Slashdot Mirror
Microsoft Confirms Zero-Day Hours After Exploit
CWmike writes "Microsoft confirmed on Tuesday an unpatched vulnerability in Windows just hours after a hacking toolkit published an exploit for the bug. A patch is under construction, but Microsoft does not plan to issue an emergency update to fix the flaw. The bug was first discussed Dec. 15 at a South Korean security conference, but got more attention Tuesday when the open-source Metasploit penetration tool posted an exploit module crafted by researcher Joshua Drake. Metasploit says successful attacks are capable of compromising victimized PCs, then introducing malware to the machines to pillage them for information or enlist them in a criminal botnet."
You should check out the one-sided bashfest that was posted on Ars Technica over this.
If the maintainer of the tool is to be believed, MS has known of this flaw for almost six months and done nothing, and had several days of notice that the new version was going to be released (not that the new version appears to have mattered.)
http://www.microsoft.com/technet/security/advisory/2490606.mspx
Windows 7 is not affected, for people who are too lazy to click the link.
"...I think the Microsoft hatred is a disease." - Linus Torvalds
avg sees 2nd link as a threat
I'm too lazy to click the link. What about us under Win98?
Non-Affected Software
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for Itanium-based Systems
You all are still losers. Same as always.
Sleep your way to a whiter smile...date a dentist!
A co-worker and I have witnessed multiple attempts by CutePDF Writer to install itself, unbidden. I haven't ever used it, as far as I know and haven't been to any pages I can think of which would require me to save something in PDF. As a wary user I don't trust anything which just pops up without my asking, particularly to install software. Could this be the result of accessing a web page which is retrieving content from a compromised site? Seems such that the CutePDF install request could really be a spoof trying install malware.
A feeling of having made the same mistake before: Deja Foobar
I spat my coffee out all over my 2 day old keyboard. Thank you.
Oh, FORK THAT!
Sent from my CR-48
I always thought that "zero-day" means "before the product is released publicly" -- so eg "zero-day crack" would be a cracked, leaked copy of some software, "one-day exploit" would be an exploit found the same day it was released, etc. But now it seems that "zero-day" is being applied to absolutely every exploit ever. Am I totally mis-remembering? Mis-understanding? Can anyone explain?
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
The moment Microsoft confirmed the zero-day, it was no longer a zero-day. Microsoft can never become aware of a zero-day, because by doing so they make it a one-day.
didn't want to accidentally /. Microsoft
We're talking about a zero day exploit not a zero-day release.
With a zero-day exploit it means you had zero days of warning to patch the flaw before an exploit was spotted in the wild. So basically it means someone out there found this bug on their own and was using it for their own nefarious means before the good guys even knew about it the existence of the bug.
Not every exploit is a zero-day one, but for some reason they are all called zero-day exploits now.
This one doesn't seem like a zero-day exploit since the bug was found 20 days before there was any known exploit.
http://lkml.org/lkml/2005/8/20/95
timothy is working on it.
The article noted affecting a graphics rendering engine... There are lots of custom games on starcraft 2 and a LOT of players making their own maps...
They discovered an exploit to give us zero-day hours? And it's confirmed? W00t! Better call Stephen Hawking! ... oh.
Pet peeve: Profane people propagating perfunctory pedantry.
what av do u use?
warning pointless sig
I am still tired of ms win7 giving me the worst, most shtlss performance of any o/s ever. At least if they tank I will not have any expectations of at least moderate performance.
Sorry!! I am one guy they forgot to bribe and have been using IT for 30 years, so the sht on a platter that they sell is nothing so spellbiding for me.
As long as you keep buying their repackaged usless crap the more they will ignore you and the issues. Remember when they kept saying vista and win7 were built from the ground up - LMFAO forgot about that didnt you?
1. Windows XP still has more market share (57%) than Windows Vista (12%) and Windows 7 (21%) combined. More to the point since Vista and XP are affected, more than three quarters of Windows systems are affected. They should care. We sure as hell care. If all Microsoft cares about is W7, that tells us a lot about their commitment to support and security. It's not 2002 any more. It's now 2011, and if being "all in" in the cloud and "all in" in mobile, and committed to "Dynamics" (whatever the heck that was) has distracted from their commitment to security, then we need to know because WE USE THEIR SOFTWARE for more than a year or two.
2. Windows is a brand. A label. A blank symbol. It's not, and never was an operating system. It has been an operating environment for some time, or as some would say, several. It doesn't, and can't, "give a flying fuck" about anything. Windows is a brand that's owned by a legal fiction, a "corporate person". Since there is some fictional personhood attached to the legal entity Microsoft, and some history, we may be able to ascribe some motivation to that with the understanding that anthropomorphizing soulless corporations is in itself a trap. Some here would probably say that Microsoft is the cruel bargainer the devil himself hopes to be someday, but at least we're agreed that it has some personification to hang motivations on. Please don't say "Windows" when you mean "Microsoft" it confuses many issues. They also make very good mice. Ok, they don't actually make the mice, but you should get my drift.
And yeah if it drives adoption of their new product off of their old product without too much escape to actually good product as a goal, we'd all have thunk it. Because that's what they do. The prevention of actual progress is their goal.
Help stamp out iliturcy.
Developpers needs to stop using int's when unsigned int's would have done the job.
Then all those "oh god, we did not anticipate a negative number here!" bugs would be fixed already.
The honourable gentleman FAILS IT.
Yes, I forget I was on /. where no one has a girlfriend and so erections aren't the needful...