some reason. Then of course there is the whole close button matter how it won't warn you about the document not being saved. It will just go ahead and close anyway leaving you none the wiser.

It has basic functionality that one would expect from an office suite but OpenOffice has a long way to go before it's going to be a true replacement for a great many people. I haven't seen that many content management systems integration nor have I seen change tracking which are all features users expect from MS Office and use rather regularly.

Of course in my environment I go one further with spreadsheets that are dynamically driven by our database which is still functionality lacking in OpenOffice. Combine all that with the fact that it loads slow as all get out and I clearly have a low opinion of OO.org

That said, now that I've learned a few gotchas I can work just fine in OO but the user seems to have to learn everything the hard way and that doesn't strike me as either a quality or flexible application.

Other than that I agree with your general principle that better is very subjective as one person my care so much about the cost of MS Office that OO.org being free and able to do the basic stuff suits them just fine, in that case then the product is indeed better for them than MS Office would have been.

Re:Its really time to spread the word:

[NoOneInParticular]

Network effects. If I need to communicate with my customers, using MS Office is a safe bet. Even if it doesn't work, you can always complain about Microsoft screwing up. Try to communicate using OO.org, and every single communication needs to be absolutely perfect for it to be acceptable. If OO screws up, you're unprofessional. If MS Office screws up, it's MS Office, and everybody knows that there are glitches.

Now compare with Firefox. Although Microsoft has tried to make the internet an IE only thing, they have failed due to the security implications of their chosen vehicle, Active X. Now Active X is dead, and the internet is open for any browser to compete. If I choose to use Firefox to browse the web, there's no customer whose business I might loose. Although there was an attempt from Microsoft to extinguish the web, the offer was less compelling than for office, so they lost.

So, yes, there is a gigantic conspiracy of users who just can't think of anything better to do with their money. It's called a Network Effect. OO has a hard uphill battle against this. You could easily put billions into creating the best office suite that has ever materialized, and still you would fail against MS office, as no individual can move out of using it without losing something.

Re:Its really time to spread the word:

[mlwmohawk]

I don't know how you can write that and be serious. OpenOffice is not a very well developed product, is not very flexible, and durability is in question because a lot of people end up throwing it out.

Without any actual facts to back that up, I don't believe you because my experience is entirely different.

Another feature I really like about OOo is the ODF format. It is documented and I will always be able to use my documents.

Re:Its really time to spread the word:

[shutdown -p now]

It's by no means comprehensive, but it's pretty clear that OO.o is making some pretty serious headway. Whole nations are standardizing on Open Office!

So, 2009 will finally be the year of OO.org on the desktop? *yawn*

And on a related note, OO's document format, ODF, is now a recognized international standard, is a mandatory standard for NATO, and is also being adopted by governments around the world.

That's really good, but I doubt it'll help OO.org much, once MSOffice 2007 SP2 is released with ODF support.

Re:Its really time to spread the word:

[mcrbids]

Every new release of OO I load it up, play with it, then never use it again. It's not that I love MS Office, it's that there are other OSS products that do a better job.

Other OSS products, such as... ?

Didn't think so.

Re:Its really time to spread the word:

[SatanicPuppy]

Abiword is better than writer; Gnumeric is better than calc. Both of them are light and responsive, and if they lack features, it's only in comparison to Office, not Open Office.

End of story. Thanks for shopping.

It's all clear now!

[Anonymous Coward]

Now I know why Microsoft calls it "Exchange"!

Re:I love the small of hot-fix patches in the morn

[Ash Vince]

There is a difference between the hole you posted and the one that is being discussed though, a very big difference.
The security hole in the Kernel that Ubuntu fixed required local access to the machine in question, the exchange bug could be exploited by sending the server an email so not access what so ever was required.

Privilege escalation vulnerabilities are generally considered to be of a lower priority to fix and not as severe as you must have modicum of trust in order to give someone a shell account. No trust is required to send someone an email.

Dear Slashdot,

[mbstone]

I don't use Outlook but it's on my box, do I have to patch it?

Re:Dear Slashdot,

[amclay]

No.

