Slashdot Mirror
Microsoft Finally To Patch 17-Year-Old Bug
eldavojohn writes "Microsoft is due for a very large patch this month, in which five critical holes (that render Windows hijackable by an intruder) are due to be fixed, in addition to twenty other problems. The biggest change addresses a 17-year-old bug dating back to the days of DOS, discovered in January by their BFF Google. The patch should roll out February 9th."
Is this a record(for a bug that's "known about" anyways?
How in the world can a bug exist for 17 years when they've released so many versions of Windows in that time? Hasn't the kernel been revamped three times? (Win98/ME, WinNT/Win2K/WinXP, Vista/7)
I do not fail; I succeed at finding out what does not work.
Wasn't Windows NT developed from the ground up separately from DOS? If it's developed separately from DOS (no copy and paste), would it really have the same bugs as DOS (for all intents and purposes an unrelated operating system). This feels like to me Microsoft fixing an error that has been around ever since Linux...
This is a rather odd story to drop into the Slashdot cycle on a Friday Night (East Coast USA), it's basically just a warning that the typical Patch Tuesday (Second Tuesday of every month) is next week and the typical 0-day bugs that will be fixed which leads to the "bad guys" finding out what the bug was and deploying their attacks in the next few days.
This really is a notice to the IT guys and people who don't have automatic update downloads installed... nothing newsworthy or out of the normal cycle of things.
Tavis disclosed the ntvdm vulnerability in January, however it was reported to Microsoft on June 12, 2009.
http://lists.grok.org.uk/pipermail/full-disclosure/2010-January/072549.html
ms bash?
A bug no one knew about is being patched a month after it's found. WTG ms?
News for nerds? Or news for those that line your coffers?
As opposed to ?
Best F'ing Friend?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
17 year old bug and a 14 year old kid reading about the bug(that doesn't effect me btw)
epic sig..... ya i got nothing
Remember that BSD bug that sat around for about the same length of time? Yeah, it happens everywhere.
Of course, this is only a bug that can be exploited by 16-bit programs and only on 32-bit Windows. Since I run neither of those, it's not even a problem for folks like me.
Let's call it the Cicada bug.
A Cicada has a life-cycle of 17 years.
Now Microsoft is about to squash it.
You seriously have no idea what you're talking about. But enjoy being ignorant and naieve about things like this, because problems alike do not exist for other OS's, only in Windows.. right?
Touche, however I should have mentioned that I was mainly referring to microsoft waiting to release their patches until "Microsoft Tuesday", whereas linux releases patches as soon as the fix is discovered
You mispronounced "so unused that it took 17 years to find."
Isn't it a little disingenuous to say "finally" when the bug was discovered last month?
That it was introduced 17 years ago doesn't mean that Microsoft has been tardy about fixing it...
"We are not the streamlined, small, hyper-efficient kernel I envisioned 15 years ago. Our kernel is huge and bloated. Whenever we add a new feature, it only gets worse." -- Linus Torvalds, September 2009.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
And then you wait till whenever your distro updates the kernel, and that's if you are bleeding edge. Otherwise, you wait for backports. It's probably fast enough, but there's no guarantee you get it the day of.
[putting on anti-grammar Nazis hat]
Isn't that supposed to be "miswrote" instead of "mispronounced" since 1) I didn't verbally say anything and 2) I very much doubt you could hear me without being in the same room.
[taking off anti-grammar Nazis hat]
Just pointing out that "Microsoft's BFF, Google" deserves a placement in internet culture
So now you realize your argument failed you try fixing it with a different approach?
Look up the list of unpatched vulnerabilities found in your own OS on securityfocus and realize how even this argument fails.
You clearly don't understand the thorough testing some patches go through before they go live. Besides, severe security issues are patches outside the patchcycle on a regular base.
This is excellent news for Digital Research! With these latest patches, DR-DOS can finally run the latest version of Windows without any spurious error messages. This is a great day!
That's really going to screw up their average response time numbers...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
It was reported to M$ in June 2009.
To be honest, it doesn't sound that dangerous if it took that damn long to figure it out. Now it is, but its getting patched. Question here is, did anyone know about it before and abuse it while keeping tight lips? If so, they may really pissed to know its done.
"They confiscated everything, even the stuff we didn't steal!"
BFF, how cute...
eTrade SUCKS
"Just reported in a public way" != "Just discovered"
Bugs reported in a private way to microsoft could take months to be fixed or disclosed (i.e. the recent IE6+ bug that enabled intruders get into google and other companies recently were reported 4-5 months ago).
And of course, the bad guys dont report bugs, they exploit them. And people could find (or not) that something weird is happening when is already too late.
Yet another reason I avoid Windows and run for the hills with my linux box, if Windows was patched in a timely matter instead of being vulnerable for weeks, months, 17 years or when the media s**ts their pants, then I just might look at using it.
A.) You don't understand what really happened here. You should read the +5's in this thread before reading the next part of my post.
B.) There is absolutely nothing preventing Linux or anything else from having a problem like this. In fact, this is quite the cautionary tale for anybody running a computer. Your computer has a number of exploitable bugs in it right this second. Your machine is not safe. You need to install updates. You need network protection, firewall, etc. You need to make backups. You need to not run every executable you find from un-trusted sources. You need to use good practices when dealing with sensitive data. Running Linux, BSD, OSX, whatever, doesn't alleviate any of these concerns.
C.) Summaries often contain more information than the headline does. They also usually have links you can click on to get even more info.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
If I remember correctly, as far back as NT 4.0 NSA Security Guidelines recommended removing the 16 bit MS DOS subsystem. I believe it is also absent in 64 bit Windows 7. I wonder about 64 bit XP & 64 bit Vista.
Who will guard the guards?
That 16 bit shit will come and get you if you don't pay attention.
