News: SP2 Fights Worms, Has Bugs
335002
After a rough couple of years of embarrassing and serious hacker attacks hitting the Windows-using world, Microsoft Corp. struck back in August with the security-minded upgrade it dubbed Service Pack 2.
676379
Christian Stocker has an update on his blog today that Windows users will be happy to hear:   Frank Kromann applied some patches yesterday to the PECL sources of the uploadprogress extension to make it compile under Windows (almost the same as by SteveH provided in a comment of my post yesterday). Therefore, thanks to the pecl4win site, a compiled dll is now already available. Get it here (untested by me..)   He also mentions some documentation that was asked about concerning the package (and the patches), but notes that he "can't promise anything any time soon".
745683
How a simple bug betrays Microsoft's disdain for basic best practice principles
304020
ProKras writes &quot;German magazine PC-Welt has discovered a major security flaw in Windows XP SP2 when installing over SP1. The article says that &#39;with a certain configuration, your file and printer sharing data
22770
Unpatched Windows machines are vulnerable to latest adware attack
169476
Microsoft has fixed a critical flaw in the Windows operating system that could be used by criminals to create a self-copying computer worm attack.The software vendor released its first set of patches for 2008 on Tuesday, fixing a pair of networking flaws in the Windows kernel. Microsoft also released a second update for a less-serious&#160;Windows flaw that would allow attackers to steal passwords&#160;or run Windows software with elevated privileges.The critical bug lies in the way Windows processes networking traffic that uses IGMP (Internet Group Multicast Protocol) and MLD (Multicast Listener Discovery) protocols, which are used to send data to many systems at the same time. Microsoft says that an attacker could send specially crafted packets to a victim&#39;s machine, which could then allow the attacker to run unauthorized code on a system.Security experts say that there is no known code that exploits this flaw, but now that the patch has been posted, hackers can reverse-engineer the fix and develop their own attack code.Because IGMP is enabled in Windows XP and Vista by default, this bug could be used to create a self-copying worm attack, Microsoft said Tuesday.&quot;Theoretically this is wormable, and that&#39;s why this is rated critical,&quot; said Tim Rains, security response communications lead with Microsoft. However, Microsoft does not believe that hackers will have an easy time developing attack code that will work reliably. &quot;We&#39;ve done a thorough analysis of the vulnerability, and we&#39;ve come to the conclusion that there are several technical mitigating factors that make it unlikely to get reliable remote code execution,&quot; Rains said.Windows uses the IGMP protocol for many popular consumer applications such as streaming video, multiplayer games, and universal plug-and-play, but the protocol is usually blocked at the router. A derivative of IGMP, MLD is the multicast protocol used by IPv6 systems and is enabled on Vista by default.&quot;If it became a worm it could take over an internal network pretty quickly, or at least all the machines where multicast is enabled,&quot; said Eric Schultze, chief technology officer with Shavlik Technologies. &quot;But this one is going to be mitigated because a lot of people have blocked multicast.&quot;The critical MS08-001 update that fixes this flaw also patches a second, less-serious bug in the Windows networking stack that could be leveraged to launch a denial-of-service attack against a Windows system. This vulnerability lies in the Internet Control Message Protocol Router Discovery Protocol (ICMP RDP), which is used by Windows to find out how to communicate with the network. Because this capability is not turned on by default, Microsoft considers this to be merely an &quot;important&quot; bug.Microsoft&#39;s other Tuesday update, MS08-002, fixes an elevation of privilege flaw in the Windows Local Security Authority Subsystem Service (LSASS), used to manage account credentials in Windows.This flaw could be exploited by attackers to steal passwords or run their code with a higher level of privilege on Windows, said Schultze. &quot;The primary concern is Johnny who is a user becoming Johnny admin,&quot; he said. But if attackers were to combine an attack that exploited this flaw with another exploit that would allow them to run code on the system, then &quot;that could become a critical issue,&quot; he said.
17134
Enterprise developers looking for a guide to test applications against the new Windows XP Service Pack 2 (SP2) are getting some help from Microsoft (Quote, Chart).
86299
Plus: Is Microsoft search engine crawling Google? [News.com Extra]
370225
Security researchers found two software flaws in the Windows XP Service Pack 2 that could allow virus writers and malicious hackers to sidestep new security features in the operating system.
361420
Games and security programs are on a long list of software that does not work well with the Windows SP2 update.
642789
At least a dozen Microsoft software applications and operating systems affected. Also: The talking worm.
63078
Security researchers have discovered another vulnerability in Windows XP Service Pack 2, but it doesn&#39;t appear to be an immediate threat.