Re:I love the small of hot-fix patches in the morn

[ByOhTek]

Of course not, they get them on a daily bases, per app.

I wouldn't surprise me if the sum development time on the core system and apps of any given Linux install was greater than that of any given MS install, for any given duration.

incase anyone is wondering...

[Anonymous Coward]

the exchange fix is part of exchange rollup 6 which showed up in wsus yesterday:
http://support.microsoft.com/kb/942846

specifics about the vulnerability:
http://www.microsoft.com/technet/security/bulletin/MS09-003.mspx

Bandwagon

[Demonantis]

Microsoft has gotten a large amount of heat for its operating system. In large part due to the number of well crafted viruses that exploit weaknesses in the programming. Apple was long toted to be virus free. That was only due to the obscurity of the system and people's willingness to write viruses for it. I don't think we should bash the quality of Mircosoft's code because anyones code can be full of holes when people work at breaking it. I think Microsoft's issue is updating. Update when the exploit is found not the second Tuesday of the month after the exploit has been abused for a while.

Re:Bandwagon

[rawr_one]

You're not looking at the actual history of Microsoft Windows, though. Windows was (and still is, to a large part) built off what was originally a single-user system that would exist ENTIRELY as a standalone unit that was never connected to any other computers. UNIX, on the other hand, started with that kind of functionality in mind. So, while UNIX has been building off of that original multi-system support, Microsoft had to build up theirs (this becomes especially important with netcode) on top of a system that wasn't made to work like that. To put it simply, Microsoft started with a shoe and tried to make a hat.

Re:Bandwagon

[drsmithy]

You're not looking at the actual history of Microsoft Windows, though. Windows was (and still is, to a large part) built off what was originally a single-user system that would exist ENTIRELY as a standalone unit that was never connected to any other computers.

No, it's not. Windows NT was designed from the start to be a multiuser, networked OS.

UNIX, on the other hand, started with that kind of functionality in mind.

Actually, no. The very first versions of UNIX were single user. The multiuser stuff was added later, which is probably why it still had (and still has, in most configurations today) the concept of a superuser, even when other OSes had moved on.

Re:Bandwagon

[dedazo]

Windows was (and still is, to a large part) built off what was originally a single-user system that would exist ENTIRELY as a standalone unit that was never connected to any other computers

True for Win9x (and their predecessors). Not so for NT.

Re:Bandwagon

[DarkOx]

I still think their should be a super user. It should be the only shared account, and only shared between a small group of people in the org that are both willing and by need trust each other entirely anyway.

The other options generally don't make sense because:
* You never can have total separation of powers someone always has to have the ability to get access to someone else fife should something happen to that person. Continued..

*If multiple accounts exist that can grant themselves new privileges at will they might just as well have had that access in the first place.

*Multiple super user accounts are worthless. Nobody should be using the account except when the are, that is to say admins should not be reading e-mail from the privileged account for example.

*Multiple super users does not provide a better audit trail because that user is privileged enough to alter the audits anyway. At the top of the tree trust has to be implicit.

*Multiple super accounts could pose a risk of making it unclear who can actually get into what. Old accounts might go unnoticed. Better to have one account where the password changes often and *anytime* *anything* happens those people also get together and change the password.

Re:Bandwagon

[Mr. Firewall]

I don't think we should bash the quality of Mircosoft's code because anyones code can be full of holes when people work at breaking it.

Yeah, I guess that's why OpenBSD is so full of holes...

Apple was long toted [sic] to be virus free. That was only due to the obscurity of the system and people's willingness to write viruses for it.

No, it's due to the design. This notion that all OSen are equally vulnerable and 'Doze only gets attacked because it's the most popular -- is total M$-funded BullFUD and needs to die.

If that FUD were true, we'd be seeing many more compromised Apache servers than IIS -- and even more compromised Sendmail servers than Exchange.

But we're not. And this is because the simple truth is that 'Doze gets attacked the most BECAUSE IT IS THE WEAKEST! Hello????

Re:Bandwagon

[lukas84]

*Multiple super users does not provide a better audit trail because that user is privileged enough to alter the audits anyway. At the top of the tree trust has to be implicit.