I'm here for the experience, not the Hyperbole.
that sci-fi yarn where the mad programmer unleashes a bit of code that squirrels around the net for fifty or a hundred years, unnoticed by anyone, and when the programmer dies it unleashes the programmer's hate and fury upon the world, and no one is able to stop it even though computer's are a million times more complex and powerful than when the program was originally written? That could work?
Awesome.
Prisencolinensinainciusol. Ol Rait!
I believe it is also absent in 64 bit Windows 7. I wonder about 64 bit XP & 64 bit Vista.
The 16-bit subsystem is absent in all 64-bit versions of Windows.
While I'm not positive, my understanding is that this has to do with the CPU not running 16-bit code when in 64-bit mode or something like that, but don't quote me on that. I know VMWare can run a 64-bit guest on a 32-bit host and vice versa, so this can't be the whole story; perhaps VMWare changes the processor's mode between 64-bit and 32-bit when doing a world switch or something like that, and MS doesn't want to do that in order to keep around the 16-bit subsystem.
Windows Bugs get younger every year
No, That's Windows 7 by itself. Office is 3GB extra.
The cited DSL fits in 64MB, all things included.
Damn Small Linux is small enough and smart enough to do the following things:
It includes three browsers, document processing, email, spreadsheet, VOIP, and a lot more.
The smallest pendrive I've ever heard of is the 64MB USB 1.0 device I'm holding in my hand right now that I bought my wife more than a decade ago. I paid $79 for it at Fred Meyer, because tech stores wouldn't carry it. Actually, there were 16 and 32MB versions of this, but let's not go there because this was the Windows 95 era.
I am on the record as stating that we've had no productivity increases since the advent of Windows. Let me quote from a wise man:
"Word processing was a solved problem in 1984. By 1987 spreadsheets had all the functions a normal person would ever use. Databases took a little longer, but by 1990 that was sorted. An infant could have been born that day and by now would be almost of age to vote and we've seen no real improvement in productivity since."
64MB is 0.32% of 20GB.
So let me ask you: If the Office team needs 3,000 MB to install their full application set, what can they do with 30MB - 1% of that? Splash? Can they even do that?
Help stamp out iliturcy.
Actually the canonical term for this meme is "misspelled".
The Tao of math: The numbers you can count are not the real numbers.
Can they mod it to oblivion before I burn up all my Karma? We shall see.
Help stamp out iliturcy.
Possibly; I was going off a meme at our lab that originates from one person saying something negative, and the other responding "you mispronounced 'awesome'."
Aikon-
....and YOUR Slash number has six digits. Mine has five. See? I can count backwards! :)
I've been using Linux since kernel version 0.99pl10, when Slackware ruled on a couple dozen floppies.... ...and get off my lawn!
When politicians are involved, everyone loses.
Sure there is. Open source software has maybe thousands or tens of thousands of people looking at the source code for security issues. Microsoft has maybe hundreds?
Security by obscurity isn't secure.
If Google was their best friend forever, a future Google employee would invent a time machine, go back to the 1990s, and alert Microsoft of the bug. Since we know that won't happen, it makes me doubt the level of friendship between Google and Redmond when Google invents the time machine.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Yeah? Well my dick's smaller than yours!
What does his choice of words have to do with grammar?
My Windows 7 is scaring me more and more these days, that's the last thing I needed! 17 Years? Well Microsoft, looking forward for a reason not to go Open Source with my software.. Moving to Ubuntu.
This round of the The Tanenbaum–Torvalds debate on kernel architecture seems to be a self-administered blow from Linux to himself.
Jus' sayin'.
If you mod me down, I shall become more powerful than you could possibly imagine.
Rats. I meant to call him "Linux Torvalds" only in the subject line, as a bit of humor. Mr. Linus Torvalds delivered the knockout blow, to himself, of course.
If you mod me down, I shall become more powerful than you could possibly imagine.
Apparently your Slashdot ID doesn't make you any smarter.
But what I was getting at was perhaps if Linux chose a more modular design like a Microkernel, it would be less bloated.
Although it was in jest, as I think if they chose a Microkernel it would probably have ended up like Hurd and I'd be typing this from a Mac.
I need to track down John Titor so I can test my hypothesis.
Mod me down, my New Earth Global Warmingist friends!
They're making money like a drunken sailor. I.E. they don't have any more today than they did yesterday because they spend it as fast as it comes in. This has been true for a decade.
Help stamp out iliturcy.
And that's completely preventing an exploit that was created years ago from being found?
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
A wrong word choice can change the meaning of the sentence. Grammar is about writing clear sentences.
2) I very much doubt you could hear me without being in the same room.
Well, apparently there's this exploit in the wild....
People replying to my sig annoy me. That's why I change it all the time.
That's great that you can count. Now lets see if you can subtract ;-)
Number of users between me and binarylarry: 1186880
Number of users between me and binarylarry: 1326989
Number of users between you and me: 140,109
See the difference?
Ummm... Check your data again. You got two different numbers between yourself and BL... :D
(I think you meant the second line to be between ME [Timex] and BL.)
When politicians are involved, everyone loses.
32-bit lives?
Backwards-compatiabiliy [sic] makes me sad.
===============
Why on earth would we want to run our 32-bit apps written last year when they could be compiled as 64-bit?
HINT: There's a lot of old code out there that 1) works as it should, 2) the company that wrote it no longer exists and the source-code is gone.
Windows 3.1x calc: 3.11 - 3.10 = 0.00
Grammar is about the validity of sentences. Two sentences that mean different things can both be grammatically correct. Perhaps you're thinking of semantics?
that's what she said. (?)
Now hopefully MS will finally patch that one problem in Windows, where it's a big bloated pile of shit.
Almost too easy.
I am not devoid of humor.