Slashdot Mirror
New Windows XP Zero-Day Under Attack
wiredmikey writes "A new Windows kernel zero-day vulnerability is being exploited in targeted attacks against Windows XP users. Microsoft confirmed the issue and published a security advisory to acknowledge the flaw after anti-malware vendor FireEye warned that the Windows bug is being used in conjunction with an Adobe Reader exploit to infect Windows machines with malware. Microsoft described the issue as an elevation of privilege vulnerability that allows an attacker to run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights."
Adobe Reader - problem solved
Hmm, a bug that gets admin rights.... If I were sufficiently evil I would have saved this until April when there's no chance of it being patched ever.
Too bad Windows XP won't be supported much longer. Once that happens, it would be a...shame if something were to happen to that PC. If you upgrade to Windows 8, Microsoft will surely protect you.
Never have an adobe product installed in the first place - solved.
So other than Flash or Edge Animate, what's a good program for creating vector animations?
You have a hilariously mistaken idea of how copyrights work.
Oh, I see, a ramping-up of press releases about 'exploits' against XP prior to the cut-off date.
Didn't see that coming.
All your ghosts are just false positives.
Per TFA, this exploit is dumb and unconcerning. It just lets a standard user perform admin operations, no remote exploit of any kind. There have always been many ways for a standard user to get admin on any OS, the most trivial being physical access.
A lot of companies own multi-thousand-dollar PC peripherals with no NT 6 (Windows Vista/7/8) driver, and the peripheral's manufacturer has either gone out of business or deliberately chosen not to make new drivers for old but still working hardware. When companies have to re-buy expensive peripherals, the manufacturer makes more money.
so all you need to due is use this to install that remote exploit app.
wipe windows and install Linux on the machine.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
I don't know if you're joking, I suspect you are, but for the benefit of the following readers I'll explain.
Here's how it works. User is tricked into accessing an infected pdf which contains code to elevate the user's privileges. the infected document's code downloads further exploits to root-kit the box. Right now the exploit is in a pdf, but infected websites are sure to follow.
If it's out there, and it has a picture of a puppy (or, in the USA, the word "free"), some user will click on it.
If you read the TFA, then you know it also is a Server 2003 bug as well.
Privilege elevation exploits are a nightmare for Terminal Server and Citrix boxes because it is a conduit for installing tools (using the admin rights) to grab other users' credentials and to continue from there to own the entire environment.
Did the submitter RTFA, or just submit as soon as (s)he saw the words "XP exploit" somewhere?
It's not mentioned, in the Slashdot article, but it's also a Server 2003 bug.
https://technet.microsoft.com/en-us/security/advisory/2914486
This means Server 2003 Terminal Servers and Citrix boxes.
No, it is not trivial to go from a non-root user to a root user, at least in a properly secured system. That requires local root exploits such as these. This is the whole basis for running daemons as non-privileged users. Even if Apache has an exploit, if it's running as a dedicated, non-privileged user, you can't get root on the system.
Local root exploits are serious, though obviously not as serious as a remote remote exploit. It's also true that they are usually easy to come by on unpatched systems. But your claim that it's trivial to go from a non-privileged user to a privileged one is incorrect.
Your ideas about security are wrong, and you are missing the first rule of holes: when you find yourself in one, stop digging.
Unless you've been living under a rock for the past year or more, they HAVE decided what they're doing with it. On April 8, 2014, the update and activation servers are going dark. That's it. Game over. The End. They're NOT releasing a patch to disable activation and they're NOT releasing another service pack or update pack. You won't be able to do a fresh install without cracking the activation and you won't be able to get the 150 or so updates since SP3 without using a third party update pack. Do not pass GO, do not collect $200.
I doubt we'll go through the same thing with people hanging on to Vista for dear life on April 11, 2017 but I can already hear the same whining for Win 7 on January 14, 2020.
I have heard nothing indicating that they are planning on shutting down activation servers. This (recent) article agrees http://www.windowsobserver.com/2013/09/17/will-microsoft-turn-off-the-windows-xp-activations-servers-after-official-support-ends-in-april-2014/
After XP End Of Support, Windows XP will remain on MSDN and TechNet for customers who still need to activate and re-activate XP (there aren’t new retail copies). We don’t have a date to share around when activation will be shut off, but it will be on for the foreseeable future.
As a precedent, Microsoft released a "sunset" version of Money Plus when they shut down activation servers for it. Adobe did similar for CS2.
http://www.microsoft.com/en-ca/download/details.aspx?id=20738
When usage rates drop below 1-5% they'd probably consider sunsetting activation. Right now XP has between 10-25%.
You will be able to get all updates to date, but they won't release new ones. As a precedent, last time I tried you could update Windows 98 to July 2006 state (when support for Windows 98 was stopped).