I disagree. In a criminal case, you're right.

But if we're talking about common, everyday mistake where you just want to know how fucked something up, this is good enough.

Re:Bandwagon

[Anonymous Coward]

No, that was based on VMS...

Re:Bandwagon

[Blakey Rat]

Windows was (and still is, to a large part) built off what was originally a single-user system that would exist ENTIRELY as a standalone unit that was never connected to any other computers.

Wrong; current Windows versions (2000+) are based off of the Windows NT code, which was designed from the very beginning to exist on networks and with multi-user support.

UNIX, on the other hand, started with that kind of functionality in mind.

So did Windows 2000, Windows XP, Vista and Windows 7.

To put it simply, Microsoft started with a shoe and tried to make a hat.

And you started with ignorance and tried to turn it into bullshit. Kudos.

Re:Bandwagon

[Spit]

You set root to a strong password, seal it in an envelope and put it in the safe. Then limit root access to sudo, make sudo.log append only using the various methods available to your particular flavour.

Re:Bandwagon

[Anonymous Coward]

To put it simply: You're an idiot and are mind-numbingly ignorant as well. Please don't post here anymore.

Re:Bandwagon

[pommiekiwifruit]

UNIX, on the other hand, started with that kind of functionality in mind...original multi-system support...

Um, the "Uni" part of the name says not originally multi-user, well until 1970 anyway. :-)

Re:Bandwagon

[lukas84]

So basically you workarounded the fact that there's only a single super user by using a broker program.

Thanks for proving my point.

Re:Bandwagon

[drsmithy]

I still think their should be a super user. It should be the only shared account, and only shared between a small group of people in the org that are both willing and by need trust each other entirely anyway.

Shared accounts are a bad idea all round. They're essentially unauditable, which has negative repercussions for everything from security to configuration control.

Throw in 'has unlimited and uncontrollable access to the entire system' on top of that, and it's a recipe for trouble.

You never can have total separation of powers someone always has to have the ability to get access to someone else fife should something happen to that person. Continued..

Being able to take over the privilege levels of another person in emergencies in a controlled and auditable fashion is _NOT_ the same thing as being able to inherently do anything and everything they can do.

If multiple accounts exist that can grant themselves new privileges at will they might just as well have had that access in the first place.

No, they mightn't. See above.

Multiple super user accounts are worthless. Nobody should be using the account except when the are, that is to say admins should not be reading e-mail from the privileged account for example.
[...]

You are hooked up on the idea that there must be a superuser of some sort, which is missing the point - superuser accounts shouldn't exist *AT ALL*. Individual privileges to access restricted resources should be granted as required.

A single user account that, for all intents and purposes, completely bypasses all aspects of access control as if they didn't even exist, is an inherent security flaw that should not exist.

MS Proprietary Protocols have a history of flaws

[compusci]

I am not surprised by the announcement of these major flaws, many directly related to MS proprietary components/protocols. Microsoft has a history of manipulating open standards into MS proprietary protocols in order to prevent development outside Windows. However, as a result, Windows OS's become less compatible with other OS's and do not reap the benefit of improvements to open source alternatives made in the open source and standard organization communities. Several examples of flawed Windows proprietary technologies: WMI (no longer supported in newest Windows Servers), Direct X (unstable and high overhead compared with OpenGL), UAC (worst Vista feature) and Windows Automatic Updates (incremental updates with multiple reboots to update, memory leaks and high resource consumption under idle conditions).

Re:I love the small of hot-fix patches in the morn

[GooberToo]

The verbiage there is mind numbingly stupid. I quote, "Ubuntu became the latest Linux vendor to patch a vulnerability in the open-source operating system's kernel". In other words, a kernel fix was made available and it was applied. They make it sound like it has far reach consequences and by have multiple distros, the problem is somehow made far, far worse.

Huge difference between local and remote exploits. The fact you seem to not understand the difference squarely places you into your own worst scenario, "False sense of security is the worse security."

Since I'm the only user on my box I don't think I have to worry about me exploiting my self and doing unknown harm.

So....

[Trashman]

....What "carefully crafted message" would I need to send to take over an Exchange Server?

