Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security

Microsoft Discloses Security Flaws in XP and WMPlayer 295

Posted by timothy from the innocent-whistle dept.
An anonymous reader writes: "Salon is running a story on Microsoft's disclosure of a number of security flaws in WinXP and Windows Media Player, versions 6.4 and 7.1. The story also states that there are 2 critical vulnerabilities in Commerce Server 2000. Will I ever get the bang for my MS buck?"
This discussion has been archived. No new comments can be posted.

Microsoft Discloses Security Flaws in XP and WMPlayer More

Microsoft Discloses Security Flaws in XP and WMPlayer

Comments Filter:

  • Get them from... (Score:5, Informative)

    by Mwongozi ( 176765 ) <slashthree AT davidglover DOT org> on Friday June 28, 2002 @05:00AM (#3785313) Homepage
    The article doesn't make clear that you should pop along to Windows Update to get you dose of patchy goodness.

    After seeing holes in OpenBSD and Apache recently, I guess it's Microsoft's turn again. ;)

    • Re:Get them from... (Score:3, Flamebait)

      by cyborch ( 524661 )

      After seeing holes in OpenBSD and Apache recently,

      oh come on, the apache vulnerabilities were embarrasing, but that does not make all the vulnerabilities of IIS alright. And according to the new strategy of MS you are going to pay a subscription fee to MS to get updates. Apache updates are going to remain free.

      I guess it's Microsoft's turn again.

      Microsofts turn at what? They still don't have the most widely used web server. They still do not patch as fast as the free alternatives are patched. We still cannot see the source since that would pressent a threat to national security.

    • I also think the article forgot to mention you can install Critical Update Notification in Windows 98/ME/2000/XP that automatically flags you about security and other important updates whenever you log onto the Internet.
      • I also think the article forgot to mention you can install Critical Update Notification in Windows 98/ME/2000/XP that automatically flags you about security and other important updates whenever you log onto the Internet.

        Actually, Critical Update Notification has been superseded by Automatic Updates. Instead of telling you that you need to go download some updates, it'll download them and tell you that they need to be installed.

        (Of course, to add Automatic Updates, you need to have checked the Windows Update site sometime in the past month or two. The luser who's been running unpatched Win98 for the past four years isn't too likely to have done that.)

  • The article implies that these vunerabilities haven't been patched. Funnily enough, I downloaded the patches from Windows Update last night, thanks to XP's auto-update feature.

    Every Operating System and application has bugs. If there were security bugs in Linux or Freeamp, would it warrant front page news?

    Not wishing to be Flamebaity at all. MS have a lot of things severely wrong with them. For once they've dealt with an issue in timely fashion. This is not the Anti-MS rhetoric you're looking for.

    • Re:Yet more unwarranted MS bashing (Score:5, Insightful)

      by e_n_d_o ( 150968 ) on Friday June 28, 2002 @05:20AM (#3785372)
      If there were security bugs in Linux or Freeamp, would it warrant front page news?

      Yes. If there were a security bug in Linux, Mozilla, XMMS, FreeAmp, etc, that allowed your computer to be compromised, it would warrant front page news on Slashdot.

      Or was that supposed to be one of those rhetorical questions?

      • Re:Yet more unwarranted MS bashing (Score:5, Insightful)

        by Sycraft-fu ( 314770 ) on Friday June 28, 2002 @07:26AM (#3785610)
        I think it's more the tone of the post. Just a few days ago a venurability in OpenSSH poped up (and was fixed). The post about that is very neutral and newslike, simply reporting the bug, it's nature and the fix. This one is whiny and sounds immature. It would be like if the OpenSSH post read:

        "Security focus has a post on a huge venurability in all versions of OpenSSH from 2.9.9 to 3.3. Just another example of you getting crap for paying nothing."

        I think the poster's intent was to remind everyone that MS is not the only company that has security problems and that they did deal with the issues already.
      • Yes. If there were a security bug in Linux, Mozilla, XMMS, FreeAmp, etc, that allowed your computer to be compromised, it would warrant front page news on Slashdot.

        You're right. There WOULD be a news article on Slashdot about a bug if it were in a piece open source software. However, Slashdot's news articles about bugs in open source software usually include a link to the patch for the program if it has already been released. But in this case, like all the others, Slashdot refuses to even acknowledge the patch for Microsoft product, let alone provide a link to it, so that they can infer that it hasn't been patched.
      • "If a Linux computer falls in a valley, does Slashdot make a sound?"

        Heh. :)

    • Re:Yet more unwarranted MS bashing (Score:2, Insightful)

      by Anonymous Coward
      It wouldn't warrant front page news, save for these facts:

      (1) MS Windows comes with virtually all PCs.
      (2) The ammount of security holes alone found in Windows in a given week FAR, FAR outweighs those found in any other OS that I can think of.

      Given that we've all had to have Windows shoved down our throats at some point in our lives, don't you think that knowing exactly how it's fucked up this week might just be a plus?
      Same reason I wanna know about a security flaw in Linux. So it can be fixed.. for every 1 hole in Linux though, there are like 50 in Windows, so it's a bit more important to fix the Windows ones, that is if you don't say fuck it and delete the POS first.

