Slashdot Mirror
Microsoft Says No TCP/IP Patches For XP
CWmike writes "Microsoft says it won't patch Windows XP for a pair of bugs it quashed Sept. 8 in Vista, Windows Server 2003 and Windows Server 2008. The news adds Windows XP Service Pack 2 (SP2) and SP3 to the no-patch list that previously included only Windows 2000 Server SP4. 'We're talking about code that is 12 to 15 years old in its origin, so backporting that level of code is essentially not feasible,' said security program manager Adrian Stone during Microsoft's monthly post-patch Webcast, referring to Windows 2000 and XP. 'An update for Windows XP will not be made available,' Stone and fellow program manager Jerry Bryant said during the Q&A portion of the Webcast (transcript here). Last Tuesday, Microsoft said that it wouldn't be patching Windows 2000 because creating a fix was 'infeasible.'"
The U.S. Navy's and Marine Corp's NMCI computing infrastructure is all Windows XP. Let's see whether or not Microsoft withholds a patch from them.
It is unclear how large a threat this is to the end user. However the fact that XP is being loaded on netbooks suggests that Microsoft has a revenue stream that it should protect by writing a patch if it is serious.
Facts are history now plebs have politics for religion on social media.
"not feasible"
yeah right, more like MS wants people to move onto Windows 7
I thought the Code for windows 2003 and windows xp was mostly identical. As a currently shipping product isn't that a violation of some states/countries warranty/merchantability laws.
That's unpossible!
This sig left unintentionally blank.
So, basically, upgrade or you'll be hacked?
Two questions:
1. Does 7's XP mode potentially have this issue, or is there a compatibility layer so xp doesn't talk directly to the network?
2. They seemed to be able to make massive security updates for code that was that old, and still patch a number of other issues. What about this REALLY makes it so hard to code?
In the end, while I understand not wanting to waste resources on way older products, I think it is a marketing move.
How very serendipitous for Microsoft, people now have a reason to upgrade from XP.
I ran W2K on my desktop until a couple of years ago, i.e. until the patches stopped coming W2K did everything I needed.
Guess I'll have to consider Win7 now...
So now they are going to force us to upgrade to Windows 7 sooner rather than later?
well, that's one of the positive aspects of the open source code. If the main developer doesn't want to fix something, then someone else can do it.
Isn't the codebase for XP and Windows 2003 essentially the same? Why can't the 2003 patch be modified? I don't remember reading that the TCP/IP stack was that different in 2003.
While the code may very well be 15 years old, that does not really matter to the user. What matters is how long ago Microsoft sold the product. If they sell software today that uses some code written 15 years ago you should be able to expect security updates for some period of time. Now, had they decided not to patch software they haven't sold in 15 years that would be totally OK.
MS hate aside, they're just doing what they've always done. We don't get our panties in a knot when they don't release a Win 98 patch, do we? With Win 7 on our doorstep, there is no reason for MS to be supporting three separate OS. Well, aside from customer service. I just sort of shrug my shoulders and deal with it. Anyone running XP knows they're doing it because Vista/7 don't appeal to them; deal with the consequences.
Looks like all of those netbooks microsoft allowed to be shipped with XP in the last two years will be tasty targets.
The same two bugs were ranked "moderate" for Vista and Server 2008, while a third -- which doesn't affect the older operating systems -- was rated "critical."
Yes, it's easy to take the "We won't be backporting this fix" stance when the old OS isn't vulnerable in the first place.
For some unfathomable reason, MS rates remote code execution as a LOW impact problem for XP.
And somehow, the TCP stack, perhaps the most modular and with the most well-defined interfaces, can't be replaced wholesale.
This makes no sense, unless they're trying to get people to spend $$$ on moving to "Windows 7",
or as the congnoscenti call it, "Vista SP2".
ooooohhh.....
Since XP is still being shipped and supported on netbooks this seems a little strange. What's the message - spend extra on memory and hard drive so that you can run XP instead of Linux but we won't give you security patches?
I've worked with older code than that... nothing unfeasable about it.
In other news... 10 year old Linux 2.4 kernel patched yesterday...
A new car built by my company leaves somewhere traveling at 60 miles per hour. The rear differential locks up. The car crushes and burns with everyone trapped inside. Now: do we initiate a recall? Take the number of vehicles in the field (A), multiply it by the probable rate of failure (B), then multiply the result by the average out-of-court settlement (C). A times B times C equals X...
If X is less that the cost of a recall, we don't do one.
Loading...
Oh, Dusty. In-feasbile is when you're MORE than feasible. This TCP/IP fix, it's not just feasible, it's IN-feasible.
...we lost the source code, we kept it in Microsoft Source Safe and it ate it.
Do daemons dream of electric sleep()?
The U.S. Navy's and Marine Corp's NMCI computing infrastructure is all Windows XP. Let's see whether or not Microsoft withholds a patch from them.
Since 2008, the US Navy will acquire only systems based on open technologies and standards. That excludes M$ products explicitly in every way but name. The TCP/IP being just one example of failure on M$ part to implement standards. US Navy is ditching M$.
They'll probably go with an American company like Red Hat or roll their own spin of Red Hat.
The question remaining is will Bill's father's political connections keep lil Bill out of Camp X-Ray or not? If you've got Windows on your network, then you have a personnel problem, not just a network security problem.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
The true cost of releasing a patch is not in compiling and distributing the fix. The money is spent on verification. By not releasing the patch to XP and w2k my estimates are that Microsoft is saving man-years in verification.
Break the sound barrier - bring the noise.
"retrofeasable," "antifeasable," "inflamafesable," and "!feasable."
There is really no reason for XP on a netbook any more. You aren't using it a high end gaming platform. You aren't running Adobe Creative stuff on it.
You are using it to run FireFox, edit documents, read, IM and send email.
Linux has all that covered and is even document-compatible with Windows.
I have a Eee 900A with a 32GB SSD in it running Xubuntu and I connect to a corporate Radius network, bluetooth tether to my phone, and even use the web version of outlook on it to get at calendars.
Flash even works.
The only thing I can't do that would be nice is play Netflix movies as the Moonlight package does not have DRM in it (and likely never will.)
Dog is my co-pilot.
This is just another reason to abandon Microsoft. I am so happy with my Mac, open office and a variety of other non-Microsoft technologies. The last time I spent money on one of their "products" was Windows 98. No reason to ever drop a dime again on their crap.
The DOS/DDOS possible via the latest weakness in Windows 2000's IP stack @ least (uses RDR20.DLL as the LSP (layered service provider) vs. MSWSOCK.DLL (the LSP used in XP/Server 2003 onwards, by way of comparison, & this is where I think the problem lies largely, as it is the "most radically different part" of the IP stack in Windows 2000 vs. the more current builds of Windows that I could see @ least)?
WELL - That's taken care of by the SynAttackProtect setting here -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
What does it do??
http://msdn.microsoft.com/en-us/library/aa302363.aspx
Description: When SynAttackProtect is enabled, this value specifies the threshold of TCP connections in the SYN_RCVD state. When SynAttackProtect is exceeded, SYN flood protection is triggered.
TcpMaxPortsExhausted
TcpMaxHalfOpen
TcpMaxHalfOpenRetried
Also have to be considered as well (these determine how long before SynAttackProtect "kicks in", vs. the DOS/DDOS attack that could occur)
This SynAttackProtect registry value causes Transmission Control Protocol (TCP) to adjust retransmission of SYN-ACKS. When you configure this value, the connection responses time out more quickly in the event of a SYN attack (a type of denial of service attack).
2: Set SynAttackProtect to 2 for the best protection against SYN attacks. This value adds additional delays to connection indications, and TCP connection requests quickly timeout when a SYN attack is in progress. This parameter is the recommended setting.
NOTE: The following socket options no longer work on any socket when you set the SynAttackProtect value to 2: Scalable windows
-----
IIRC? This is called the "Silly Window Syndrome", & this is a way, in theory, around it... & iirc, "Scalable Windows", via setsockopt API calls from an attacker are what the problem is here anyhow & this ought to 'stall it'... thoughts/feedback?