To: ExchangeServer@company.com
Subject: H3ll0

I 0wn you Now. Please reply back with passwords.

Regards,
Hax0r

Re:So....

[QuantumRiff]

My buddy figured out how to craft the message. He emailed me the message this morning at work. Hmm, maybe that's why its such a quiet day.

Re:So....

[legirons]

....What "carefully crafted message" would I need to send to take over an Exchange Server?

To: ExchangeServer@company.com
Subject: H3ll0

I 0wn you Now. Please reply back with passwords.

Regards,
Hax0r

To: ExchangeServer@company.com
Subject: H3ll0

sudo reply back with passwords, plz

Re:MS Proprietary Protocols have a history of flaw

[Anonymous Coward]

Well, this little Slashbot has certainly been studying his talking points. I'm sorry to inform you, but this flaw is not in the underlying protocol; it is in the implementation.

As for your other allegations...

WMI is not only supported in Windows Server 2008, but additional providers have been added. This is the most ridiculous of your claims as it has absolutely no basis in reality whatsoever.

I don't know enough about DirectX to comment on your assertion, but I suspect you are probably equally delusional.

UAC is just a band-aid; it is better than nothing, but it doesn't fix the underlying problems.

I do agree that rebooting for Automatic Updates is a pain. However, I've never even heard of anyone complaining about memory or resource usage or leaks while using it.

Oblig. Quote

[Anonymous Coward]

That's nothing! If you boot Windows forwards, it loads Windows!

Re:Oblig. Quote

[Fred_A]

That's nothing! If you boot Windows forwards, it loads Windows!

Woah, now that is scary !

Re:MS Proprietary Protocols have a history of flaw

[tignet]

Let me start with saying that I'm no fan of MS. I'm Open Source friendly -- I have several projects on SourceForge, and have contributed effort to several additional projects. But what you've stated is FUD.

• WMI is supported on the newest Windows Servers, including Windows 2008.
• DirectX is stable (although the same can not be said for all video drivers) and is a fantastic API for games, with excellent documentation and examples available. Quite the opposite for OpenGL.
• UAC being the worst Vista feature is not only subjective, it offers no support for your argument.
• Automatic Updates may not be perfect, but it's not uncommon for an OS to require multiple updates (and reboots) to complete the patch cycle -- like Solaris 10 without LiveUpdate.

So having addressed the FUD, look at your main point. "Windows OS's become less compatible with other OS's and do not reap the benefit..." Windows has never tried to be compatible with other OS. When it comes to Windows compatability I would go so far as to say they've done a damn good job (possibly *too* good) considering the mess with which they're keeping backward compatibility and the crud that keeps getting carried forward.

Microsoft may have many faults, but you seem to have missed the mark.

We installed it ...

[humph2]

... and Exchange 2003 stopped delivering messages to mailboxes.

Rolled it back, and everything worked fine ^H^H^H^H just as it used to.

I may be missing the point of these "fixes", but surely "security updates" should actually be tested at some stage?

Re:We installed it ...

[lukas84]

Yes, they should. Namely by you. In your testing environment. Before deploying it to production.

Re:We installed it ...

[Anonymous Coward]

"testing environment"? What's that? Sounds like one of those things that adequately-funded IT departments get.

Re:We installed it ...

[segedunum]

I think what the parent is describing isn't going to be solved by a test environment.

Re:We installed it ...

[Culture20]

"testing environment"? What's that? Sounds like one of those things that adequately-funded IT departments get.

"Adequately-funded IT department"? What's that? Sounds like one of those things that only IT-oriented companies might have.

Re:We installed it ...

[Anonymous Coward]

"Yes, they should. Namely by you. In your testing environment. Before deploying it to production."

Then why am I paying Microsoft for it?

Re:We installed it ...

[lukas84]

You're not. But i'm sure you can hire some Microsoft consultants to your test environment for you.

