Microsoft warns on Home Server bug
512932
This year the turkey came late Microsoft has confirmed that its recently released Windows Home Server OS can corrupt data if users are reckless enough to put it under extreme loads.â¦
321195
Researchers warn that a number of critical holes have been found in Microsoft Windows XP which could be exploited. Symantec acted after security researchers published the details of the heap overflow vulnerabilities
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
159977
Home net hardware could come under attack from malicious hackers, say security researchers
556270
After first unveiling the product at CES in January, Microsoft on Monday released Beta 2 of Windows Home Sever, and is opening up the beta program to a broader group of external testers. Previous releases were tested by over 1,000 Microsoft employees and the Redmond company's partners.
51437
eEye Digital Security has alerted Microsoft's bug team about a remote code vulnerabilityin Office 2007. Microsoft confirmed that  it's looking into the report.
97191
A Chinese security group has released sample code to exploit two new unpatched flaws in Microsoft Windows. The advisory comes in the week before Christmas, a time when many companies and home users are least prepared to deal with the problems.
143929
Microsoft Windows users need to watch out for several flaws in non-Microsoft media players.
381915
Microsoft issues patches for holes that could allow remote attackers to gain control of your PC.
378608
The Windows Home Server bug that's corrupting data is, according to Microsoft, of fairly limited scope and remarkably hard to reproduce, but they'll be working on it around the clock. Still, some users are yowling.
219303
Microsoft is warning of a new unpatched vulnerability in its Word software.
457301
A computer security researcher and Symantec Corp. are warning Microsoft customers about an unpatched hole in the company's Web browser that could allow an attacker to bypass security warnings and download malicious content onto vulnerable systems.
163595
Computer users could be open to attack from malicious hackers because of the way that Windows displays some images. Microsoft has issued a warning about a critical vulnerability in Windows that could let carefully
112205
Software update patches bug in wireless drivers that left systems vulnerable.
75853
Microsoft product managers Friday claimed that a data corruption bug in Windows Home Server crops up only when the system is under an &quot;extreme load,&quot; but also defended their decision to sound a general alarm before they had completed their investigation.The news that Windows Home Server (WHS) could corrupt files raised a storm of criticism from customers and observers alike.&quot;The problem isn&#39;t one hundred percent reproducible, and depends on quite a few different factors,&quot; explained Todd Headrick, the product planning manager on the Windows Home Server (WHS) team. &quot;Home Server has to be under an extreme load while doing a large file copy,&quot; he said, adding that the flaw comes into play only in instances when the file server&#39;s cache is full and the user is editing a file previously saved to a shared folder.&quot;But we thought it was important enough to generalize [the bug] so people would take it seriously, even though we took a PR [public relations] hit,&quot; Headrick added.Wednesday,&#160;Microsoft warned users&#160;in a tightly worded support document not to edit files stored on their servers with certain programs. &quot;Files may become corrupted when you save them to the home server,&quot; Microsoft said in KB946676, which it published last week to its support site.Saying that the bug was in the shared folders feature of WHS, the document urged users to stop using seven Microsoft applications, including Windows Vista Photo Gallery, Windows Live Photo Gallery, OneNote 2003, OneNote 2007, Outlook 2007, Microsoft Money 2007 and SyncToy 2.0 Beta under some conditions. &quot;We recommend that do not use the programs to save or to edit program-specific files that are stored on a Windows Home Server-based system,&quot; the document read.That wide-ranging recommendation caught the eye of WHS users and Microsoft critics alike. Some sounded white-hot.&quot;I&#39;ve had a fair share of files corrupted,&quot; a user identified as Shane K claimed on the WHS support forum. &quot;I have 800+ gigs of data on my home server and I&#39;ve had just about every file type you can imagine refuse to open or at sometime go to 0KB file size for no reason. This issue has been around for MONTHS so I don&#39;t know why suddenly the WHS team decides to &#39;work through the holidays&#39; to resolve it when there has been plenty of action on the boards since beta about this issue.&quot;Others misunderstood Microsoft&#39;s warning, and assumed that client backups to WHS would end up corrupted, which wasn&#39;t true. &quot;This could potentially be the &#39;my dog ate my homework&#39; for the 21st century,&quot; said a user named BVis on a Slashdot.org thread that tracked Computerworld&#39;s original story. &quot;&#39;I did my homework, but the power went out before I could save it, and my backups were all corrupt!&#39;&quot;&quot;People read things into [the KB],&quot; said Headrick. &quot;I heard people say &#39;Don&#39;t use the computer backup,&#39; but there were no problems whatsoever with Windows Home Server backup.&quot;Headrick and Joel Sider, a WHS senior product manager, both defended the decision to issue the warning. &quot;This is a very serious issue,&quot; said Headrick. &quot;We take any [data] corruption issue very seriously.&quot;&quot;We went with the amount of information we had at the time,&quot; said Sider. &quot;We had seen a reproducible problem, but we hadn&#39;t created a reproducible environment yet.&quot;&quot;We didn&#39;t have any more information, other than we were working on the problem, which we&#39;d already said,&quot; echoed Headrick in explaining why the team left the original support document untouched until late Friday. Then,&#160;Microsoft updated KB946676&#160;to include some of the same information that Headrick and Sider discussed in their interview with Computerworld.&quot;You can still use the WHS home computer backup to back up and restore files from and to your home computers,&quot; the revised document read.Headrick promised that the WHS team would work around the clock to come up with a permanent patch for the corruption bug, and would release it first as a hotfix that users would have to download manually from the Microsoft site. He refused to set a schedule for its release, however, saying only that the developers would have something to test &quot;in fairly short order.&quot;At some later date, the fix will be pushed to all WHS customers via Windows Update, Microsoft&#39;s update service, with the process determined by the server software&#39;s Automatic Updates settings, Headrick promised. He also said that although the WHS team was aware of file corruption reports related to Torrent applications, Intuit Inc.&#39;s Quicken personal finance program and Intuit&#39;s QuickBooks small business accounting software, it has not been able to reproduce the bug on its test systems. In addition, Headrick put the responsibility for any problems with Quicken on users&#39; shoulders.&quot;Quicken [data] was never meant to be stored on a network share,&quot; said Headrick.Computerworld&#160;is an InfoWorld affiliate.&#160;
653917
A new variant of the Mydoom worm that exploits an unpatched flaw in Microsoft&#39;s Internet Explorer browser is in the wild and posing particular risk to home and small business users, security experts warn.
