Windows kernel, LSASS flaws fixed
563601
As anticipated, Microsoft today released five security bulletins rated &quot;important.&quot; All five fix vulnerabilities in Windows that could have been exploited by attackers to
55391
Microsoft released a &quot;critical&quot; fix on Thursday for a security issue left unresolved by the Windows XP Service Pack 2. The configuration change closed a hole in the Windows firewall settings that could open
395402
When Steve Sinchak's new Intel network card became "really slow" after upgrading his Windows Vista PC with a pre-release version of Service Pack 1, he tried uninstalling its software driver and replacing it with a new one.But to his dismay, the Chicago-area technology author and blogger found himself "stuck in a loop" during the InstallShield-managed process -- unable to replace his sluggish older driver with a new, peppier one."It's messed up to the point where I may have to use brute force to uninstall the driver, or wipe my hard drive and reinstall Windows Vista completely," he said.Sinchak's is an example, admittedly an extreme one, of the driver problems that forced Microsoft to take the unusual step of holding SP1's availability to users until March even while announcing its release to manufacturing (RTM) on Monday.Not even the hundreds of thousands of people who have already been testing Vista SP1, nor the many Windows developers accustomed to being able to download software on Microsoft's MSDN or TechNet Web sites immediately after RTM, will be able to get SP1 for another 6-8 weeks.And if you are one of the unlucky Vista users using a driver known to break and need reinstallation after the upgrade to SP1, Windows Update will quarantine you from getting SP1 until the driver is fixed."We want all of our customers to have the same good experience," said Microsoft senior product manager, David Zipkin, in an interview Monday. "That's why we're erring on the side of caution."Cancel or allow or shut up already?Service Pack 1 remains the milestone by which many companies and consumers judge when a Microsoft product is truly bug-free and mature enough to deploy. Any delay in SP1 could have an adverse effect on Vista uptake, which has been generally strong -- more than 100 million copies shipped -- despite a lukewarm market response.Zipkin points out that most drivers, once re-installed after the SP1 upgrade, should work properly.That was the experience of several Computerworld readers.Zipkin blames hardware vendors for failing to strictly follow Redmond's instructions on how drivers should be installed."The issue is that the drivers were not written per the spec we have on MSDN to ensure successful updates," he said, a spec that "has been around since the XP days."Zipkin declined to elaborate or comment on Sinchak's case. And neither Intel nor Macrovision, maker of the InstallShield software, immediately responded to requests for comment.But some experts think that the problem must be related to under-the-hood changes in Vista SP1, especially those concerning security and user privileges, which can directly affect how applications and drivers are installed."Microsoft looks like they are monkeying around with a lot of lower-level stuff," said Paul Morris, a project manager at QualityLogic, a Moorpark, Calif. software and driver testing firm. "In my mind, you've got to treat SP1 as an entirely new OS."Vista's overhauled security model had two major changes. First, local users who were formerly granted administrator access by default are granted standard access in Vista. Second, a new feature called User Account Control, or UAC, prompts users to verify whenever a new application or driver is about to be installed.Both moves help to prevent viruses and malware from taking hold. But UAC has been criticized by some users for its overzealousness, though UAC pop-ups decrease dramatically after the first month, according to Redmond.Moreover, moving users to standard rather than administrator accounts wreaked havoc on many applications and drivers that depended on full administrator access to install or run properly.If SP1 makes even small changes to Vista's security model, that could cause drivers to break again, according to Ian Lao, an analyst at In-Stat. Why? For one, most vendors took the easier, less rigorous option of patching and modifying their drivers to make them Vista compatible, rather than "rewriting them from the ground-up," said Lao. That makes them more fragile.Moreover, many drivers, unlike applications, can't be completely shut down during an installation process. The upgraded software -- in this case Vista -- may not be able to properly update the drivers, he said. Thus, permissions may be lost during the SP1 upgrade, or resources moved to different locations.Of drivers and ass-kickingsDrivers were a major bane to Vista in its early months last year.Despite Microsoft's claim that more than 1.6 million peripherals worked with Vista at its launch, there were numerous complaints from early adopters, gamers and other power users about non-working devices."It definitely wasn't just a vocal minority that had a problem with drivers at Vista's launch," said Robert McLaws, a blogger who also tested SP1 but didn't face any driver issues.Indeed, driver issues had been on the wane. At its Windows Hardware Engineering Conference (WinHEC) conference last May, Microsoft said that 1.9 million devices supported Vista.Microsoft has not updated that number since then. But it says that over 78,000 hardware products are now supported by Windows Update, up from 34,000 at launch.And 17,000 peripherals and devices (see list, IE 6+ required) have passed one of Microsoft's two rigorous certification programs: Certified for Windows Vista, which requires successful testing by a third party such as QualityLogic, and the more self-reported Works with Windows Vista program, which is more reliant on self-reporting."A lot of OEMs did not take the Vista launch seriously," McLaws said. "So Microsoft took their problem reports to vendors and kicked some ass."In a PowerPoint presentation distributed to media last month, Microsoft was confident enough to state "Many device and software problems behind us: Nearly all Windows Vista PCs have drivers for every single device installed, available on WU [Windows Update] or from vendor websites."But Microsoft may have relaxed too soon. Morris says none of vendors that came to QualityLogic for certification of their Vista drivers have returned seeking the same service for SP1."They may be hammering on them tooth and nail internally, but they're not asking us to touch it," he said.The result? Monday's delay.Gregg Keizer contributed to this story.