Re:MS Proprietary Protocols have a history of flaw

[compusci]

You're wrong about WMI - no longer supported in Exchange - EWS used instead. While it still exists, it is continuing to be replaced by other Microsoft protocols for Microsoft Server products, like Exchange and MS SQL Direct X - requires more hardware than OpenGL to run and many third-party developers will report problems programming under this API - XBOX issues have occurred as a result of Direct X instablities Also, you clearly know little about OpenGL if you think it is less stable and performs poorer than Direct X. UAC - seriously, what use is this - can I really be more secureusing an annoying pop-up notifier? I think not. Automatic Updates - seriously, show me another update manager that is worse. Examples that are much better: linux yum and OS X Software Updates. Furthermore, what is the point of an OS that isn't compatible with anyone else???? Windows is rarely compatible with their own legacy software, let alone others...

Go run Win98 then

[TravisO]

Win98 doesn't need any of these silly patches, so is it also more secure?

Re:MS Proprietary Protocols have a history of flaw

[DAldredge]

Please go back to reddit and/or digg.

Re:I love the small of hot-fix patches in the morn

[Craig Davison]

A local exploit is a potential problem even if you're the only user. If an attacker combines a remote non-root exploit (say an Apache bug that gets him access as the 'nobody' user) with a local exploit (that upgrades 'nobody' to 'root'), he now has a remove root exploit.

Local in this case just means a logged-in, unprivileged user that can run arbitrary code.

Read up on blended threats.

Zimbra?

[mcrbids]

Have you evaluated Zimbra?

At my company (I'm CTO) we have a mix of Windows, Mac, and Linux clients. (Sales/Support use Windows/Mac, tech dept is nearly all Linux) Throw in a few palm and Windows mobile phones, and you have a support nightmare. Supposedly, Zimbra supports all of these without issue.

I'm in the beginning stages of implementation (just allocated a dual-CPU server to trial it on today ON CentOS) but I'm wondering if anybody out there has anything to say about this?

Re:Zimbra?

[Anonymous Coward]

Where can I get a CTO job that it's possible to ask tech questions on Slashdot?

Re:Zimbra?

[Anonymous Coward]

Any company that only has 5 people (4 with windows, plus 1 "CTO" who gets paid 30k/year and has a mac laptop and a linux desktop)

I jest, but the same idea applies at even fairly large small companies.

Re:Zimbra?

[dropadrop]

We have had Zimbra for over a year and it's great. The webmail interface is very intuitive, and the system scales well with medium to large mailboxes (We have up to about 25GB of mail in the largest boxes). We have a mixture of Windows, Mac, Linux and mobile users (about 500 users with about 1000 mailboxes all togeather.

Not all parts of the usability are quite on par with Exchange (see how you find the calendars) but I think it makes up for that with scalability and other features.

Seems to be very trouble free till now.

Re:I love the small of hot-fix patches in the morn

[mcgrew]

Since I'm the only user on my box I don't think I have to worry about me exploiting my self and doing unknown harm

How do you know you don't have DID? ;)

Re:MS Proprietary Protocols have a history of flaw

[tignet]

In all fairness regarding Exchange, things break on every release. My comments regarding backward compatibility were specifically regarding Windows the OS, not the Microsoft server applications. While there are some good ones (SQL) there are some terrible ones (Exchange, SMS) too.

Regarding performance, both APIs are functional. DirectX is more an interface to hardware where OpenGL is a generic interface that may or may not be hardware accelerated. Performance is driven largely from the drivers. In my experience games that support both DirectX and OpenGL perform better in DirectX. Does that mean it's better? No, maybe Nvidia does a better job with DirectX than OpenGL. Regardless, you can't say one is always clearly better than the other.

Your UAC rant is still misplaced. I don't know anyone who likes the implementation. But what does it have to do with performance, stability or backwards compatibility with other software? It was a bad implementation of a good idea. Well, assuming you don't want to fix security (and break compatibility) with the Win32 API it's about the best you can do. An example of how MS tried to band-aid a poor design problem maybe. An example of broken backward compatibility it is not.

Okay, I'll bite on automatic updates. It's not the best. Nor did I claim it was. apt-get is better and my personal favorite. Solaris is on-par with Windows in that it will detect a "major" update and won't detect patches for that major update until the next time the update is run (possibly after a reboot). I've seen the same thing with OS X (such as after an iTunes upgrade). Why does Safari or iTunes reboot the computer? I have no idea. Why can't all update software look ahead and see if there are patches to what it has planned to install/upgrade? I don't know. What I do know is that Windows Update is not alone. Patching NetWare servers has to be many times worse than Windows.