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
758325
Part of the recently-released Service Pack 2 for Windows XP was a slew of long-awaited updates to Internet Explorer. Along with patches for the browser, SP2 also included features such as the ability to block
481653
I'm back, with a very interesting topic too!  Joel Spolsky, ex-Microsoft Manager and software engineering guru has a new essay, How Microsoft Lost the API War that is creating quite a big storm in the blogging communitiy.  Joel posits that the priests in the holy Temple of Microsoft have lost their way, because it has split into two factions, and the wrong faction is winning. One faction worships on the alter of backward compatibility, while the other is led by fervent priests who are proselytizing to raise up the new gods of .NET and Longhorn. Joel suggests that the new gods will cause the destruction of the holy Temple because Microsoft's great victories were built on the altar of keeping customers happy with backward compatibility. Furthermore the old gods of the Windows API continue to grow more grotesque and cruel with the passing of time, driving former worshipers into the arms of the friendlier gods of World Wide Web.  This story sounds extremely plausible. I must admit that i fit the profile of the developer who used to develop on the Window's API, is familiar with COM and Win32 who now develops mostly using PHP and Python. However I continue to develop and maintain Windows apps that keep our customers happy, and we still plan to develop new Windows apps. Some points:  Temple of the Blind? Firstly, Microsoft is still a compelling place to work for to people who feel that they can make a difference. The Temple continues to attract talented people with a Unix background. For example we have the recent hiring of Ward Cunningham, author of the Wiki.  Microsoft is still able to keep talented people like Raymond Chen, and others like him who continue to look after the Windows API, and Longhorn apparently will still give high priority to backward compatibility. Open sourcerers like Miguel Icaza are sufficiently attracted to the .NET vision to stake their careers on Mono. Longhorn and .NET are compelling technologies, so even if Win32 is not so cute anymore, M'soft is providing something that remains very attractive.  What i do see M'soft doing wrong is that they aren't disseminating the .NET runtime fast enough. It remains an optional install in XP Service Pack 2 for example. Also their IE dev team appears to be hog-tied due to political reasons; nevertheless IE remains good enough, particularly when I can embed IE as an activeX control, something I cannot do with Mozilla (AFAIK) - Update: I'm wrong.  Temple of the Spider?  Secondly, people don't merely use a web browser. They run the web browser in the OS.  So let me ask you, if you are using DreamWeaver or HomeSite or Photoshop or vi or emacs or Gimp, how many of you are willing to give it up for a java applet (or whatever your favorite technology is) running in your web-browser? Precisely.  Temple of the Abandoned?  Third, Joel makes the claim that developers are not developing to the Windows API. Well he could be right. But I bet a lot of them are still calling Win32.  If you are using a framework or IDE like Delphi or wxWindows (or .NET or VB) then you certainly are insulated from the Windows API, but that doesn't mean that you're not calling the Windows API all the time. I don't see Borland dropping their Windows version of Delphi at any point in time.   In fact, the fact that many developers are using some form of framework is a compelling argument for Microsoft to enhance the .NET framework to attract developers who are using other frameworks.  Today, not that many students learn x86 assembler, but that doesn't mean that Intel lost the CPU wars. Just because fewer people are learning Win32 doesn't mean Microsoft has lost the API wars, if the frameworks run predominantly on Win32.  Temple of the Lost  Joel even warns you in the beginning that "because I'm talking about big trends, I need to exaggerate and generalize". But you still get sucked in because Joel Spolsky is a first-class writer, in the same order as Philip Greenspun or Eric Raymond. That makes him so persuasive and plausible. But this is not Indiana Jones and doomed temples, but Steve Jobs and reality distortion fields.  Other opinions:  Harry Fuecks (PHP is ASP's upgrade path),  Dennis Hamilton (M'soft is just covering all bases), Robert McLaws (Joel is wrong in 7 points), Oliver Travers (the web is not good enough), One Run-time to Rule them all....
429232
DecemberÃ¢ÂÂs Patch Tuesday finds Vista in the bad guysÃ¢ÂÂ sights. Plus: Get Office 2007 SP1, get your fix for Flash, and avoid an HP laptop disaster.
