Microsoft rushes out emergency Windows update Microsoft is about to issue an emergency security update to plug a vulnerability which could allow an internet worm to be spread via a computer without the user doing anything. The update is rated as critical for users of Windows 2000, XP and Server 2003 and the less severe rating of "important" for users of Windows Server …
Microsoft's Patch Tuesday is the 2nd Tuesday of the month, however that is not necessarily the 2nd week of the month. If the 1st of the month is on a Wednesday, then the 1st Tuesday will be the following week, i.e. the 2nd week of the month, and Patch Tuesday will be the 3rd week of the month.
Sorry for being so pedantic.
Mine's the one with me getting my coat and going to the pub instead of being in the office on a Thursday night downloading patches for Microsoft's flawed operating systems.
That's right there have never, ever been any holes in "Ubuntu", in fact Linux has never had anything wrong with it, it's perfect, nope not one flaw EVER...
Get over it and go do your homework, otherwise your mum will ground you as your grades slip....
All O/S's have holes in them, but feel free to belive the bullshit your mates tell you...
Paris, because....oh best stop there....
Seems even Microsoft do it sometimes.
If I was feeling generous I'd say they'd learned their lesson after the ssl exploit where all other browsers had a patch out in hours and they had a press release the following day playing down the severity. Sadly I doubt they've learned much.
No reason for the icon except it is actually 16:59 by my work clock and that's almost coat-time.
if ONE more person emails me to say "wow - how do you know so early?" - sheesh. It was a joke above -JOKE- , check out the smiley.
They haven't even bothered to patch that 2006 exploit yet
Trusted Computing eh?
I'd rather have everyone on the same debain ssh key than this haha < note that this is also a joke. except, now I think about it, it's still more preferable!
ahh i love it
how can any windows lover back up their so fortunate OS now lol
Bin it and save yourself lots of agro and money
and maybe once you have binned it your brains can open and work out what is behind all those GUI's
pfft. windows is only for amatuers not serious computer users.
I guess Gordon Slater was making a joke about it being an emergency patch for CVE-2006-2094 from 2006 but this patch doesn't seem to have anything to do with that.
Someone seeing his reply and not realising it's a joke might think the problem is to do with IE and not bother installing the patch because they don't use IE.
In fact, the problem seems to be in the RPC service and browser choice won't matter.
For those that complacently sit back and assume that their non-MS OS of choice is inherently safer and more secure than Microsoft's offerings, you should educate yourselves about the facts before spouting off in public.
http://blogs.technet.com/security/archive/2008/05/15/q1-2008-client-os-vulnerability-scorecard.aspx
For January through March of 2008, Mac OS X users experienced the highest
number of vulnerabilities as well as the highest number of High severity
vulnerabilities while Windows Vista users experienced the fewest and the fewest
High severity vulnerabilities.
NO operating system / application / software / user is ummune from hackers and malware and to assume otherwise is just plain stupid.
Microsoft, and any other vendor for that matter, should be commended for releasing well-tested fixes for important vulnerabilities. But they DEFINITELY deserve commendation for offering a webcast explaining the vulnerability and the fix - how often do YOUR platform/app vendors do THAT for YOU?
"I'm not sure anyone can possibly think that any software written by humans will be error free."
Well, yeees ... but who took the decision to have a Remote Procedure Call server permanently running in their OS.
RPC is *designed* to let other machines run code on your machine, and Windows doesn't let you turn it off because a second genius decided to use it for basic windows functions (ie. using the "remote" functions to run code on the same machine as itself).
Question: What's better?
a) Depending on RPC to be 100% bug free
b) Not having RPC enabled (except on fancy server farms which actually need it).
Bottom line, yes, blame Microsoft. Things like RPC, UP&P and ActiveX are broken by design.
Worse than that, people told them what would happen in the design phase but they went ahead and did it anyway because it made things like things like file sharing easier to configure if you leave all the machines wide open to network activity.
although as I write this the CVE entry is just a placeholder. Quite why Gordon posted a link to a 2006 CVE bulletin... anyway, could happen to anyone.
The actual MS update, MS08-067, says "A remote code execution vulnerability exists in the Server service on Windows systems. The vulnerability is due to the service not properly handling specially crafted RPC requests".
Source: http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
The bulletin also says that Server 2008 and Vista users are less vulnerable because on those OSes "the vulnerable code path is only accessible to authenticated users". It adds "To prevent this vulnerability, add a rule that blocks all RPC requests with the UUID equal to 4b324fc8-1670-01d3-1278-5a47bf6ee188."
Another buffer overflow, maybe? Another one down, and a few thousand more to go.
Are you seriously suggesting that some of the people who comment here don't know exactly what they are talking about and are out to score cheap points, in order to make themselves look better?
This place is exclusively commented by serious IT professionals, we're all above that sort of thing. Aren't we?
Well lets be honest - Microsoft here have discovered a flaw and fixed it pretty quickly, and people still attack them... for fixing a bug. As Slartybardfast said, people would have flamed Microsoft here whether they had fixed it or not.
Microsoft are far from perfect - but I think this was a good move, and they've got the fix out pretty quickly. Personally, I find it hard to negatively criticise Microsoft here.
It makes me laugh that everyone who hates windows claims that linux have no critical holes in it. Like all large piece of software it will, these however arent found as users, dont use it therefore the bad guys dont target it, (as whats the point of stealing geeks identies??), therefore they remain dormant.
As soon as (ie never) the ordinary man in the street uses linux, all these hackers will target it and we will be flooded with critical patches for all these holes.
I use windows and linux, BTW.
Look here to all the linux haters all those non serious multi booter and the likes of Vincent etc
Microsoft gets attacked for a few reasons here they are:
1. They develop code with copyright tag and do not allow the general public to view/comment/expand on their code. [linux is open source and if anything should be getting exploited more than any other OS due to this factor]
2. the develop duff code from taking code from 1980's and adding new colour to it and want to charge general public license money for this per year [ no wonder why they get attacked]
3. They keep changing the standard so people have to go and spend money on their stupid licences look at open office and Microsoft Office.
With all these 3 in mind do u not wonder why it is they get attacked lol
This I hope explains to u all why MS is shit and will be dead in the next 10 years
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