I'm not sure how you miss the point of Windows (the OS) not being compatible with anyone else. They want it that way. POSIX wasn't implemented for a reason. You can't switch out Windows and replace it with something else without a huge investment (time and/or money). I am crystal clear on the issue of why it's not compatible with other operating systems. I don't suspect that it will ever change. Why would they want to compete against UNIX on equal ground when they have their own API that UNIX can't implement (or when doing so breaks apps because the API doesn't function as is publicly documented)? The only reason to be compatible with another OS is if you want to move applications between them. Microsoft doesn't want to. So what is the point of an OS that isn't compatible with anyone else? Money. And lots of it. And if you have to deal with the public sector where .DOCs are the "standard" or have to access corporate web applications that only run in IE you see the point very clearly.

As far as rarely compatible with their own legacy software? Well Vista broke some things in an attempt to lock things down better. A lot of the problems are due to bad coding -- code which if ran in *NIX would also not work due to some dubious assumptions on the part of the developer. The difference is in that *NIX software developer know (and often prefer) that their software will not run as root. Much of the MS software out there requires that it be run as an administrator. When you start locking things down (non-root users in Linux, roles in Solaris, SELinux, CSA and Vista/UAC) bad software breaks.

I'm not a fan of Windows for many reasons. One of those reasons is backwards compatibility. It's really, really hard to "fix" security problems with a bad API when you carry forward that bad API into every future release. Sure, some of the really bad API is removed (and applications break) but most of it has carried forward. At the expense of security, it has definitely allowed for backward compatibility.

I have an incredible philosophical problem...

[tlambert]

I have an incredible philosophical problem with any software designed to cause code to run as a result of you receiving an email, and which then takes that email as its input data, particularly if it starts processing it before it verifies the referential integrity of the MIME container(s) in the message.

The primary reason OutLook has been such a cesspit of exploits is "Exchange integration". Loosely translated, this means that it ignores encapsulation enforcement by starting to interpret the contents of an email prior to verifying that the container object for the email itself is intact and contains what the headers say it contains. That it also runs code in arbitrary and unverified DLLs registered to handle decoding a particular MIME type when you receive an email, and AGAIN without verifying the referential integrity of the container is almost criminal.

You take those pieces away, and the "neatly integrated" quickly becomes not nearly so "neatly".

I have to agree with one of the other posters, that the best example of this done correctly is the server-side AJAX integration that's used in Zimbra. For non-Zimbra solutions, recognizing dates as things you can put on a schedule or addresses or signatures as things you can attach to an address book entry is about a 90% solution, and doesn't require the risk of premature decoding to make it work. Apple's Mail.app does this rather well, although it also is starting down the "active email message" path-to-hell blazed by Outllook, at least it's not turned on in the preferences by default, and container integrity is checked up front.

-- Terry

Re:I have an incredible philosophical problem...

[SatanicPuppy]

The reason it's been a problem is that the vast majority of Windows admins don't know what the hell they're doing.

If it's properly configured, and properly deployed behind a shitload of OSS-based hardening, it'll hardly ever have problems...Our corporate exchange setup hasn't had a virus in years...We have far far far more trouble with people who still use IE and people who bring in thumbdrives full of crap from home.

Yea, it's a pain to protect it, but once you do it works fine.

Re:MS Proprietary Protocols have a history of flaw

[compusci]

I agree that OS X Updates often do require one reboot, after the software update process is complete. This is still much better than Windows: Incremental Update, reboot, incremental update, reboot, etc.... As far as UAC goes, this is more of an example of a new, MS proprietary idea badly implemented that was used instead of embracing alternative security models that have existed for decades under UNIX. I'm not saying that other OS's don't have proprietary components, but if I write a program in Visual Studio with C++ and use Direct X or MFC, how do I port such a program to linux? I really can't. In the end, I would have to re-write most of the program. Compare this to proprietary UNIX-based OS's where ports are much easier to accomplish between systems. The purpose of technical standards is to integrate technology across vendors, which, does not really exist under the Microsoft philosophy to control their majority market share. So Microsoft's claims of compatibility are only true if you are using another Microsoft system.

oh get over yourself

[citylivin]

I had the same with exchange 2007. Calendaring stopped working so I reinstalled rollup 5 and everything went back to normal.