APK
P.S.=> Also, "hardcoding" the TcpWindowSize & GlobalTcpWindowSize settings in the registry in TCP/IP Parameters (see registry path above) SHOULD also help here also, for servers that can accept MANY connections from MANY clients, worldwide, as your specific constraints specify...
Thus, effectively stalling the ability to use TcpWindowScaling is stopped by SynAttackProtect too, so an attacking system/app sending a setsockopt of 0 for this SHOULD also be nullified, on a server also...
(However/Again - Workstations are easily taken care of , vs. servers, just by what I wrote up above either by PORT FILTERING)
IP Security Policies, which can work on ranges of addresses to block, OR, single systems as well you either ALLOW or DENY to talk to your system, still can help also... vs. a DDOS though? SynAttackProtect is your best friend here... you'd use netstat -b -n tcp to see which are held in a 1/2 open SYN-RECEIVE state, & BLOCK THOSE FROM SENDING YOUR WAY (or just by doing it in a router or routing table)... takers anyone, on these thoughts (especially for Windows 2000)?
Thanks for your time... apk
There are how many XP machines on the web? Who won't issue a repair for that many machines? If they won't do it, release the code to someone else who will. Car companies tried to do this - not releasing spare parts. Other companies won the right to make the parts.
Its not just an issue of upgrading to Vista or Windows 7 - Microsoft has a responsibility to fix their stuff because of their place in the market and their presence on the web.
They're still minting XP disks. They'll have to make the patch for big\secure customers. They should be made to release the patch.
AC
Procurement times are so long in the military that everything is old. I understand the Seawolf is powered by 68030 processors...
This is my sig.
This is just another reason to abandon Microsoft. I am so happy with my Mac
So... because you don't want to update Windows from XP to Windows 7, you will instead update your entire computer to a brand new Macintosh running a brand new operating system.
I mean, if you are shopping for a new computer, isn't Microsoft's abandonment of XP kind of irrelevant? If you are not shopping for a new computer, why would anyone care?
This is my sig.
Clearly, this is something Microsoft is leveraging to get people to move to Win7. (You know, in some fonts "Win7" looks rather similar to "Win?") But I have to wonder:
There will be large government installations that still need to use Windows XP. Will they get this impossible patch? Also, does Microsoft's support claims for Windows XP fit within this windows and if not, how can Microsoft pull a stunt like this? Doesn't this mean they are dropping support for Windows XP "early"?
What really needs to happen is that "the public" needs to be aware of what is happening and, in Fox News style, be instructed how to feel and respond to it.
They are still selling computers with WinXP on them. It's unfair for them to just not support it. This is all a ploy to sell more copies of Windows 7 and we all know it.
If we thought Windows was insecure before, just wait to see how vulnerable it's about to become with all the unsupported XP boxes that are going to be around!!!
I guess these guys did not read: http://support.microsoft.com/gp/lifepolicy XP extended support goes thru 2014 and supposedly covers security fixes. I would think this counts as a security fix.
Conservative, mod down for violating
To: Steve Balmer, CEO of Microsoft
Dear Steve
Here's an idea for you. If you're not going to support XP any longer, open source it! The community will be happy to fix your dirty work for you. Just don't blame us when noone buys Windows 7 afterwards.
Regards
XP_phantom
Microsoft didn't write all of Windows 7 from scratch. It's surely got plenty of "15 year old code", and probably older. So Microsoft's policy says that it cannot patch some Windows 7 bugs.
Maybe there indeed isn't any 15 year old code, as MS cycles its codebase slowly through "new" OS releases over the years. But there's doubtless 10 year old code, and certainly 5 year old code. So in 5-10 years, everyone buying Windows 7 today (and tomorrow) will be forced to buy the next "upgrade". And the one after.
Or run seriously insecure code that the bad guys have had 5, 10, 15 years to figure out how to exploit.
Microsoft: job security through product insecurity.
--
make install -not war
I will never feat the miscreant attacking and then commanding MY PC AGAIN !! I hearby swear to all mighty GOD that I am though with M$ and will abandon everything I've spent for it over these past 20 YEARS because some miscreant will, might, maybe could, DENY ME MY SERVICE of MY COMPUTER !! I have seen these SMALL WINDOW SIZE TCP PACKETS and they are HORRIBLE, HORRIBLE I tell you !! And they WILL, might, maybe, could DEMY ME MY SERVICE of MY COMPUTER. Well, I won't STAND FOR THAT. I am hearby DENYING MYSELF of MY SERVICE of MY COMPUTER before the miscreant CAN, might, maybe could DENY ME MY SERVICE of MY COMPUTER.
God bless and keep you,
Right Reverend M$ Can Suck My Balls Kartmann
Why not? The Pentagon continued using Halliburton for years, on huge no-bid contracts, even when its divisions were installing showers in Iraq that electrocuted our servicemembers. And that's just the worst failure the public heard about, after most of a decade of abusive cronyism.
Microsoft is much richer than even Halliburton, and its failures much less publicly scandalous. Why would it face a tougher standard? I'm sure Dick Cheney owns a lot of Microsoft stock, too.
--
make install -not war
Today GM announced that the GMC trucks have some fundamental flaw and they are prone to explode randomly. GM said it wont fix the issue because the design is very old, and fixing it is unfeasible. When asked if they will when they stopped shipping trucks with the fatal flaw, GM spokesman said, "we have not stopped building or shipping them yet. We need to compete with the low cost competitors in the net-truck market and so we continue to make and ship the trucks, but we wont fix the safety issue. The drivers may wrap themselves in bags filled with thermocol peanuts to get some measure of protection.
If not, why do we let Microsoft get away with it?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Alex P. Keaton is an MCSE? Is there anything that guy can't do?
Microsoft Corporation has announced a limited one-off extension of availability of its Windows XP operating system to April 2101 after criticism from large customers and analysts. This is the fifty-sixth extension of XP's availability since 2008.
Through successive releases of Microsoft's flagship Windows operating system, demand for XP has remained an important factor for businesses relying on stable XP-specific software and installations, who have pushed back strongly against the software company's attempts to move them to later versions. Windows administration skills have become rare in recent years and consultants have demanded high fees. Reviving Windows administrators from cryogenic freezing has proven insufficient to fill the market gap, as almost all begged to work on COBOL instead.
"Windows XP is currently in the extremely very prolonged super-extended support phase and Microsoft encourages customers to migrate to Windows for Neurons 2097 as soon as feasible," said William Gates V, CEO and great-grandson of the company founder. "Spare change?"
Microsoft Corporation, along with Monsanto Corporation and the RIAA, exists as a protected species in the Seattle Memorial Glass Crater Bad Ideas And Warnings To The Future National Park in north-west Washington on the radioactive remains of what was once the planet Earth, under the protection of our Linux-based superintelligent robot artificial intelligence overlords. Company revenues for 2098 were over $15.
illustration: A background wallpaper for your insecurable XP desktop. (Anyone got a pointer to the 1024x768 version?)
http://rocknerd.co.uk
So the patch code for Vista et al won't fit on XP? Hardly suprising - I believe that was a different tcp/ip stack. What MS is actually saying is they won't spend the time/effort/money to develop a patch tailored for the XP stack. There's no such thing as infeasible in this business, only 'too expensive' or 'not in our political best interest'.
- The Kessel run is for nerf herders. I can circumnavigate the entire Central Finite Curve in a lot less than 12 parse
Best Buy's recent "training" slide #9, where they say that "Linux is safer than Windows" is a myth, the "Real Facts" states (referring to Linux) 'There's no guarantee that when security vulnerabilities are discovered, an update will be created. Users are on their own.'
Here's proof that that statement is really talking about Windows...
I say give 'em a month, tops, and then there will be a patch (or news of a coming patch) for Windows XP.
Now would be a terrible time for Microsoft to alienate all those big corps that have XP and force them into another OS, if they want to keep their customers.
