Microsoft investigates Windows Server flaw
33360
Microsoft is investigating a security flaw in Windows server software that could allow an attacker to gain complete control over systems running the software, the company said.
417021
Microsoft has warned of seven newly found flaws in its software that could allow an attacker to steal data and take over a personal computer running the Windows operating system.
223142
(InfoWorld) - Microsoft has blamed an unspecified server problem for a 19-hour stretch during which paying users of Windows XP and Vista were accused by the company's WGA (Windows Genuine Advantage) validation system of running pirated software. Any Vista system fingered during the episode was stripped of some features, including the operating system's Aero graphical interface. As of Saturday at 3 p.m. EDT, Microsoft said the problem had been fixed. "We are aware it is a server-side issue," said Phil Liu, a Microsoft program manager in the WGA group. "[But] the cause is unknown at this current time." "Customers who received an incorrect validation response can fix their system by revalidating on our site," said Alex Kochis, senior product manager of WGA, in a blog posting. The site Kochis referred to is the Genuine Microsoft Software home page, which includes links to validation tests for Windows and Microsoft Office. "After successfully revalidating, any affected system should be rebooted to ensure the genuine-only features are restored," Kochis continued. The validation server snafu began sometime prior to 8 p.m. EDT on Friday, when users started posting messages on Microsoft's support forums, including Vista Validation Issues, saying that their PCs had been tagged as running nongenuine Windows. Overnight, the number of users adding their accounts to the tale spiked significantly, as did the frustration index. "What in hell is going on, Microsoft?" asked a user named Hedgemeister. "SUPPORT? Where are you? Validation issues with Vista. Hello? All of us need help," wrote Gnrlbzik. "This is an absolute disgrace. Treating legitimate customers like criminals is a great way to make people want to buy your software in the future! [I'm] absolutely disgusted," added Costanza. Although copies of both Windows XP and Vista were being tagged as counterfeit during the 19 hours, users of the latter were especially incensed. The WGA antipiracy scheme for that operating system disables several features when it thinks the copy is bogus, among them the Aero graphical user interface and ReadyBoost. Early in the outage, several Microsoft customers posted what they said was the text of e-mail they had received from Microsoft support that suggested users sit tight for several days. "I'm sorry to inform you that the Windows Genuine server might be down for few days," the e-mail, attributed to Microsoft Technical Support, said. "I have escalated the issue to our Genuine team, kindly try to validate again on Tuesday 28 Aug 2007." If the message was intended to mollify users, it didn't work. "TUESDAY!?! Yeah, f that," said Nooaah. It wasn't until Saturday around 1 p.m. EDT that a non-anonymous Microsoft manager offered up information. "I guarantee that we're working on this issue right now," said Liu in a post to the forum. "My goal is to identify a FIX for this issue -- afterwards get you all what you are looking for, an explanation and cause. I promise I will have an explanation and resolution as soon as humanly possible." Users' testy relationship with WGA Although Microsoft did not identify the number of affected systems Saturday, based on the user comments and Liu's promises, it appeared to be systemwide. If so, it would be the biggest problem so far in the developer's contentious WGA program. Designed to spot pirated copies of its Windows and Office software, WGA has been mandatory since mid-2005 before nonsecurity updates or files can be downloaded from Microsoft's site. WGA has faced criticism almost since its inception, but until Friday, the most vocal complaints dated back to June 2006, when users discovered that the Windows XP version of WGA was "phoning home" to Microsoft every time the PC was booted. Those critics returned when Microsoft upped the ante with Vista by replacing the WGA messages that only nagged XP users suspected of running counterfeits with a new policy that used an RFM (reduced functionality mode) to cripple machines. In RFM, only Internet Explorer works, and then for just an hour at a time. Because RFM only allows a grace period of three days to those who previously activated Windows but are subsequently deemed pirates, any problems must be fixed quickly to prevent customers' PCs from going dark. Microsoft managed to beat the deadline. That, however, didn't mean much to some, who said this was it for their relationship with the vendor. One claimed that he was heading out the door to buy a Mac, while others swore they would switch to Linux. Others called on Microsoft to ditch WGA. "Once again the legitimate person gets screwed while the people who pirate software probably aren't even affected," said Mark in the support forum. "This whole validation process should be dropped. This is just another nail in the Microsoft coffin." Saturday's outage was not the first time the validation service has gone dark and then identified all PCs connecting with the servers as running pirated copies. In October 2006, Microsoft's Kochis acknowledged a similar blackout. "Earlier this week, a server on the back end of the WGA service experienced a bug that resulted in a temporary outage. As a result, some systems were incorrectly flagged as being non-genuine, and we want to confirm for those who contacted us about this that it was indeed an error," he wrote.
395103
The emergence of a new Internet virus targeting a Microsoft Windows security flaw could cause more damage than usual because the company&#39;s system for fixing the problem is so complex that many
538459
Microsoft Corp. is investigating a reported vulnerability in its ASP.Net that could allow an attacker to bypass security features on a Web server and view sensitive content, the company said Thursday.
500612
Microsoft is investigating reports of a new Internet Explorer flaw that puts people with the most secure version of Windows at risk of phishing attacks.
60184
A flaw in popular Windows server software could allow remote attacks to be launched against systems, Microsoft has confirmed. The vulnerability is in Windows Internet Name Service, or WINS, a network infrastructure
633489
OCTOBER 08, 2004 (IDG NEWS SERVICE) - Microsoft Corp. is investigating a reported vulnerability in ASP.Net that could allow an attacker to bypass security features on a Web server and view sensitive content, the company said yesterday.
628475
Computer code that exploits a flaw in the way many Microsoft applications process JPEG images has been published on the Internet and could indicate coming attacks on vulnerable PCs, experts said.
221404
Millions of computer users are at risk of attack because flaws in the way Windows handles some images.
224030
An 18-month-old flaw in Microsoft Windows -- patched by Microsoft in 2006 -- continues to allow hackers to infect PCs with advanced rootkits and launch infections from thousands of compromised Web sites.
247227
Microsoft released a security bulletin yesterday alerting computer users of a critical flaw in software that processes JPEG images.
427995
Microsoft is offering a patch for a critical security flaw related to the processing of JPEG images by its operating systems and other applications.
278689
Microsoft Corp. warned on Tuesday of  seven newly found flaws in its software that could allow an  attacker to steal data and take over a personal computer  running the Windows operating system.
114189
Microsoft has found two new security flaws in its software, including a critical hole that could spread viruses using Jpeg graphics.
205960
Microsoft Corp. yesterday released an unusually large number of software security updates to fix flaws in its products, some of which could be exploited to remotely take over computers running the Windows operating system.
514325
Microsoft Corp. MSFT.O warned Windows  users on Tuesday of two new "critical"-rated security flaws in  its software that could allow attackers to take control of a  computer and delete or copy information.