Slashdot Mirror
Microsoft Says No TCP/IP Patches For XP
CWmike writes "Microsoft says it won't patch Windows XP for a pair of bugs it quashed Sept. 8 in Vista, Windows Server 2003 and Windows Server 2008. The news adds Windows XP Service Pack 2 (SP2) and SP3 to the no-patch list that previously included only Windows 2000 Server SP4. 'We're talking about code that is 12 to 15 years old in its origin, so backporting that level of code is essentially not feasible,' said security program manager Adrian Stone during Microsoft's monthly post-patch Webcast, referring to Windows 2000 and XP. 'An update for Windows XP will not be made available,' Stone and fellow program manager Jerry Bryant said during the Q&A portion of the Webcast (transcript here). Last Tuesday, Microsoft said that it wouldn't be patching Windows 2000 because creating a fix was 'infeasible.'"
The U.S. Navy's and Marine Corp's NMCI computing infrastructure is all Windows XP. Let's see whether or not Microsoft withholds a patch from them.
It is unclear how large a threat this is to the end user. However the fact that XP is being loaded on netbooks suggests that Microsoft has a revenue stream that it should protect by writing a patch if it is serious.
Facts are history now plebs have politics for religion on social media.
"not feasible"
yeah right, more like MS wants people to move onto Windows 7
That's unpossible!
This sig left unintentionally blank.
So, basically, upgrade or you'll be hacked?
Two questions:
1. Does 7's XP mode potentially have this issue, or is there a compatibility layer so xp doesn't talk directly to the network?
2. They seemed to be able to make massive security updates for code that was that old, and still patch a number of other issues. What about this REALLY makes it so hard to code?
In the end, while I understand not wanting to waste resources on way older products, I think it is a marketing move.
How very serendipitous for Microsoft, people now have a reason to upgrade from XP.
I ran W2K on my desktop until a couple of years ago, i.e. until the patches stopped coming W2K did everything I needed.
Guess I'll have to consider Win7 now...
well, that's one of the positive aspects of the open source code. If the main developer doesn't want to fix something, then someone else can do it.
Isn't the codebase for XP and Windows 2003 essentially the same? Why can't the 2003 patch be modified? I don't remember reading that the TCP/IP stack was that different in 2003.
While the code may very well be 15 years old, that does not really matter to the user. What matters is how long ago Microsoft sold the product. If they sell software today that uses some code written 15 years ago you should be able to expect security updates for some period of time. Now, had they decided not to patch software they haven't sold in 15 years that would be totally OK.
MS hate aside, they're just doing what they've always done. We don't get our panties in a knot when they don't release a Win 98 patch, do we? With Win 7 on our doorstep, there is no reason for MS to be supporting three separate OS. Well, aside from customer service. I just sort of shrug my shoulders and deal with it. Anyone running XP knows they're doing it because Vista/7 don't appeal to them; deal with the consequences.
The same two bugs were ranked "moderate" for Vista and Server 2008, while a third -- which doesn't affect the older operating systems -- was rated "critical."
Yes, it's easy to take the "We won't be backporting this fix" stance when the old OS isn't vulnerable in the first place.
For some unfathomable reason, MS rates remote code execution as a LOW impact problem for XP.
And somehow, the TCP stack, perhaps the most modular and with the most well-defined interfaces, can't be replaced wholesale.
This makes no sense, unless they're trying to get people to spend $$$ on moving to "Windows 7",
or as the congnoscenti call it, "Vista SP2".
ooooohhh.....
Since XP is still being shipped and supported on netbooks this seems a little strange. What's the message - spend extra on memory and hard drive so that you can run XP instead of Linux but we won't give you security patches?
In other news... 10 year old Linux 2.4 kernel patched yesterday...
A new car built by my company leaves somewhere traveling at 60 miles per hour. The rear differential locks up. The car crushes and burns with everyone trapped inside. Now: do we initiate a recall? Take the number of vehicles in the field (A), multiply it by the probable rate of failure (B), then multiply the result by the average out-of-court settlement (C). A times B times C equals X...
If X is less that the cost of a recall, we don't do one.
Loading...
...we lost the source code, we kept it in Microsoft Source Safe and it ate it.
Do daemons dream of electric sleep()?
The U.S. Navy's and Marine Corp's NMCI computing infrastructure is all Windows XP. Let's see whether or not Microsoft withholds a patch from them.
Since 2008, the US Navy will acquire only systems based on open technologies and standards. That excludes M$ products explicitly in every way but name. The TCP/IP being just one example of failure on M$ part to implement standards. US Navy is ditching M$.
They'll probably go with an American company like Red Hat or roll their own spin of Red Hat.