It'd be great for everyone else, as customers may start looking into things they would never have considered otherwise, such as various open source operating systems, and the necessary apps it would take to keep them going in their workflow, post-transition.
The way it looks is, some people (usually companies) will view this as a threat from Microsoft that reads: "Upgrade if you want protection."
Some of them in this group will obediently upgrade to Fista or 7.
Some of them will reluctantly upgrade to Vista or 7.
Some of them will stay with XP and find other ways to secure themselves.
Some of them will [cross their fingers and hope|pray] that Microsoft changes their mind and offers a patch.
Some of them will be offended and migrate to another OS outside of Big Red Robotland.
And of course, some of them will feel that litigation solves everything, and want to take MS to court for "refusing to patch an OS that is in such widespread use" (or) "intentionally posing a security risk".
Refusing a patch like this, in my humble opinion, isn't something you want to do until a few months after your new OS lands, at the bare minimum. That way, you've already got people migrating.
XP's patching lifecycle isn't up yet, from what I can see here, though: XP SP2 should be good until July of 2010, and SP3 should be good a bit longer than that, so I'm surprised no-one has really called 'em out on that.
One of these days, I am going to flip out. When I flip out, I'll be back in five minutes.
1. Buy Netbook with Microsoft WIndows XP installed. ...
2. Run all updates.
3. Browse web, get hacked by this exploit. Lose money through "identity theft" / bank fraud.
4. Turn up in court with the receipt for the netbook & windows license stating when purchased, and the date and time Microsoft refused to patch the hole which caused your loss.
5. State that Microsoft is profiting from a product which is unsuitable for purpose, and it knows is unsuitable.
6.
7. Read Microsoft fine print and realise that you have to now give Microsoft your first born child for ever doubting that their asses are covered.
Yeah, consumer loses out on this one.
Finally had enough. Come see us over at https://soylentnews.org/
Good points, but can you start writing in that funny old language English? Shit it was hard to decipher ;)
What an excellent advertisement for Apple (or even, gasp, Linux)! Just as soon as they decide you should be forced onto a new operating system, Microsoft decides to leave bugs in XP that could create a gap in security and lead to millions of machines getting infected.
Nice work. I know what my next operating system WON'T be.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
[...]backporting that level of code is essentially not feasible[...]
Okay, so if I get this straight, there's a bug that's in Vista on TCP and that same bug's in XP. So I take it (and knowing m$ a bit, why wouldn't they?) the code is essentially the same or these idiots made the same mistake twice. So if the update for Vista is possible, then what's the big deal about XP?
Please..all underlying architecture has not changed from xp to vista, even though they want you to believe this...and for them to correct the wrapper on xp, would be trivial, however, they are testing the waters about phasing out xp, and want to see what the backlash will be like, seeing as no one wants vista garbage, and maybe even no windows7!
I prefer, being given the opportunity of just paying a yearly fee to keep getting updates on a system that runs properly compared to their new bloated versions of vista etc... too bad no one can pick it up like a linux distro and start their own version of windows...
in other words:
it's the same feigned argument as when they refused to port DX10 to XP to boost Vista sales - uh - I mean it was because it's technically impossible... it's just that hackers ported it to XP later....
The MAFIAA is a bunch of mindless jerks who will be the first up against the wall when the revolution comes
Don't run an OS that you can't patch yourself. Seriously, if we put our trust in these guys after they've proven time and again that they really don't represent our best interests we are the only ones to blame. It's about time to let MS go gently into the night alone and without a sleeping bag into a rabid pack of wolves.
I don't believe in karma, I just call it like I see it.
I wonder if the enormous deployment of XP will be the concrete block that causes Microsoft to sink to the bottom of the river.
If Microsoft could not get XP users to adopt Vista and Win7 does not get them to upgrade either, then XP customers' inertia will pull Microsoft down.
Microsoft can never go forward with XP users rejecting any new OS it produces.
Follow the cash. Windows 7 comes out in October and they want all those damn pesky XP users to upgrade to it since they refused to be Vista guinea pigs so they're cutting them off to upgrades to drive home the point of we want OUR cash. As others have noted, quite curious since you can buy some machines today with XP on them standard. Standard M$ crap.
What really needs to happen is that "the public" needs to be aware of what is happening and, in Fox News style, be instructed how to feel and respond to it.
I'm not sure why you think this is the sole province of Fox News, Perhaps because Fox News more closely reflects what the general American public thinks and feels? And thus appears to be more effective at shaping pubic opinion, when in fact they are more reflecting public opinion than shaping it. Here is a link that lists many attempts (some successful, some not) by other news sources to shape public opinion by selectively (and sometimes falsely) reporting the news: http://spectator.org/archives/2009/09/15/media-malpractice-tom-brokaws/
The truth is that all men having power ought to be mistrusted. James Madison
Because Apple stopped selling versions older than 10.5 nearly two years ago and the upgrade to 10.6 is thirty dollars retail. Microsoft is still selling XP licenses.
Can you be Even More Awesome?!
Legal Trouble? Hahaha!
MS: "Here's $10,000"
"Okay, no more trouble!"
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
I can't speak to the main issue of this story, but XP is anything but off the market. I bought a new copy of XP from New Egg last week for $90 and installed it on my daughter's computer. She has an older computer that cannot run Vista, and she lost her original XP CD. When her hard drive crashed, I replaced it and put the newly purchased copy of XP on it.
M$ isn't cute, funny, or meaningful.
The dollar sign is dumb.
Let's knock it off.
Okay, I have a weakness... sometimes I can't help responding to trolls and off-topic discussion.
Fox news does NOT more closely reflect what the general American public thinks. If that were the case, the initial positive approval ratings of Obama would have been reflected in Fox's news reportings. Most polls showed that Obama was welcomed with enormous public majority favoring his getting into office. (FWIW, I am no Obama follower) Further and more recently, countless polls early on in the healthcare reform initiative, most people favored healthcare reform quite strongly with an overwhelming majority in favor of regulating the healthcare industry. Polls still report that the numbers are in favor of healthcare reform and the Fox News view would seem to be quite different.
Not only this, but Fox News is more in the business of expression of opinion with the majority of its presentations and shows falling under the "editorial" category with its reporters performing all sorts of dramatics such as crying, screaming and in no uncertain terms calling Obama "racist."
I completely understand the psychology behind the need to "defend your favorites" because the things people favor are somehow a reflection of themselves and so they are actually defending themselves in a way. This is why Apple and Microsoft fans are so froth-mouthed. And while I am not going to claim that "all other news is neutral," Fox News is known world-wide as being owned and directed by a particular group of people with a particular agenda are various issues. And that group of people are FAR from a majority. And, of course, Fox News is so far to one side that they are actually attempting to move the center closer to themselves to make everyone else appear to be polarized in the opposite direction. In short, Fox News has the strongest reality distortion field of any "News" activity.
Computer maybe broke. Computer maybe be un-broke with little work. Can do on own given not stupid. Take with grain of salt, reading slashdot.
wrong analogy, you are focusing on the wrong issue. Real analogy: Do you still expect adobe to patch the latest versions of their software as long as they are in business? yes. What if they had a DLL that was affected in *all* versions. Do you expect them to patch it with the latest version? Hell yes you do. This is not a car warranty, so that argument is completely null. Things that are on XP cannot necessarily magically be "upgraded" like you think, additionally why should someone even feel remotely obligated to spend money on a new version of something that works just fine?
Car analogy: does the manufacturer shutdown their car after 10 years if you can keep it running?
Why should MS exclude one?
maybe you should think about the argument you are making, because it is off.
The fix is to NEVER buy Microsoft products, again. Microsoft is a defective corporation that has made a mint off of selling knowingly defective products and reselling the HOPE that these defects will be fixed in the next update but reneging again, and again, and again, and again. MSFT's example of no/low quality has become the new American metric of quality, its business plan, corroding our society's business and work ethic, a complete mockery of the consumer laws on mechantability, deservedly debasing our reputation for quality goods.