123003
Now you see it, now you don't Microsoft has suspended distribution of one of the updates required for Vista service pack one (SP1), after customers complained that their PCs wouldnât boot up properly after KB937287 had been applied.â¦
169476
Microsoft has fixed a critical flaw in the Windows operating system that could be used by criminals to create a self-copying computer worm attack.The software vendor released its first set of patches for 2008 on Tuesday, fixing a pair of networking flaws in the Windows kernel. Microsoft also released a second update for a less-serious&#160;Windows flaw that would allow attackers to steal passwords&#160;or run Windows software with elevated privileges.The critical bug lies in the way Windows processes networking traffic that uses IGMP (Internet Group Multicast Protocol) and MLD (Multicast Listener Discovery) protocols, which are used to send data to many systems at the same time. Microsoft says that an attacker could send specially crafted packets to a victim&#39;s machine, which could then allow the attacker to run unauthorized code on a system.Security experts say that there is no known code that exploits this flaw, but now that the patch has been posted, hackers can reverse-engineer the fix and develop their own attack code.Because IGMP is enabled in Windows XP and Vista by default, this bug could be used to create a self-copying worm attack, Microsoft said Tuesday.&quot;Theoretically this is wormable, and that&#39;s why this is rated critical,&quot; said Tim Rains, security response communications lead with Microsoft. However, Microsoft does not believe that hackers will have an easy time developing attack code that will work reliably. &quot;We&#39;ve done a thorough analysis of the vulnerability, and we&#39;ve come to the conclusion that there are several technical mitigating factors that make it unlikely to get reliable remote code execution,&quot; Rains said.Windows uses the IGMP protocol for many popular consumer applications such as streaming video, multiplayer games, and universal plug-and-play, but the protocol is usually blocked at the router. A derivative of IGMP, MLD is the multicast protocol used by IPv6 systems and is enabled on Vista by default.&quot;If it became a worm it could take over an internal network pretty quickly, or at least all the machines where multicast is enabled,&quot; said Eric Schultze, chief technology officer with Shavlik Technologies. &quot;But this one is going to be mitigated because a lot of people have blocked multicast.&quot;The critical MS08-001 update that fixes this flaw also patches a second, less-serious bug in the Windows networking stack that could be leveraged to launch a denial-of-service attack against a Windows system. This vulnerability lies in the Internet Control Message Protocol Router Discovery Protocol (ICMP RDP), which is used by Windows to find out how to communicate with the network. Because this capability is not turned on by default, Microsoft considers this to be merely an &quot;important&quot; bug.Microsoft&#39;s other Tuesday update, MS08-002, fixes an elevation of privilege flaw in the Windows Local Security Authority Subsystem Service (LSASS), used to manage account credentials in Windows.This flaw could be exploited by attackers to steal passwords or run their code with a higher level of privilege on Windows, said Schultze. &quot;The primary concern is Johnny who is a user becoming Johnny admin,&quot; he said. But if attackers were to combine an attack that exploited this flaw with another exploit that would allow them to run code on the system, then &quot;that could become a critical issue,&quot; he said.
668678
On Thursday, Microsoft gave I.T. administrators a sneak peak of next week&#39;s security updates. June&#39;s Patch Tuesday will see six sets of software patches. Four of those six will fix critical flaws in Windows and related software.
40932
Patches address flaws in Microsoft Agent in Windows 2000, Windows Services for UNIX, Visual Studio, MSN Messenger and Windows Live Messenger.
642873
Patches released for flaws in software package that lets Windows files and printers be shared by Unix and Linux systems.
68810
Rare, out-of-cycle Windows patch fixes one flaw, but attacks through other known, yet-to-be-plugged holes continue.
673034
Microsoft said over the weekend that an issue with its Windows Genuine Advantage validation systems -- which were causing verified systems to fail and lose access to features -- had been fixed.
280329
InfoWorld - Microsoft has released its monthly set of security patches , fixing problems in Windows, Internet Explorer and in the SSL (Secure Sockets Layer) software used for secure Web browsing.
316852
Holey night Symantec says it has fixed vulnerabilities in its NetBackup storage software identified by TippingPoint.â¦
513604
News of holes in security appliances come a few days after company patches operating system bugs.
283538
Use the tools built into Windows XP and Vista to repair broken network connections and device glitches.
22770
Unpatched Windows machines are vulnerable to latest adware attack
216439
Acknowledging that its patching process has "not been an example of our best work," Microsoft this week issued a second update to security bulletin MS06-042, which was released in August. The original patch included a security vulnerability - and it turns out the fix introduced even more.
104408
A software patch to protect your system is available from Microsoft.