The question remaining is will Bill's father's political connections keep lil Bill out of Camp X-Ray or not? If you've got Windows on your network, then you have a personnel problem, not just a network security problem.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
The true cost of releasing a patch is not in compiling and distributing the fix. The money is spent on verification. By not releasing the patch to XP and w2k my estimates are that Microsoft is saving man-years in verification.
Break the sound barrier - bring the noise.
There is really no reason for XP on a netbook any more. You aren't using it a high end gaming platform. You aren't running Adobe Creative stuff on it.
You are using it to run FireFox, edit documents, read, IM and send email.
Linux has all that covered and is even document-compatible with Windows.
I have a Eee 900A with a 32GB SSD in it running Xubuntu and I connect to a corporate Radius network, bluetooth tether to my phone, and even use the web version of outlook on it to get at calendars.
Flash even works.
The only thing I can't do that would be nice is play Netflix movies as the Moonlight package does not have DRM in it (and likely never will.)
Dog is my co-pilot.
The DOS/DDOS possible via the latest weakness in Windows 2000's IP stack @ least (uses RDR20.DLL as the LSP (layered service provider) vs. MSWSOCK.DLL (the LSP used in XP/Server 2003 onwards, by way of comparison, & this is where I think the problem lies largely, as it is the "most radically different part" of the IP stack in Windows 2000 vs. the more current builds of Windows that I could see @ least)?
WELL - That's taken care of by the SynAttackProtect setting here -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
What does it do??
http://msdn.microsoft.com/en-us/library/aa302363.aspx
Description: When SynAttackProtect is enabled, this value specifies the threshold of TCP connections in the SYN_RCVD state. When SynAttackProtect is exceeded, SYN flood protection is triggered.
TcpMaxPortsExhausted
TcpMaxHalfOpen
TcpMaxHalfOpenRetried
Also have to be considered as well (these determine how long before SynAttackProtect "kicks in", vs. the DOS/DDOS attack that could occur)
This SynAttackProtect registry value causes Transmission Control Protocol (TCP) to adjust retransmission of SYN-ACKS. When you configure this value, the connection responses time out more quickly in the event of a SYN attack (a type of denial of service attack).
2: Set SynAttackProtect to 2 for the best protection against SYN attacks. This value adds additional delays to connection indications, and TCP connection requests quickly timeout when a SYN attack is in progress. This parameter is the recommended setting.
NOTE: The following socket options no longer work on any socket when you set the SynAttackProtect value to 2: Scalable windows
-----
IIRC? This is called the "Silly Window Syndrome", & this is a way, in theory, around it... & iirc, "Scalable Windows", via setsockopt API calls from an attacker are what the problem is here anyhow & this ought to 'stall it'... thoughts/feedback?
APK
P.S.=> Also, "hardcoding" the TcpWindowSize & GlobalTcpWindowSize settings in the registry in TCP/IP Parameters (see registry path above) SHOULD also help here also, for servers that can accept MANY connections from MANY clients, worldwide, as your specific constraints specify...
Thus, effectively stalling the ability to use TcpWindowScaling is stopped by SynAttackProtect too, so an attacking system/app sending a setsockopt of 0 for this SHOULD also be nullified, on a server also...
(However/Again - Workstations are easily taken care of , vs. servers, just by what I wrote up above either by PORT FILTERING)
IP Security Policies, which can work on ranges of addresses to block, OR, single systems as well you either ALLOW or DENY to talk to your system, still can help also... vs. a DDOS though? SynAttackProtect is your best friend here... you'd use netstat -b -n tcp to see which are held in a 1/2 open SYN-RECEIVE state, & BLOCK THOSE FROM SENDING YOUR WAY (or just by doing it in a router or routing table)... takers anyone, on these thoughts (especially for Windows 2000)?
Thanks for your time... apk
I guess these guys did not read: http://support.microsoft.com/gp/lifepolicy XP extended support goes thru 2014 and supposedly covers security fixes. I would think this counts as a security fix.
Conservative, mod down for violating
Why not? The Pentagon continued using Halliburton for years, on huge no-bid contracts, even when its divisions were installing showers in Iraq that electrocuted our servicemembers. And that's just the worst failure the public heard about, after most of a decade of abusive cronyism.
Microsoft is much richer than even Halliburton, and its failures much less publicly scandalous. Why would it face a tougher standard? I'm sure Dick Cheney owns a lot of Microsoft stock, too.
--
make install -not war
Today GM announced that the GMC trucks have some fundamental flaw and they are prone to explode randomly. GM said it wont fix the issue because the design is very old, and fixing it is unfeasible. When asked if they will when they stopped shipping trucks with the fatal flaw, GM spokesman said, "we have not stopped building or shipping them yet. We need to compete with the low cost competitors in the net-truck market and so we continue to make and ship the trucks, but we wont fix the safety issue. The drivers may wrap themselves in bags filled with thermocol peanuts to get some measure of protection.