Since the government has been ineffective in enforcing these laws, falling for MS legal theories, only insistent market rejection will [partially] protect a consumer from the borg. No doubt we will be seeing more FUD IP attacks, like SCO, traceable to MSFT. Good luck to all. Fsck MSFT.
Microsoft says "no"
Adding anything after the "no" is superfluous. We've learned that the hard way.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Ah, a car analogy. It's more like this: You go to the Honda dealership and take a look at their 2010 models and purchase a vehicle. You discover that the engine has a serious flaw in it and ask Honda for a fix. Honda refuses because that engine is based on an 8 year old engine design. Except in this case, instead of a Honda you bought a brand new netbook and instead of an engine it came with a new copy of Windows XP.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
That doesn't make sense. Server 2003 and XP are nearly the same, how could they patch one and not the other?
Copyright is a government grant of rights.
Just stop enforcing them. The government would be well within their rights.
Or take the source code.
Again, they would be within their rights.
Or rescind the corporate charter.
Again, they would be within their rights.
"@" takes two character strokes (shift 2) to write
"at" takes two character strokes to write
Writing "at least" is universally understood and no more effort than writing "@ least".
There are few things more feasible than devoting a few engineers to working on a product used by tens of millions. That's the core definition of mass production and mass sales.
Legion are the feasible products that had a minuscule fraction of that, at best.
No, this is a lie whose purpose is to help twist the wooden stake in the chest of XP and 2000, both of which are still well-distributed at home and in business. Hell, I only had my 2000 machine replaced with an XP machine at work 3 freakin' months ago. And I'm one who gets regular upgrades at the premium "engineering" level computer = about 90% of the bleeding edge hardware capability, as my company defines that lol.
Note Microsoft got another OS sale for this new XP machine. Gotta really twist hard now in preparation for Vista++, whatever the hell it's called.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
and his "not feasibly" large testicles.
Squirrel!
and nobody here on slashdot notices that they actually explained that xp past sp2 doesn't NEED the fix, as it's written and documented.
reason: it's a flaw that affects all systems that have a listening service of some form on the firewall. all server os have it, vista, win7 have it. but xp doesn't.
so it doesn't NEED THAT FIX.
stop slashdotting and bashing microsoft, all of you.
(and i fully support that they don't care about pre sp2 windows xp anymore, as no one should)
We're in the worst economic downturn since the great depression and NT4 and Windows 2000 are still in widespread use. Custom software is a huge outlay for SME's and they're not typically looking to replace perfectly servicable code every decade. I have one client who depends on an app written in an obscure 4GL, they don't have the source code to the runtime and it will not run under Server 2008. We're not just talking office software; Industrial control apps where the initial cost of developing the plant is amortized over a period of 15-20 years usage.
I'm sure many of us warned our employers at the time about switching to NT, just as we warn them about cloud computing now. Microsoft's message as they pass around the hat to collect their monopoly rent, "Depending on our software was the wrong choice suckers". Let's get the facts: what's Microsoft's TCO now?
it's not like anyone would ever write a virus capable of exploiting the hole that someone could accidentally install on their computer, behind the company firewall.
This hole isn't useful to build a botnet because the effect of an exploit is just RAM consumption, not arbitrary code execution. Virus authors have bigger fish to fry.
I haven't bothered to check... but didn't Microsoft just use BSD-licensed TCP/IP stack like everyone else? If they did that would make the code much older than 15 years. Which is fine. Old code doesn't imply bad.
In the revised advisory, Microsoft explained why it won't patch Windows XP, the world's most popular operating system. "By default, Windows XP SP2, Windows XP SP3 and Windows XP Professional x64 Edition SP2 do not have a listening service configured in the client firewall and are therefore not affected by this vulnerability," the company said. "Windows XP SP2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network."
Interesting enough, if you are that concerned about security, then you probably already installed at least SP2. Which means that your XP box is NOT vulnerable to this type of attack. I guess computerworld needed a flashy headline to get some clicks and ad revenue.
Posting this way up here so people see it. Summary is mostly incorrect. From TFA: "In the revised advisory, Microsoft explained why it won't patch Windows XP, the world's most popular operating system. "By default, Windows XP SP2, Windows XP SP3 and Windows XP Professional x64 Edition SP2 do not have a listening service configured in the client firewall and are therefore not affected by this vulnerability," the company said. "Windows XP SP2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network."
I wouldn't be surprised if there is a third party developer that creates a patch that fixes this. Wasn't there something like that a while back?
Procrastinating life a way at a rapid rate of speed.
The above is clearly not a troll. One quick glance through my posting history will confirm that I believe these things. Feel free to believe that I am a crackpot, but anyone who doesn't understand that well-moneyed interests are the only true voters in this nation has truly missed the boat. If you can't read between the lines, then you'll never really understand anything. It's like all the idiots in the last couple days "RIP NORMAN BORLAUG"... the so-called green revolution has done little to nothing to feed the starving, but has pushed the use of synthetic pesticides and fertilizers as well as machine harvesting techniques that when combined kill off the soil. The evil done far outweighs the good. The Gates Foundation is very much the same thing. Time will prove me right, I wish it were otherwise.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
That will be interesting under German law.
IANAL but I'm familiar with a few of the relevant regulations. One of them is that the customer has a claim against the dealer he got the software from. Not against Microsoft directly.
So in theory a pissed off customer in Germany could sue the dealer but not Microsoft. Maybe the dealer could sue Microsoft in turn, but I'm not sure about that. AFAIK contracts between companies allow a lot more exclusions of liabilities than contract with consumers, so Microsoft may have guarded against that.
C - the footgun of programming languages
Did you even check the link I posted? The link gave specific examples of the other news networks doing the same things you accuse Fox News of.
BTW, I have not watched more than 6 hours of Fox News programming since the network began. I believe that television is an inherently terrible place to get news from.
The truth is that all men having power ought to be mistrusted. James Madison
That says it all really. Win7 is a decent improvement, but I guess those people happy with their XP machines need some "motivation"...
"When information is power, privacy is freedom" - Jah-Wren Ryel
If it's less than one year old and the manufacturer refuses to fix critical problems with it, you should be able to hand your Windows license back and get a re-fund.
Installed the Bubblemon yet?
Micro$oft finally finds 15 year old bug in software but cannot fix it as no one writes assembler anymore!
It's actually Alexander Peter Kowalski, and he's a freakin nutjob.
His posts are ALWAYS like this... a bizarre mashup of english, symbols and general incomprehensibility.
He likes to piss and moan about the HOSTS file not allowing 0 as a shorthand for 127.0.0.1
-Yuri Klastalov-
... *Windows Genuine Abandonment.
That's unpossible!
You keep using that word. I do not think it means what you think it means.
If a car is discovered with a flaw in it's design, then yes, they WILL cover a fix. Warranty or not.
Yes, the software the released was broken, so yes, they should be held responsible to fix it.
BTW, this is the ONLY way companies will start releasing better software, and the only way a company that makes an OS will put Design ahead of replacing it every 3 years.
"Microsoft are perfectly within their rights to "force" obsolescence onto users by concentrating on more recent versions of their software."
No.
The are within their right to not add new features, cosmetic changes, and a lot of other things, but they aren't within there right to sell a flawed product and then tell their customers to screw off.
The Kruger Dunning explains most post on
Correct me if I'm wrong. Microsoft is saying that because, by default, Windows firewall does not allow any listening services, the client is safe?
So anyone running Windows XP should not have any listening services. I just realized that, by default in our enterprise environment, the Windows firewall on our desktops are shut off (not my decision). This probably isn't a good thing.
It makes sense to NOT invest money/resources in something that will only encourage users to stay with XP.
Welcome to the Launch Nuclear Weapons Wizard
Please read the licensing agreement.
[Don't use against own country...Microsoft holds no responsibility...Mutants created by fallout may be used in Halo 4 marketing campaigns without prior consultation of blah blah blah...]
Are you launching towards a position more than 3000 miles from your current location?