223142
(InfoWorld) - Microsoft has blamed an unspecified server problem for a 19-hour stretch during which paying users of Windows XP and Vista were accused by the company's WGA (Windows Genuine Advantage) validation system of running pirated software. Any Vista system fingered during the episode was stripped of some features, including the operating system's Aero graphical interface. As of Saturday at 3 p.m. EDT, Microsoft said the problem had been fixed. "We are aware it is a server-side issue," said Phil Liu, a Microsoft program manager in the WGA group. "[But] the cause is unknown at this current time." "Customers who received an incorrect validation response can fix their system by revalidating on our site," said Alex Kochis, senior product manager of WGA, in a blog posting. The site Kochis referred to is the Genuine Microsoft Software home page, which includes links to validation tests for Windows and Microsoft Office. "After successfully revalidating, any affected system should be rebooted to ensure the genuine-only features are restored," Kochis continued. The validation server snafu began sometime prior to 8 p.m. EDT on Friday, when users started posting messages on Microsoft's support forums, including Vista Validation Issues, saying that their PCs had been tagged as running nongenuine Windows. Overnight, the number of users adding their accounts to the tale spiked significantly, as did the frustration index. "What in hell is going on, Microsoft?" asked a user named Hedgemeister. "SUPPORT? Where are you? Validation issues with Vista. Hello? All of us need help," wrote Gnrlbzik. "This is an absolute disgrace. Treating legitimate customers like criminals is a great way to make people want to buy your software in the future! [I'm] absolutely disgusted," added Costanza. Although copies of both Windows XP and Vista were being tagged as counterfeit during the 19 hours, users of the latter were especially incensed. The WGA antipiracy scheme for that operating system disables several features when it thinks the copy is bogus, among them the Aero graphical user interface and ReadyBoost. Early in the outage, several Microsoft customers posted what they said was the text of e-mail they had received from Microsoft support that suggested users sit tight for several days. "I'm sorry to inform you that the Windows Genuine server might be down for few days," the e-mail, attributed to Microsoft Technical Support, said. "I have escalated the issue to our Genuine team, kindly try to validate again on Tuesday 28 Aug 2007." If the message was intended to mollify users, it didn't work. "TUESDAY!?! Yeah, f that," said Nooaah. It wasn't until Saturday around 1 p.m. EDT that a non-anonymous Microsoft manager offered up information. "I guarantee that we're working on this issue right now," said Liu in a post to the forum. "My goal is to identify a FIX for this issue -- afterwards get you all what you are looking for, an explanation and cause. I promise I will have an explanation and resolution as soon as humanly possible." Users' testy relationship with WGA Although Microsoft did not identify the number of affected systems Saturday, based on the user comments and Liu's promises, it appeared to be systemwide. If so, it would be the biggest problem so far in the developer's contentious WGA program. Designed to spot pirated copies of its Windows and Office software, WGA has been mandatory since mid-2005 before nonsecurity updates or files can be downloaded from Microsoft's site. WGA has faced criticism almost since its inception, but until Friday, the most vocal complaints dated back to June 2006, when users discovered that the Windows XP version of WGA was "phoning home" to Microsoft every time the PC was booted. Those critics returned when Microsoft upped the ante with Vista by replacing the WGA messages that only nagged XP users suspected of running counterfeits with a new policy that used an RFM (reduced functionality mode) to cripple machines. In RFM, only Internet Explorer works, and then for just an hour at a time. Because RFM only allows a grace period of three days to those who previously activated Windows but are subsequently deemed pirates, any problems must be fixed quickly to prevent customers' PCs from going dark. Microsoft managed to beat the deadline. That, however, didn't mean much to some, who said this was it for their relationship with the vendor. One claimed that he was heading out the door to buy a Mac, while others swore they would switch to Linux. Others called on Microsoft to ditch WGA. "Once again the legitimate person gets screwed while the people who pirate software probably aren't even affected," said Mark in the support forum. "This whole validation process should be dropped. This is just another nail in the Microsoft coffin." Saturday's outage was not the first time the validation service has gone dark and then identified all PCs connecting with the servers as running pirated copies. In October 2006, Microsoft's Kochis acknowledged a similar blackout. "Earlier this week, a server on the back end of the WGA service experienced a bug that resulted in a temporary outage. As a result, some systems were incorrectly flagged as being non-genuine, and we want to confirm for those who contacted us about this that it was indeed an error," he wrote.