As for your comment, one day when you move into the "real world" you will realize that you dont always have the resources to test every single patch that comes down the line. Id much rather have a microsoft patch fubar the machine than have a haxxor pwning it because i was busy testing a patch. At least when i have to explain to management why the email was down for 30 minutes, I can blame microsoft instead of saying that we got exploited (which would then become MY fault).

Not everyone can afford to have redundant everything. Especially machines that are only used for testing, and therefor not in a production environment, where it is easier to find bugs. Sure, if your exchange server services 2000+ users, or generates tens of thousands of dollars a day then maybe you can afford another machine to test on. Most people in the Real World do not have those luxuries.

Re:oh get over yourself

[lukas84]

As for your comment, one day when you move into the "real world" you will realize that you dont always have the resources to test every single patch that comes down the line.

True. Reality bites and all that.

However, do not blame your software vendor for YOUR lack of procedures!

If your management considers it acceptable to deploy security patches directly into production there _will_ be regressions sooner or later. They're not your fault, they're not Microsoft's fault, they're your management's fault for not following best practices.

Re:I love the small of hot-fix patches in the morn

[JoCat]

A local exploit is a potential problem even if you're the only user. If an attacker combines a remote non-root exploit (say an Apache bug that gets him access as the 'nobody' user) with a local exploit (that upgrades 'nobody' to 'root'), he now has a remove root exploit.

Local in this case just means a logged-in, unprivileged user that can run arbitrary code.

Read up on blended threats.

We need a section on Milw0rm called, "Will it Blend?"

sendmail security

[Anonymous Coward]

Like sendmail has never had critical vulnerabilities in its address parsing code?

The last time there was a sendmail release for a major security reason was 8.13.6, back in March 2006:

http://www.sendmail.com/sm/security/
http://www.sendmail.org/releases/8.13.6

There was a DoS issue that was fixed in May 2006 (8.13.7).

tnef is the devil

[Anonymous Coward]

TNEF was M$s way of punishing non-windows sites. Any message using M$ Outlook composed in rich text format is automatically sent in this proprietary format. There are free TNEF decoders (reverse engineered), but none is perfect. Most spam virus filtering gateways use these free TNEF decoders, so the bad guys can get their payloads into organizations by encapsulating it in TNEF that the free decoders can't decode, but the vulnerable soon-to-be-zombie pcs can. It also seems that a service pack for Office 2k3 has added additional cases where outlook encodes messages with TNEF.

It is petty, but... payback time-- no sympathy from me.

FYI

[mahadiga]

It is Microsoft Exchange Software Feature.

Re:I love the small of hot-fix patches in the morn

[GooberToo]

I can't believe this was modded insightful. In other words this local exploit is an issue because of imaginary remote exploits? WTF? That's like being worried about local exploits when I don't have physical security. If I don't have physical security, nothing else matters. If I don't have remote security, nothing else matters.

Simple fact is, first order concerns always are and always will be physical security and remote exploits; assuming a system with network connectivity. Period. Everything else is secondary.

Re:I love the small of hot-fix patches in the morn

[Craig Davison]

If I don't have remote security, nothing else matters.

This is not true. There are plenty of things in place on your linux box that minimize the impact of a network intrusion.

First of all, you run network services as nonprivileged users. If I find a vulnerability in your ntpd, and exploit it, I can't for example delete files or shut down the server, or setup a keylogger, because the ntpd user doesn't have the rights to do any of that.

You might even run certain services in chroot jails, where they have no access to most of the filesystem.

However, a local root exploit makes this all much more serious. You would be able to turn the unprivileged ntpd login into a root login.

If you don't run any network services at all (or you firewall them from the world), fine, local exploits aren't going to be an issue for you.