If not, why do we let Microsoft get away with it?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Alex P. Keaton is an MCSE? Is there anything that guy can't do?
Microsoft Corporation has announced a limited one-off extension of availability of its Windows XP operating system to April 2101 after criticism from large customers and analysts. This is the fifty-sixth extension of XP's availability since 2008.
Through successive releases of Microsoft's flagship Windows operating system, demand for XP has remained an important factor for businesses relying on stable XP-specific software and installations, who have pushed back strongly against the software company's attempts to move them to later versions. Windows administration skills have become rare in recent years and consultants have demanded high fees. Reviving Windows administrators from cryogenic freezing has proven insufficient to fill the market gap, as almost all begged to work on COBOL instead.
"Windows XP is currently in the extremely very prolonged super-extended support phase and Microsoft encourages customers to migrate to Windows for Neurons 2097 as soon as feasible," said William Gates V, CEO and great-grandson of the company founder. "Spare change?"
Microsoft Corporation, along with Monsanto Corporation and the RIAA, exists as a protected species in the Seattle Memorial Glass Crater Bad Ideas And Warnings To The Future National Park in north-west Washington on the radioactive remains of what was once the planet Earth, under the protection of our Linux-based superintelligent robot artificial intelligence overlords. Company revenues for 2098 were over $15.
illustration: A background wallpaper for your insecurable XP desktop. (Anyone got a pointer to the 1024x768 version?)
http://rocknerd.co.uk
Best Buy's recent "training" slide #9, where they say that "Linux is safer than Windows" is a myth, the "Real Facts" states (referring to Linux) 'There's no guarantee that when security vulnerabilities are discovered, an update will be created. Users are on their own.'
Here's proof that that statement is really talking about Windows...
I say give 'em a month, tops, and then there will be a patch (or news of a coming patch) for Windows XP.
Now would be a terrible time for Microsoft to alienate all those big corps that have XP and force them into another OS, if they want to keep their customers.
It'd be great for everyone else, as customers may start looking into things they would never have considered otherwise, such as various open source operating systems, and the necessary apps it would take to keep them going in their workflow, post-transition.
The way it looks is, some people (usually companies) will view this as a threat from Microsoft that reads: "Upgrade if you want protection."
Some of them in this group will obediently upgrade to Fista or 7.
Some of them will reluctantly upgrade to Vista or 7.
Some of them will stay with XP and find other ways to secure themselves.
Some of them will [cross their fingers and hope|pray] that Microsoft changes their mind and offers a patch.
Some of them will be offended and migrate to another OS outside of Big Red Robotland.
And of course, some of them will feel that litigation solves everything, and want to take MS to court for "refusing to patch an OS that is in such widespread use" (or) "intentionally posing a security risk".
Refusing a patch like this, in my humble opinion, isn't something you want to do until a few months after your new OS lands, at the bare minimum. That way, you've already got people migrating.
XP's patching lifecycle isn't up yet, from what I can see here, though: XP SP2 should be good until July of 2010, and SP3 should be good a bit longer than that, so I'm surprised no-one has really called 'em out on that.
One of these days, I am going to flip out. When I flip out, I'll be back in five minutes.
1. Buy Netbook with Microsoft WIndows XP installed. ...
2. Run all updates.
3. Browse web, get hacked by this exploit. Lose money through "identity theft" / bank fraud.
4. Turn up in court with the receipt for the netbook & windows license stating when purchased, and the date and time Microsoft refused to patch the hole which caused your loss.
5. State that Microsoft is profiting from a product which is unsuitable for purpose, and it knows is unsuitable.
6.
7. Read Microsoft fine print and realise that you have to now give Microsoft your first born child for ever doubting that their asses are covered.
Yeah, consumer loses out on this one.
Finally had enough. Come see us over at https://soylentnews.org/
Dude, How often do you hear of Mac Viruses running rampant? The reason Microsoft has to constantly patch their crap is because it's terrible. Mac is much more solid and the whole issue goes away... You are showing your Microsoft-centric world view. In the Mac world, the need to constantly fix old mistakes just is not a problem. It's a non issue.
Please..all underlying architecture has not changed from xp to vista, even though they want you to believe this...and for them to correct the wrapper on xp, would be trivial, however, they are testing the waters about phasing out xp, and want to see what the backlash will be like, seeing as no one wants vista garbage, and maybe even no windows7!
I prefer, being given the opportunity of just paying a yearly fee to keep getting updates on a system that runs properly compared to their new bloated versions of vista etc... too bad no one can pick it up like a linux distro and start their own version of windows...
in other words:
it's the same feigned argument as when they refused to port DX10 to XP to boost Vista sales - uh - I mean it was because it's technically impossible... it's just that hackers ported it to XP later....