Are you launching across the Pacific Ocean?
Are you launching across the Atlantic Ocean?
Ah...going over the North Pole to shorten flight time?
Errr...South Pole?
You aren't, by chance, located on the east coast?
Which would put you more than 3000 miles away from Redmond, Washington?
Bummer.
The Georginator himselficant couldn't pronunciaticate in a morely Bushified methodification if he triedicated.
Table-ized A.I.
First and foremost: remember, we're talking about Windows 2000 and Windows XP below.
CVE-2008-4609 documents a problem with TCP stacks where established connections (meaning the initial SYN, SYN+ACK, ACK have already been experienced) can renegotiate their TCP receive window size to a small value (no idea what "small" means) or zero, the result being the number of available sockets on the machine becomes exhausted over time. Since TCP window sizes are negotiated, but not necessarily respected, there's really nothing one can do about this other than fix the stack, or allow added tuning for this. You can force window sizes (like you mention in your post), but that does not guarantee the remote end will honour them. This is Normal(tm).
CVE-2009-1925 documents a much more serious problem with the Windows TCP stack: "a remote code execution vulnerability exists in the Windows TCP/IP stack due to the TCP/IP stack not cleaning up state information correctly. This causes the TCP/IP stack to reference a field as a function pointer when it actually contains other information." There's nothing one can do about this one other than fix the TCP stack. End of discussion.
CVE-2009-1926 documents a problem with the Windows TCP stack where an already established TCP connection, with an agreed upon small (again, no idea what "small" is) or zero-sized TCP receive window, is closed with data still pending on the socket (likely shown as SendQ). When this scenario occurs, the Windows TCP stack never removes this entry from the state table. There's no indication or documentation from Microsoft as to whether or not this applies to sockets which have a) already gone through the FIN, ACK, FIN+ACK, FIN+ACK handshake, or b) is stuck in a "half-open" state where either the teardown handshake is severed/botched in mid-stream, c) is stuck in a "half-open" state elsewhere before socket teardown, or d) is stuck in a "half-open" state during RST.
I think you're focusing on CVE-2009-1926, since you have excessive focus on "half-open" connections, but then simultaneously you switch to focusing on SYN.
> TcpMaxHalfOpen
> TcpMaxHalfOpenRetried
>
> Also have to be considered as well (these determine how long before SynAttackProtect "kicks in", vs. the DOS/DDOS attack that could occur)
"Half-open" can refer to one of two things, depending on who you talk to: where from a source, SYN has been sent but has not received a SYN+ACK back (Windows calls this state SYN_RECEIVE, *IX calls this SYN_RECV) -- or -- a socket that has already been established but during tear-down never completes the full 4-way handshake (see above).
> P.S.=> Also, "hardcoding" the TcpWindowSize & GlobalTcpWindowSize settings in the registry in TCP/IP Parameters (see registry path above)
> SHOULD also help here also, for servers that can accept MANY connections from MANY clients, worldwide, as your specific constraints specify...
Please do not follow this advice. It has been stated by Microsoft in numerous KB articles that people should not use GlobalTcpWindowSize. The registry entry in question has been deprecated with the introduction of Windows 2000 and beyond; you should be using this.
Secondly, increasing/forcing/making static the TCP window size permitted does not "harden" the stack at all, or provide any direct effect on security. Instead, stop that and enable RFC1323 instead. There are numerous sites that describe this process. On servers in this day and age, RFC1323 is more or less mandatory, ideally if you're serving large content (greater than 64KB). Here's some links that describe RFC1323 in Windows:
http://searchnetworking.techtarget.com.au/tips/27055-How-to-use-TCP-RFC-1323-to-improve-Windows-XP-s-network-performance
h
This looks like a class action lawsuit waiting to happen.
XP is still the main OS for netbooks, and if MS is going to sell (or allow others to resell), then they need to support it until there is alternative for that class of hardware on the market. An I am guessing that Win 7 isn't going to run like everyone thinks it will on old/underpowered hardware like the beta's seemed to indicate.
As far as the argument that the XP firewall will prevent this, we all know that isn't true, not to mention, there are often times when running the XP firewall is undesirable, like on enterprise deployments that sit behind an edge firewall.
I doubt anything will actually happen, but it would be interesting if it did.
Clearly, you didn't read the article as it is not an issue for XP SP2 and SP3. Maybe remember this the next time you decide to use the word "clearly" and postulate on crap you don't know the details about. Fox News style indeed.
Support a great indie game: http://www.abaddon360.com
Isn't M$ going to sell XP on netbooks ? Wouldn't this mean that any M$ netbook would inherently be insecure ?
The cisco TCP bug notice
B-b-but we're not ON your lawn, sir!
Free Martian Whores!
The real issue is that I can walk into Walmart right now and buy a computer that comes with XP on it. Adobe may not support a 8 year version of Photoshop, but neither do they continue to sell that 8 version today.
Do what thou wilt shall be the whole of the Law
We're talking about code that is 12 to 15 years old in its origin
Maybe you shouldn't have admitted that. And why praytell, is the code this old?
Sadly, a Libertarian cannot force his views on another, and freedom cannot spread as does the cancer known as religion.
The problem is that anything can install such a listening service on XP making it instantly vulnerable. That XP SP2/3 isn't vulnerable by default is a 'mitigating factor' in MS Security bulletin lingo, not a reason not to patch.
I don't understand why they're dragging their feet, as sooner or later something installs a listening service (or the user already has such a service) and it's over.
Never underestimate the relief of true separation of Religion and State.
'We're talking about code that is 12 to 15 years old in its origin, so backporting that level of code is essentially not feasible,'
Eh? You mean to say that Windows 2000 and Windows XP weren't "complete rewrites" like they claimed (at the time), and that that code goes back to NT4?
What about 2003 Server? Correct me if I'm wrong, but that's the same exact network codebase as XP. If you're going to patch 2k3, the amount of effort would be trivial to patch XP. (Often, the DLLs are even interchangeable, so it might be possible for a 'community' patch to be made.)
From where I'm sitting, this sounds like MS is putting a "real" EOL date (ie "today") on XP instead of "promised" EOL. That's a really crappy thing to do to your customers, as you can still get new Windows XP based devices (and they were commonplace as of a couple months ago). I'd suspect they're trying to push business clients to upgrade their networks due to the difficulty of "forcing" a customer to move from a 7-year-tested application framework to a new, yet-untested OS. I suspect it's been many years since small-medium businesses have given much money to Microsoft for OS licensing.
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
I believe that television is an inherently terrible place to get news from.
Yes it is truly terrible to trust the television because it is completely under the control of a government agency which does not have to abide by the constitution. And here in Canada it's a little worse, but less abused. From the page linked in previous post:
You said that it was critical for people to "vet information⦠because there is so much disinformation out there that it's frightening, frankly, in a free society that depends on information to make informed decisions." Mr. Friedman then chimed in that the Internet is "an open sewer of untreated, unfiltered information."
And soon the internet too will be brought under the umbrella of censorship, and then we'll be back to the dim ages.
Sadly, a Libertarian cannot force his views on another, and freedom cannot spread as does the cancer known as religion.
A good example of the "honest" reporting from non-Fox news organizations can be seen while examining this past weekend's 912 Project/Tea Party protest in DC. ABC News, specifically, was reporting 70k-80k people in attendance for a diverse base of reasons/no unified front. The reality, however, is that there was one primary (and very evident) unified front of "too much government/government spending", and that there were well over 1 million people present. While it might be difficult to prove there was over 1 million people in attendance, a review of the many stop-motion videos will show you that there was easily well over 100k people in attendance: people covering the 100' wide roadway all the way from the White House to the Capitol Building.
Sadly, this is just one of a handful of fraudulent reporting from CNN and ABC. They appear to be the worst offenders of late. Fox News isn't perfect, but anyone who's paying attention should be able to notice a bit of an echo chamber amongst the non-Fox news sources - and when Fox differs, an analysis of the information presented and facts available (photographic, independent 3rd party, etc.) tends to prove Fox in the right.
