Slashdot Mirror
New Windows XP Zero-Day Under Attack
wiredmikey writes "A new Windows kernel zero-day vulnerability is being exploited in targeted attacks against Windows XP users. Microsoft confirmed the issue and published a security advisory to acknowledge the flaw after anti-malware vendor FireEye warned that the Windows bug is being used in conjunction with an Adobe Reader exploit to infect Windows machines with malware. Microsoft described the issue as an elevation of privilege vulnerability that allows an attacker to run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights."
Uninstall Adobe Reader - 2 problems solved!
Upgrading the OS would be wise as well, especially since we're fast coming to the point of end of support, April 8th 2014. Windows 7 and 8.x both improved security considerable, and there are other more secure options as well such as MacOS X and the other varies flavors of *nix such as Linux distributions.
Never have an adobe product installed in the first place - solved.
For Web browsing in a VM, it is hard to beat XP for something that takes 512 MB of RAM, 16-24 gigs of disk space (partitioned into two disks, one for the system, one for scratch space for sandboxie's sandbox.) Its footprint is so light, the VM can stay resident on a box with 6-8 gigs of memory without issue, even with running fairly larger applications like Acrobat [1], Photoshop, Dreamweaver, and Flash.
I use Acrobat for producing PDFs for long term storage, FoxIt for viewing. So far, so good.
Sure, Windows 7 fits on my EeePC. Not.
Then do like I did: install an Xfce-based Linux distribution and run Windows applications in Wine. Should Microsoft follow through on the rumored complete deprecation of the desktop in Windows 9, you'll be ready. Or you can install a larger SSD in your Eee PC and max its RAM.
Do they even make pocketable little 9" PCs any more?
I too mourned the end of netbooks. Tablets sold with a keyboard, such as the ASUS Transformer Book, are probably the closest successor.
Oh, I see, a ramping-up of press releases about 'exploits' against XP prior to the cut-off date.
Didn't see that coming.
All your ghosts are just false positives.
My CNC requires a parallel port which doesn't even exists anymore and my CNC software can't run on Windows versions above XP. Are you suggesting I throw away my perfectly good CNC setup just because it's "old worthless crap"? Send me a check for $15K and I'll think about it.
Get free satoshi (Bitcoin) and Dogecoins
Per TFA, this exploit is dumb and unconcerning. It just lets a standard user perform admin operations, no remote exploit of any kind. There have always been many ways for a standard user to get admin on any OS, the most trivial being physical access.
Foxit is just as bloated as Adobe Reader.
Sumatra PDF is what Foxit was before becoming bloatware.
Did the submitter RTFA, or just submit as soon as (s)he saw the words "XP exploit" somewhere?
It's not mentioned, in the Slashdot article, but it's also a Server 2003 bug.
https://technet.microsoft.com/en-us/security/advisory/2914486
This means Server 2003 Terminal Servers and Citrix boxes.
GP AC here. I looked around to see if Adobe had anything to say about this and I saw a post where an Adobe employee claimed that the inclusion of the McAfee software was required to fund the development of Flash Player because they provide it freely to users. It was also pointed out that users can opt-out and how they supposedly understand users' concerns about bundled crapware so they will always offer an opt-out. I can't seem to find the link now, but the way it was worded just sounded so smug and entitled. The question that comes to mind is, why not make it opt-in instead? The answer is because their original intent was to trick users into installing it.
Isn't it funny how a multi billion dollar corporation that made shitloads per software license of Creative Suite (and individual component applications therein) and distributed Flash Player (a necessary plugin for their own customers' audience) for years without the need for bundled crapware is all of a sudden "forced" to start including it; all around the same time that they discontinued Flash support on mobile devices and went to an even more expensive subscription model for their bread and butter products?
I'd definitely say Adobe is evil.