The MAFIAA is a bunch of mindless jerks who will be the first up against the wall when the revolution comes
Don't run an OS that you can't patch yourself. Seriously, if we put our trust in these guys after they've proven time and again that they really don't represent our best interests we are the only ones to blame. It's about time to let MS go gently into the night alone and without a sleeping bag into a rabid pack of wolves.
I don't believe in karma, I just call it like I see it.
And with Windows 7 returning us to the age of malformed-packet-inducable-BSOD, I'm doing everything I can to maintain XP as our platform over the next 2-3 years, including a final round of PC purchases with XP downgrade rights in place.
I use irony whenever I can, but my shirts are still wrinkled...
Because Apple stopped selling versions older than 10.5 nearly two years ago and the upgrade to 10.6 is thirty dollars retail. Microsoft is still selling XP licenses.
Can you be Even More Awesome?!
wrong analogy, you are focusing on the wrong issue. Real analogy: Do you still expect adobe to patch the latest versions of their software as long as they are in business? yes. What if they had a DLL that was affected in *all* versions. Do you expect them to patch it with the latest version? Hell yes you do. This is not a car warranty, so that argument is completely null. Things that are on XP cannot necessarily magically be "upgraded" like you think, additionally why should someone even feel remotely obligated to spend money on a new version of something that works just fine?
Car analogy: does the manufacturer shutdown their car after 10 years if you can keep it running?
Why should MS exclude one?
maybe you should think about the argument you are making, because it is off.
Apple's not a terribly good example here. You buy software AND hardware from Apple. That nice G5 you bought 5 years ago? No parts available from Apple anymore, sorry. Oh, and Snow Leopard's dropped PPC support so won't run on it. One thing Apple's never been is scared of breaking backwards compatibility.
The fix is to NEVER buy Microsoft products, again. Microsoft is a defective corporation that has made a mint off of selling knowingly defective products and reselling the HOPE that these defects will be fixed in the next update but reneging again, and again, and again, and again. MSFT's example of no/low quality has become the new American metric of quality, its business plan, corroding our society's business and work ethic, a complete mockery of the consumer laws on mechantability, deservedly debasing our reputation for quality goods.
Since the government has been ineffective in enforcing these laws, falling for MS legal theories, only insistent market rejection will [partially] protect a consumer from the borg. No doubt we will be seeing more FUD IP attacks, like SCO, traceable to MSFT. Good luck to all. Fsck MSFT.
Ah, a car analogy. It's more like this: You go to the Honda dealership and take a look at their 2010 models and purchase a vehicle. You discover that the engine has a serious flaw in it and ask Honda for a fix. Honda refuses because that engine is based on an 8 year old engine design. Except in this case, instead of a Honda you bought a brand new netbook and instead of an engine it came with a new copy of Windows XP.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
In the revised advisory, Microsoft explained why it won't patch Windows XP, the world's most popular operating system. "By default, Windows XP SP2, Windows XP SP3 and Windows XP Professional x64 Edition SP2 do not have a listening service configured in the client firewall and are therefore not affected by this vulnerability," the company said. "Windows XP SP2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network."
Interesting enough, if you are that concerned about security, then you probably already installed at least SP2. Which means that your XP box is NOT vulnerable to this type of attack. I guess computerworld needed a flashy headline to get some clicks and ad revenue.
Posting this way up here so people see it. Summary is mostly incorrect. From TFA: "In the revised advisory, Microsoft explained why it won't patch Windows XP, the world's most popular operating system. "By default, Windows XP SP2, Windows XP SP3 and Windows XP Professional x64 Edition SP2 do not have a listening service configured in the client firewall and are therefore not affected by this vulnerability," the company said. "Windows XP SP2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network."
Certainly not. Macs are made by humans. However, you must have lived on Mars the past decade to not notice the constant stream of viruses and other trojans that are so successful finding new exploits in the MS ecosystem. Though indeed problems do occur in the mac, they are on a vastly smaller scale than on Windows. So, though I did make an exaggeration by making an absolute statement, it does jive with reality. Having been a software developer professionally for 13 years and privately for 20, I stand by my assessment that MS makes crap.
The problem is that anything can install such a listening service on XP making it instantly vulnerable. That XP SP2/3 isn't vulnerable by default is a 'mitigating factor' in MS Security bulletin lingo, not a reason not to patch.
I don't understand why they're dragging their feet, as sooner or later something installs a listening service (or the user already has such a service) and it's over.
Never underestimate the relief of true separation of Religion and State.
The XP firewall is practically fucking useless to begin with. That still doesn't give them the right to jump out of a contractual support obligation 5 years in advance.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.