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
By *default* XP doesn't have RDP running.
But how many run XP in it's "defualt" configuration.
Run RDP and you're screwed, at least as far as anyone can tell.
It appears that with ANY listening service, which probably includes RDP, your XP station is vulnerable.
And forbid that you might be running some other agent/VNC/or other listening service.
To be clear... It appears that any non-firewalled listening service opens up this vulnerability. (ie. You run RDP and actually allow that port through even a running firewall. [You know, like it's not a lot of good running RDP if you can't get to it since it's firewalled.])
Go read the transcript. MS uses all sorts of weasel language to avoid the questions asked.
At best that means that someone could DoS all your XP stations (perhaps they'll have to be inside your network, but the next spyware/trojan infection could take down the whole network.) [This is true ONLY if the weasel explanation MS gave is actually what it appears - and given the true weasel nature, I'd guess it isn't.]
At worst, that next spyware/trojan could do remote code execution on the whole network running XP and turn everything into a zombie bot-net.
Oh, where do I sign up for that. That sounds like real fun!
-Greg
Of course the TCP/IP stack is older than XP. Perhaps they built one from scratch or maybe they bought someone's and extended it.
Now, I understand over time code can get really wonky and have lots of odd bits of cruft that are under documented and all of that.
Given the importance of I/O, Com and Net Access you woud think that MS's TCP/IP stack would have been coded by the brightest of the bright and following all best practices, etc. they would have well crafted, well documented and even beautiful code, if you will.
http://www.hawknest.com/
Xtrace identifies the Vista TCP/IP stack as identical to the Windows NT stack. Obviously the code is similar at least. However, I would bet that its just a cut and paste job.
oh, that's right, you don't "do" open source and you want your customers to stop using that product even if it works well for them on the computers they're already running. I see now, never mind.
LoB
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
There was an article on slashdot a couple weeks ago about training that Microsoft released ( http://linux.slashdot.org/story/09/09/05/195219/Microsoft-Attacks-Linux-With-Retail-Training-Talking-Points?from=rss ). If you look at the actual training, there's a slide that says "There's no guarantee that when security vulnerabilities are discovered, an update will be created. Users are on their own." Looks to me like Windows users are on their own.
Don't underestimate the power of incompetence.
`echo $[0x853204FA81]|tr 0-9 ionbsdeaml`@gmail.com
I'm assuming that your network is behind a NAT and a corporate firewall anyway.
Don't take life so seriously. No one makes it out alive.
So, they're telling us Vista and Windows7 -lack- such a stateful firewall?
It's amazing how many slashdotters totally ignore the fact that SP2 and SP3 DO NOT HAVE THIS BUG.
No new computers are being shipped without SP3 at this point, and if you haven't upgraded WinXP from the original retail version, that's your own problem.
Not very good boat anchors - they'd sink intermittently.
"At worst, that next spyware/trojan could do remote code execution on the whole network running XP and turn everything into a zombie bot-net."
If you'd have read the bulletin, you'd have seen that remote code execution was not one of the possibilities for the bug in XP or Win 2k.
Don't take life so seriously. No one makes it out alive.
Yes. But that doesn't stop internal attacks.
MPunzalan@finkelsteinthompson.com
send an email to this guy - this is the firm that helped me on the EA Spore SecuROM case. I'll bet ten to one their systems run XP and they're unaware of Microsoft trying to worm their way out of a contractual obligation to provide support until 2014.
I just sent my email - I'd suggest more of you do the same so he takes notice and has more incentive to take the case.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Maybe they should make a campaign distributing pirates eye patches! Arrrrgh.!
The XP firewall is practically fucking useless to begin with. That still doesn't give them the right to jump out of a contractual support obligation 5 years in advance.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Its all been done before!
(Oblig Wikipedia reference)
Maybe they lost the source code.
Prov 9:8 Do not rebuke mockers or they will hate you; rebuke the wise and they will love you.
But you forget, you pay for the OS so get the real support from a real company that cares about its customers and not a collection of hairy hippies who tell you to RTFM when you try to install Linux on a crappy old dell with a busted harddrive.
Amazing, really, tomorrow there will be a story about linux and someone will post a story that paying MS means you got proffesional support. Denial, it must be a wonderful place to live.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
I think this is a "reverse psychology" publicity stunt. XP is bad..... Let's use Linux..... Microsoft comes to the rescue..... XP is now all good!
And what if i shut down that damn stupid firewall they ship with windows XP SPX ???
. "Windows XP SP2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network."
That REALLY sucks , like saying i won't heal my 3 inches blood/covered hole in my chest because it's under my lovely free t-shirt
and maybe you ought to look a bit further down at the table of effects where it says the maximum effect on xp is denial of service.
Since it is no longer feasible for Microsoft flagship products to be supported, we will no longer support Microsoft. Xp is XP is XP. Poor unsuspecting pre-sp3 users, W7 has allegedly been not exactly robust either.
yURINAL, go be Klass-less elsewhere.
The flaw is with a service that has been turned off since XP2. There are no known ways to exploit this flaw with the service turned off.
But I thought at the time XP was released, they said it was built from the ground up! You mean to tell me they reused code from Win 2000 and NT?
Oh wait, I'll bet Windows 7 will be completely rewritten so none of this legacy crap carries forward! Or maybe I'll need to wait a few more versions till they get to Windows 95 - oh crap!!!!
See subject-line above, & "SWS" was short for "silly window syndrome" ->
TCP "Silly Window Syndrome" and Changes To the Sliding Window System For Avoiding Small-Window Problems:
http://www.tcpipguide.com/free/t_TCPSillyWindowSyndromeandChangesTotheSlidingWindow-4.htm
PERTINENT CONCEPT QUOTE -> "Key Concept: Modern TCP implementations incorporate a set of SWS avoidance algorithms. When receiving, devices are programmed not to advertise very small windows, waiting instead until there is enough room in the buffer for one of a reasonable size. Transmitters use Nagles algorithm to ensure that small segments are not generated when there are unacknowledged bytes outstanding."
Which, per the setsockopt 0 call & parameter? Does sound a LOT like this problem is, via setsockopt 0 calls issued by an attacking malware to exploit this for DDOS/DOS attacks!
Again - please, read on & offer your thoughts after reading the above article especially & its KEY POINT/CONCEPT, quoted above... & about how setsockopt 0 is used in attacks of this nature, on this vulnerability in Windows 2000.
I am only looking for possible defenses for Windows 2000 users (MS stating PORT FILTERING will do it? Fine for workstations, but for servers that solicit connections?? Not so fine imo, as they have to offer connections, & THAT means they are "DOS'able"!)
Please, read on, offer your thoughts futhers on these points:
----
"Since TCP window sizes are negotiated, but not necessarily respected, there's really nothing one can do about this other than fix the stack, or allow added tuning for this. You can force window sizes (like you mention in your post), but that does not guarantee the remote end will honour them." - by Anonymous Coward on Tuesday September 15, @11:31AM (#29426941)
By "negotiated", don't/or do you rather, mean "Tcp Window Scaling", per the above about "Silly Window Syndrome"? I do know that SynAttackProtect, set to a value of "2", STOPS TcpWindowScaling... per this quote from MS:
SOURCE -> http://msdn.microsoft.com/en-us/library/aa302363.aspx
PERTINENT QUOTE -> "NOTE: The following socket options no longer work on any socket when you set the SynAttackProtect value to 2: Scalable windows"
----
Also: GlobalTcpWindow MAY NOT BE USEFUL HERE, since it is "deprecated", but?
The other parameter I noted apparently is, of TcpWindowSize, per your source no less here -> http://support.microsoft.com/kb/q263088/
----
"Please do not follow this advice. It has been stated by Microsoft in numerous KB articles that people should not use GlobalTcpWindowSize. The registry entry in question has been deprecated with the introduction of Windows 2000 and beyond; you should be using http://support.microsoft.com/kb/q263088/ -
PERTINENT QUOTE: "To resolve this issue, set the TCPWindowSize value globally or use a value smaller than 64240 (this value is a multiple of the Ethernet Maximum Segment Size)." - by Anonymous Coward on Tuesday September 15, @11:31AM (#29426941)
I never SAID it "hardened" the IP stack...
