Microsoft Finally To Patch 17-Year-Old Bug
eldavojohn writes "Microsoft is due for a very large patch this month, in which five critical holes (that render Windows hijackable by an intruder) are due to be fixed, in addition to twenty other problems. The biggest change addresses a 17-year-old bug dating back to the days of DOS, discovered in January by their BFF Google. The patch should roll out February 9th."
How in the world can a bug exist for 17 years when they've released so many versions of Windows in that time? Hasn't the kernel been revamped three times? (Win98/ME, WinNT/Win2K/WinXP, Vista/7)
I do not fail; I succeed at finding out what does not work.
Tavis disclosed the ntvdm vulnerability in January, however it was reported to Microsoft on June 12, 2009.
http://lists.grok.org.uk/pipermail/full-disclosure/2010-January/072549.html
It's not a bug in DOS, but a bug in the NT virtual 8086 machine monitor. Since hardly anyone still runs DOS applications, it's not surprising that it took so long for the bug to be discovered. It's a feature that's not often thought about.
Best F'ing Friend?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
The /. editors are making up for having too many Apple stories since the introduction of the iPad. Now resuming normal "[Microsoft] Evil Empire Bashing" programming. Enjoy!
Not even close: The 25-Year-Old BSD Bug.
Is this a record(for a bug that's "known about" anyways?
A while ago OpenBSD developer found a 33 year old bug.
It depends on your definition of "known about" I guess.
Remember that BSD bug that sat around for about the same length of time? Yeah, it happens everywhere.
Of course, this is only a bug that can be exploited by 16-bit programs and only on 32-bit Windows. Since I run neither of those, it's not even a problem for folks like me.
Let's call it the Cicada bug.
A Cicada has a life-cycle of 17 years.
Now Microsoft is about to squash it.
Isn't it a little disingenuous to say "finally" when the bug was discovered last month?
That it was introduced 17 years ago doesn't mean that Microsoft has been tardy about fixing it...
"We are not the streamlined, small, hyper-efficient kernel I envisioned 15 years ago. Our kernel is huge and bloated. Whenever we add a new feature, it only gets worse." -- Linus Torvalds, September 2009.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
Just pointing out that "Microsoft's BFF, Google" deserves a placement in internet culture
Yes... the only question is... Why didn't Microsoft disable running DOS apps by default?
Since hardly anyone does it, and the facility is only provided for backwards compatibility, it ought to require explicit manual admin action to enable.
Given the security risk exposure of having such a rarely-used feature exposed as part of the potential attack surface.
This is excellent news for Digital Research! With these latest patches, DR-DOS can finally run the latest version of Windows without any spurious error messages. This is a great day!
That's really going to screw up their average response time numbers...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
You'd be surprised. Until two years ago the agents' interface to one of the national insurance firms was a 16-bit app dating from the days of Win 3.11.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
Fuck you mods and your troll bullshit. /. is owned by a company that has a stake in FOSS. It would be like ars being owned by a company with a stake in HD-DVD and posting any story about blu-ray in a negative light (back when there was a format war).
Every fucking headline or story about MS is painted in a bad way, and I'd say about half the stories deserve a retraction as can be seen in the threads. Other stories like this aren't even fucking news. And the headline is sensational. It's not news for nerds. It's news for nerds with a major bias.
That's what the NTVDM *is*. It's effectively a virtual machine, though it's closer to a virtualizer than a simulator (more like VirtualBox than Bochs)
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
No wonder BSD is dying.
since this bug was "discovered" in january its only chance at being a record would be the rapid turnaround in getting it patched..
By that I mean, rapid turnaround on Microsoft scale from disclosure in January, through to early Feb patching..
I don't know if this counts... but the year 2038 problem is coming up in another 28 years. Something tells me that the public will be less riled up about this one. I don't foresee a rise in cult membership or survivalist magazine sales.