395402
When Steve Sinchak's new Intel network card became "really slow" after upgrading his Windows Vista PC with a pre-release version of Service Pack 1, he tried uninstalling its software driver and replacing it with a new one.But to his dismay, the Chicago-area technology author and blogger found himself "stuck in a loop" during the InstallShield-managed process -- unable to replace his sluggish older driver with a new, peppier one."It's messed up to the point where I may have to use brute force to uninstall the driver, or wipe my hard drive and reinstall Windows Vista completely," he said.Sinchak's is an example, admittedly an extreme one, of the driver problems that forced Microsoft to take the unusual step of holding SP1's availability to users until March even while announcing its release to manufacturing (RTM) on Monday.Not even the hundreds of thousands of people who have already been testing Vista SP1, nor the many Windows developers accustomed to being able to download software on Microsoft's MSDN or TechNet Web sites immediately after RTM, will be able to get SP1 for another 6-8 weeks.And if you are one of the unlucky Vista users using a driver known to break and need reinstallation after the upgrade to SP1, Windows Update will quarantine you from getting SP1 until the driver is fixed."We want all of our customers to have the same good experience," said Microsoft senior product manager, David Zipkin, in an interview Monday. "That's why we're erring on the side of caution."Cancel or allow or shut up already?Service Pack 1 remains the milestone by which many companies and consumers judge when a Microsoft product is truly bug-free and mature enough to deploy. Any delay in SP1 could have an adverse effect on Vista uptake, which has been generally strong -- more than 100 million copies shipped -- despite a lukewarm market response.Zipkin points out that most drivers, once re-installed after the SP1 upgrade, should work properly.That was the experience of several Computerworld readers.Zipkin blames hardware vendors for failing to strictly follow Redmond's instructions on how drivers should be installed."The issue is that the drivers were not written per the spec we have on MSDN to ensure successful updates," he said, a spec that "has been around since the XP days."Zipkin declined to elaborate or comment on Sinchak's case. And neither Intel nor Macrovision, maker of the InstallShield software, immediately responded to requests for comment.But some experts think that the problem must be related to under-the-hood changes in Vista SP1, especially those concerning security and user privileges, which can directly affect how applications and drivers are installed."Microsoft looks like they are monkeying around with a lot of lower-level stuff," said Paul Morris, a project manager at QualityLogic, a Moorpark, Calif. software and driver testing firm. "In my mind, you've got to treat SP1 as an entirely new OS."Vista's overhauled security model had two major changes. First, local users who were formerly granted administrator access by default are granted standard access in Vista. Second, a new feature called User Account Control, or UAC, prompts users to verify whenever a new application or driver is about to be installed.Both moves help to prevent viruses and malware from taking hold. But UAC has been criticized by some users for its overzealousness, though UAC pop-ups decrease dramatically after the first month, according to Redmond.Moreover, moving users to standard rather than administrator accounts wreaked havoc on many applications and drivers that depended on full administrator access to install or run properly.If SP1 makes even small changes to Vista's security model, that could cause drivers to break again, according to Ian Lao, an analyst at In-Stat. Why? For one, most vendors took the easier, less rigorous option of patching and modifying their drivers to make them Vista compatible, rather than "rewriting them from the ground-up," said Lao. That makes them more fragile.Moreover, many drivers, unlike applications, can't be completely shut down during an installation process. The upgraded software -- in this case Vista -- may not be able to properly update the drivers, he said. Thus, permissions may be lost during the SP1 upgrade, or resources moved to different locations.Of drivers and ass-kickingsDrivers were a major bane to Vista in its early months last year.Despite Microsoft's claim that more than 1.6 million peripherals worked with Vista at its launch, there were numerous complaints from early adopters, gamers and other power users about non-working devices."It definitely wasn't just a vocal minority that had a problem with drivers at Vista's launch," said Robert McLaws, a blogger who also tested SP1 but didn't face any driver issues.Indeed, driver issues had been on the wane. At its Windows Hardware Engineering Conference (WinHEC) conference last May, Microsoft said that 1.9 million devices supported Vista.Microsoft has not updated that number since then. But it says that over 78,000 hardware products are now supported by Windows Update, up from 34,000 at launch.And 17,000 peripherals and devices (see list, IE 6+ required) have passed one of Microsoft's two rigorous certification programs: Certified for Windows Vista, which requires successful testing by a third party such as QualityLogic, and the more self-reported Works with Windows Vista program, which is more reliant on self-reporting."A lot of OEMs did not take the Vista launch seriously," McLaws said. "So Microsoft took their problem reports to vendors and kicked some ass."In a PowerPoint presentation distributed to media last month, Microsoft was confident enough to state "Many device and software problems behind us: Nearly all Windows Vista PCs have drivers for every single device installed, available on WU [Windows Update] or from vendor websites."But Microsoft may have relaxed too soon. Morris says none of vendors that came to QualityLogic for certification of their Vista drivers have returned seeking the same service for SP1."They may be hammering on them tooth and nail internally, but they're not asking us to touch it," he said.The result? Monday's delay.Gregg Keizer contributed to this story.