I figured it MIGHT help "mitigate" the setsockopt 0 that a 'badware' for DOS/DDOS would use to set a WindowsSize of 0, which IS the problem here, per the setsockopt 0 call, & what SynAttackProtect stops (sliding window sizes), & the fact that you can set that WindowsSize for Tcp via the TcpWindowSize parameter in the registry for TCP/IP's parameterizations...
Again - Thoughts/Feedback on these replies/points? Thanks for your time...
APK
P.S.=> BOTTOM-LIN
Oh, wait...
There's no failure quite as dissatisfying as a complete and total solution to the wrong problem.
> I don't understand why they're dragging their feet, as sooner or later something
> installs a listening service (or the user already has such a service) and it's over.
The reason why MS is dragging its feet is that by not patching MS Windows XP/v5 there will be less of a reason for users to not move onto MS Windows v7.
If you'd have read the bulletin, you'd have seen that remote code execution was not one of the possibilities for the bug in XP or Win 2k.
It's tiring to see this flimsy assertion repeated throughout this topic. Another poster has already shown (note 2nd citation) why DOS vulnerabilities such as these should not be treated lightly.
Before you (or anyone) responds that MS could patch it after it becomes a more serious vulnerability, there are two problems: MS has asserted that a patch is not feasible - they'd have to do a lot of work (implying a significant delay) to mitigate it; MS has announced that a published vulnerability will not be patched on a widely deployed platform, effectively inviting malware authors to attempt to turn a non-critical DOS vulnerability into a remotely exploitable vulnerability, preferably (from the malware author's POV) a zero-day exploit - and the opportunity is especially attractive because MS asserts that a patch is not feasible.
- T
Where are they getting this 15+ year number from? XP was released almost exactly 8 years ago to the month.
RFC1323 - TCP Extensions for High Performance: -> http://www.faqs.org/rfcs/rfc1323.html
Specifically, as regards "Window Scaling", & these pertinent quotes (& how Tcp123Opts = 0 shuts off ALL of these hi-performance TCP/IP options (slower, but sounds like a safety measure vs. this setsockopt 0 "silly windows syndrome" attack))
Please, read on:
"The window scale extension expands the definition of the TCP window to 32 bits and then uses a scale factor to carry this 32-bit value in the 16-bit Window field of the TCP header (SEG.WND in RFC-793). The scale factor is carried in a new TCP option, Window Scale. This option is sent only in a SYN segment (a segment with the SYN bit on), hence the window scale is fixed in each direction when a connection is opened
(Note that LAST bolded statement? THAT only "holds true", IF these RFC1323 options are 'turned on', first of all, & what turns them COMPLETELY off (@ the price of performance, perhaps, but not of safety vs. this "sliding windows scale/sliding windows/silly window syndrome" attack? Tcp1323Opts does))
http://www.speedguide.net/read_articles.php?id=157
Tcp1323Opts is a necessary setting in order to enable Large TCP Window support as described in RFC 1323. Without this parameter, the TCP Window is limited to 64K.
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Tcp1323Opts="1" (DWORD, recommended setting is 1. The possible settings are 0 - Disable RFC 1323 options, 1 - Window scaling but no Timestamp options, 3 - Window scaling and Time stamp options.)
Like SynAttackProtect = 2?
Tcp1323Opts = 0 "turns off" the ability to use "scalable windows" that RFC1323 allows, & which it appears that this setsockopt 0 command exploits, via the "Silly Window Syndrome"...
So, by setting them properly against this attack, by altering them, here -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters accordingly.
http://msdn.microsoft.com/en-us/library/aa302363.aspx
PERTINENT QUOTE -> "NOTE: The following socket options no longer work on any socket when you set the SynAttackProtect value to 2: Scalable windows"
You can nullify this attack it seems, because SynAttackProtect = 2 AND Tcp1323Opts = 0 (& using a set TcpWindowSize also) can stall out "sliding/scaling TCP Window Sizes", which this attack seems to exploit a vulnerability of via setsockopt 0 calls...!
APK
P.S.=> See my point now? Using Tcp1323Opts = 0, SynAttackProtect =2, & setting a TcpWindowSize to 64k (or whatever)? This setsockopt 0 type DOS/DDOS attack may be nullified it appears, because "sliding windows/tcp scaling" doesn't even take effect anymore, & this "setsockopt 0" seems to exploit it, via the "silly window syndrome" here -> http://www.tcpipguide.com/free/t_TCPSillyWindowSyndromeandChangesTotheSlidingWindow-4.htm
PERTINENT CONCEPT QUOTE -> "Key Concept: Modern TCP implementations incorporate a set of SWS avoidance algorithms. When receiving, devices are programmed not to advertise very small windows, waiting instead until there is enough room in the buffer for one of a reasonable size. Transmitters use Nagles algorithm to ensure that small segments are not generated when there are unacknowledged bytes outstanding."
Which, per the setsockopt 0 call & parameter?
Does sound a LOT like this problem is, via setsockopt 0 calls issued by an attacking malware to exploit this for DDOS/DOS attacks!
Hope you see my point... &, again, I'd like your "Feedback/Thoughts" on this as well - Thanks for your time, because I am trying to figure out a way, hopefully, to stall this attack on Windows 2000 rigs (I h
MS08-048 fixes three vulnerabilities. The vulnerability that can result in a system compromise is CVE-2009-1925 and ONLY AFFECTS VISTA. The other two, CVE-2008-4609 and CVE-2009-1926 are denial of service attacks against listening services with no possibility for remote code execution.
Microsoft is basically saying that since 2000 and XP are only subject to a possible DOS of listening services, and are not intended as servers that the issue is not worth fixing. This would not be the first DOS only type of vulnerability that Microsoft has downplayed. They did however develop a patch to address their products that are intended as servers. Note that according to the MS KB article the patch does not eliminate the DOS vulnerabilities, but alleviates it by tweaking the algorithm used to drop open connections.
It's also not clear to me, but it may be possible to address this issue by setting some of the settings in the registry that control the max number of half-open connections (turned off by default in the usual MS way).
Ah, you see - the programmer who originally wrote the code in question - and who is the only person who can grok it's convoluted mess, has been fired.
Or perhaps, they lost the backups with the original source code, and so would have to rewrite it from scratch - which they also don't want to admit to....
So many possibilities - mostly all embarrassing to MS because they underline the nature of MS's corporate culture of protecting the incompetent.
Here's more ammo - Microsoft offers a fix for Windows Server 2003 which is based on many of the same core components as Windows XP.
I noticed this as well, specifically on x64. From everything I've read, XP x64 is essentially 2003 x64 with some branding and defaults changed - even closer than the x86 variants of XP and 2003.
The 2003 x64 download is actually named WindowsServer2003.WindowsXP-KB967723-x64-ENU.exe, and appears to have installed just fine. I haven't rebooted yet, but I don't expect any issues based on what I've seen so far.
open source it so that people can fix bugs themselves.
The largest prime factor of my UID is 263267.
There are issues with security and governmental banking regulations that will not allow windows 7.
Care to elaborate? I work in IT at a bank and we're currently in the process of testing out Win7. I don't work directly in the Compliance department obviously, but I've not heard anything even remotely like this mentioned.
I'm now running version 5.2.3790.4573 of tcpip.sys, and TCP/IP appears to be working for me... You may be able to simply copy the DLLs over in x86 as well (possibly in Safe Mode or with a BartPE CD) if the actual installer won't do it.
Wouldn't using Tcp1323Opts = 0 & SynAttackProtect = 2 work to stop "silly window syndrome" & 'scaling/sliding windows' in TCP/IP per RFC1323 "High-Performance TCP/IP features" it implements?