Reading the summary, nevermind the article would have kept both of you and the poster above you from posting sillyness.. The bug exists in a bit of 17 year old code, but was discovered last month... so not even remotely "old"
Yet another reason I avoid Windows and run for the hills with my linux box, if Windows was patched in a timely matter instead of being vulnerable for weeks, months, 17 years or when the media s**ts their pants, then I just might look at using it.
A.) You don't understand what really happened here. You should read the +5's in this thread before reading the next part of my post.
B.) There is absolutely nothing preventing Linux or anything else from having a problem like this. In fact, this is quite the cautionary tale for anybody running a computer. Your computer has a number of exploitable bugs in it right this second. Your machine is not safe. You need to install updates. You need network protection, firewall, etc. You need to make backups. You need to not run every executable you find from un-trusted sources. You need to use good practices when dealing with sensitive data. Running Linux, BSD, OSX, whatever, doesn't alleviate any of these concerns.
C.) Summaries often contain more information than the headline does. They also usually have links you can click on to get even more info.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Don't like it? Go back to digg. Slashdot has never tried to hide or deny it's FOSS bias, nor is it ashamed of it.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
I think Microsoft wasn't concerned because DOS applications are all contained in a virtual machine. The hardware is emulated by the VDM or VXD's. If anything goes wrong NTVDM.EXE terminates like any other user process. Ideally it should be as safe to run and I'm sure Microsoft wanted to make running legacy DOS apps as seamless as possible to the end user.
The clash of honour calls, to stand when others fall.
Is this a record(for a bug that's "known about" anyways?
No; the oldest known bug is the ol' missing closing parenthesis.
Outlook is the best mail server there is.
If you're going to shill with a sub-million UID account, you should get your facts straight. "Outlook" is a client, and no, it's not the best one out there, that's a matter of opinion, with the only alternative choice typically being Lotus Notes. If you really meant "the best mail server", you probably ment to say "Microsoft Exchange", although I would have said "sendmail" or "Whatever Sun/Oracle calls their mail server now", or "anything except Domino".
"When I am king, you will be first against the wall..."
No, That's Windows 7 by itself. Office is 3GB extra.
The cited DSL fits in 64MB, all things included.
Damn Small Linux is small enough and smart enough to do the following things:
It includes three browsers, document processing, email, spreadsheet, VOIP, and a lot more.
The smallest pendrive I've ever heard of is the 64MB USB 1.0 device I'm holding in my hand right now that I bought my wife more than a decade ago. I paid $79 for it at Fred Meyer, because tech stores wouldn't carry it. Actually, there were 16 and 32MB versions of this, but let's not go there because this was the Windows 95 era.
I am on the record as stating that we've had no productivity increases since the advent of Windows. Let me quote from a wise man:
"Word processing was a solved problem in 1984. By 1987 spreadsheets had all the functions a normal person would ever use. Databases took a little longer, but by 1990 that was sorted. An infant could have been born that day and by now would be almost of age to vote and we've seen no real improvement in productivity since."
64MB is 0.32% of 20GB.
So let me ask you: If the Office team needs 3,000 MB to install their full application set, what can they do with 30MB - 1% of that? Splash? Can they even do that?
Help stamp out iliturcy.
Possibly; I was going off a meme at our lab that originates from one person saying something negative, and the other responding "you mispronounced 'awesome'."
Aikon-
....and YOUR Slash number has six digits. Mine has five. See? I can count backwards! :)
I've been using Linux since kernel version 0.99pl10, when Slackware ruled on a couple dozen floppies.... ...and get off my lawn!
When politicians are involved, everyone loses.
Yeah? Well my dick's smaller than yours!
Apparently your Slashdot ID doesn't make you any smarter.
But what I was getting at was perhaps if Linux chose a more modular design like a Microkernel, it would be less bloated.
Although it was in jest, as I think if they chose a Microkernel it would probably have ended up like Hurd and I'd be typing this from a Mac.
I need to track down John Titor so I can test my hypothesis.
Mod me down, my New Earth Global Warmingist friends!