Think about this, & comment please:
1.) This DOS/DDOS attack utilizes an API call with a 0 window size parameter -> setsockopt 0
----
2.) TCP "Silly Window Syndrome" and Changes To the Sliding Window System For Avoiding Small-Window Problems - which is what this attack sounds as if it is exploiting:
KEYWORD = SLIDING WINDOW SYSTEM (for TCP/IP) -> Tcp Scaling
http://www.tcpipguide.com/free/t_TCPSillyWindowSyndromeandChangesTotheSlidingWindow-4.htm
PERTINENT CONCEPT QUOTE -> "Key Concept: Modern TCP implementations incorporate a set of SWS avoidance algorithms. When receiving, devices are programmed not to advertise very small windows, waiting instead until there is enough room in the buffer for one of a reasonable size. Transmitters use Nagles algorithm to ensure that small segments are not generated when there are unacknowledged bytes outstanding."
Which, per the setsockopt 0 call & parameter?
Does sound a LOT like this problem is, via setsockopt 0 calls issued by an attacking malware to exploit this for DDOS/DOS attacks!
----
3.) SynAttackProtect, here -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters STOPS TCP WINDOWS SCALING, per this MS article on it:
http://msdn.microsoft.com/en-us/library/aa302363.aspx
PERTINENT QUOTE -> "NOTE: The following socket options no longer work on any socket when you set the SynAttackProtect value to 2: Scalable windows"
-----
4.) Tcp1323Opts, here -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters STOPS TCP WINDOWS SCALING - This also turns off the RFC 1323 "Hi-Performance TCP/IP" options like "Scalable Windows" (sliding Windows noted in "silly window syndrome") also, & though you may go slower, you would be safer on a Windows 2000 machine because of it no longer allowing the TcpWindowSize to be reset by this attack (that uses that to its advantage via setsockopt 0).
http://www.speedguide.net/read_articles.php?id=157
Tcp1323Opts is a necessary setting in order to enable Large TCP Window support as described in RFC 1323. Without this parameter, the TCP Window is limited to 64K.
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Tcp1323Opts="1" (DWORD, recommended setting is 1. The possible settings are 0 - Disable RFC 1323 options, 1 - Window scaling but no Timestamp options, 3 - Window scaling and Time stamp options.)
Like SynAttackProtect = 2? Tcp1323Opts = 0 "turns off" the ability to use "scalable windows" that RFC1323 allows, & which it appears that this setsockopt 0 command exploits, via the "Silly Window Syndrome"...
----
Thus, if you have a 'hardcoded' TcpWindowSize in the registry, & one set to a PRE-DEFINED value/size, & "sliding window sizes" for TCP are 'turned off' by SynAttackProtect = 2 and Tcp1323Opts = 0? The ability to use setsockopt 0 (which seems to exploit "scaling windows"/"sliding windows" per "Silly Window Syndrome", which this seems to exploit) should, in theory, be utterly nullified.
APK
P.S.=> I can't think of anything better than this but the evidence above tends to show that IF you use SynAttackProtect = 2 (which works vs. types of DOS/DDOS attacks, as is) and Tcp1323Opts = 0 which STALLS "SLIDING WINDOW SIZES" (Tcp Scaling in other words), then, this attack (which seems like it is using the "Silly Window Syndrome" per the above) cannot work...
(As "setsockopt 0" cannot reset/renegotiate the TcpWindowSize & the sy
But if you run any listen program like bittorrent, filesharing, remote access, itunes's fucking searching thing or whatever. you will have listening ports open. So microsoft is just fucking with you. They should release a patch, and not say see it works just don't you know use a basic OS feature like listening for incoming TCP connections. What's next no patch because most computers are behind a NAT router. Memory leak not fixed because no body runs a computer for more then a month.
I can't cite direct examples because I don't even know which bank you work for, but if you understand how banking TLS requirements go, it's kind of like that.
This stinks. A critical part of windows becoming unsupported.
What goes around comes around, I will remember that.
"Life is short and in most cases it ends with death." Sir Sinclair
Hahaha Urinal. Nice to see that apk's security guides like this one have put a dent into your malware and botnet business with the infamous RBN, Ukie boy:
http://www.tcmagazine.com/forums/index.php?s=59a1733cda9711d7bb0c2f0b1da8e2ab&showtopic=2662
You're only showing your hand on this one. I use his guides and hosts files and I never get taken advantage of by the likes of your kind anymore because of him. It is very obvious you have taken a beating from apk before either in technical debate or because of your botnets being disabled and crippled one by one as more people do as I have done and applied apk's security guide points and hosts file versus scum like you. Trash like you deserve every second of it and the same thing is being done by online scum like you have done here to apk http://twitter.com/klastalov/status/200124793 where you said quite classlessly he could suck your sweaty cock. Small cock should have been added. Improve your English you foreign reject and improve your way of making money because you ukes have done the same to Dancho Danchev of ZDNET with his Ukranian fanclub he notes here http://ddanchev.blogspot.com/2009/09/ukrainian-fan-club-features.html and that is about all scum like you have is your online putdowns after people like Mr. Danchev and apk get through with you by blowing away your botnets and informing others online about them and how to stop them. Too bad you are too stupid and illiterate to make a living honestly and instead have to prey on grandma types online as online trash like you do. The part that makes you completely stupid is that you are obviously modding yourself up also which fools no one, you foreign moron. Go home to the Ukraine scumbag. You're not wanted here.
If you're sick of Microsoft, and Windows, then take a look at http://broken-windows.org/ and join our movement to help people get rid of Windows for good.
There isnt even a formal "joining" process. Just get to it!
I think you need to familiarise yourself with TCP stacks a bit more, and stop banging on keys and smashing registry settings in hopes of solving something that isn't an issue anyway (see other Slashdot posts with regards to the vulnerable service in question being disabled by default starting with XP SP2). I'm glad to see your brain is working/churning about this, but more experience is needed
Get your brain churning on reading comprehension because the other ac apk spoke of the Win2K issue of non patching from Microsoft, not XP.
See my subject-line above, "Yuri Klastalov" (which I severely doubt that that is your true/real name anyhow): I read this -> http://www.google.com/search?hl=en&q=%22Alexander+Peter+Kowalski%22+and+%22Yuri+Klastalov%22&btnG=Search and saw via cached copies of it as to where you want me to "suck your sweaty cock" online, from twitter, & was wondering to myself just exactly who you are, &/or how I know you (if I do at all) online etc. et al.
Sorry to disappoint you: I am NOT a homosexual, so the cock sucking stuff you wrote on twitter?? It's NOT going to happen. Find yourself another dish Yuri - I'm NOT on the menu, so-to-speak.
My personal guess is, is that I do not know you @ all personally (and you post as AC or under assumed guises constantly online), thus, I do not know your name.
Fact is?
(Nobody does, & this is why nobody EVER WILL - you're a "NOTHING", a "NOBODY", & your very actions guarantee this for you. I suppose you see some benefit by being a jerk to others online, but you don't apparently realize that all that gets you is wasted time on your part, with no real benefit to you, or yours).
Hope you're happy with the result.
APK
P.S.=> On the statements here about Dancho Danchev & his "UKRANIAN FANCLUB"? Yes, that might be a possibility, because I put up the "command & control servers" domain nanmes/hostnames of them all for "normal folks" online after I got wind of them, via Mr. Danchev's fine research, & I spread it to others... perhaps this "Yuri Klastalov" is one of their crew, or perhaps not, but it is not out of the realm of possibility he is one of them. Either way, I know I did the right thing & tough for he & his if they do not like it. Period.
If however, that IS the case in fact & Mr. Urinal with no Klass (a pisspot in other words, lol) is a member of the RBN?
Well, judging by his reactions here and on twitter more importanty? MY actions have apparently helped "floor" the RBN (Russian Business Network), which is a GOOD THING! I don't take kindly to slime that takes advantage of those weaker or less informed than they are, so it was "time to inform the masses" & it seems to have worked (argue with the results, in other words - the RBN? HISTORY - "gone with the dawn", baby)... apk