      • (2) The ammount of security holes alone found in Windows in a given week FAR, FAR outweighs those found in any other OS that I can think of.

        Don't ever, ever think that any operating system has less bugs than the other. That is a dangerous belief that is going to reach up and grab you. All of these operating systems are written by human beings.

        Microsoft wrote XP to a certain point (like Linux did with 2.4.0), and then released it. After that point, they would have to continiously send out updates to fix bugs and do updates. And everyone on /. bitchs that Microsoft was so insecure because there are so many patches.

        However, in that same time frame, The 2.4 tree in linux has gone through 19 revisions, with many critical bug fixes! This proves that Linux has just as many bugs as Microsoft.

        The difference is that Linux is open about their problems - and they make an effort to keep the public informed. If a critical problem is found, the code is changed (almost immediately).
        Microsoft hides their bugs. So for them to come out and announce bugs (and patches) before the bugs become newsworthy issues is a step in the right direction.
        • "The difference is that Linux is open about their problems - and they make an effort to keep the public informed. If a critical problem is found, the code is changed (almost immediately).
          Microsoft hides their bugs. So for them to come out and announce bugs (and patches) before the bugs become newsworthy issues is a step in the right direction. "

          I see the problem a little differently. A lot of the vulnerabilities that have been mentioned in Windows are really features that MS implemented that people have found a way to exploit. The Melissa virus comes to mind.

          So what'll happen is MS will add new features, and then somebody'll find a way to be a nuisance with them. Unfortunately, what'll happen is that the resolution to the problem isn't so clear. "Do we take out the feature, or do we put a rule in it and wait for somebody to find a loophole?"

          Anybody used Office XP? (heh yah right, sorry) One of my coworkers is using Outlook XP. One of his coworkers tried to send him an .EXE (no, not one of those web games, it was a test build of some code he was writing) but Outlook refused to admit that it had it. What happened was Outlook XP had disabled the ability to recieve .EXE files. I don't mind this by default, but there wasn't a menu option to re-enable it. Result? A Google search and a clumsy registry hack.

          I can't help but think that MS just got tired of people being hit with it and just removed it all together.

          Just to be clear: I'm not arguing with you, just presenting another angle to the story. It's a big tangled mess. Windows has bugs, vulnerabilities, and features that can be used against you. I hope the Linux community is paying attention to this. I have a feeling they could develop a solution that allows the interesting features without allowing kiddie scripters to exploit them.
        • There's a big difference there. The 2.4.0 Linux kernel by itself is not a complete OS in the sense of Windows XP, and it wasn't packaged and sold as a finished product. A Linux distribution is packaged and sold in that way. They do their own testing and software integration in addition to the kernel developers, and they all waited a long time to release distros based on the 2.4 kernel.
    • Not wishing to be Flamebaity at all. MS have a lot of things severely wrong with them. For once they've dealt with an issue in timely fashion. This is not the Anti-MS rhetoric you're looking for.

      Perhaps that is why this is news? eg. Man bites Dog, MS Fixes Security Flaw in Time?

    • Re:Yet more unwarranted MS bashing (Score:4, Insightful)

      by sheriff_p ( 138609 ) on Friday June 28, 2002 @05:50AM (#3785431)
      Could you expect to see them? Well, I mean, I guess everyone has been *REAL* quiet about the Apache and SSH ones on /., right?

      Stop being paranoid about alleged M$ bashing.

    • You get what you pay for? (Score:5, Insightful)

      by Slashamatic ( 553801 ) on Friday June 28, 2002 @06:27AM (#3785487)
      If this was a major compromise in another system, of course it would be reported here. However, commercial systems such as Windows cost money. I have no means of fixing the bug myself so I rely on the vendor.

      Given the revenue stream of say Win-XP compared to that of commercial Linux distributions, I am very surprised that MS still makes code with so many holes. If XP ius too big for MS to manage the development and support, then they should simplify it.

    • Re:Yet more unwarranted MS bashing (Score:5, Interesting)

      by bludstone ( 103539 ) on Friday June 28, 2002 @06:57AM (#3785547)
      one of my XP-running friends went through this upgrade.. It compleatly trashed all his funky video codecs.. He currently cant watch about 2/3rds of the stuff hes downloaded. Most of them being independant music videos.

      has anyone else experienced this?
      • bludstone wrote:

        > one of my XP-running friends went through this
        > upgrade.. It compleatly trashed all his funky
        > video codecs.. He currently cant watch about
        > 2/3rds of the stuff hes downloaded. Most of them
        > being independant music videos.

        Well, if the patch is the same one mentioned on ZDNet (http://zdnet.com.com/2100-1104-940063.html), then one of the "bugs" has to do with Digital Rights Management. It may be that your friend wasn't "supposed" to be able to watch those videos before, and Microsoft "fixed" it.

        If your friend would check their EULAs (end user license agreements) for MSN (if they have it) and XP, they would find that Microsoft can also download stuff that might affect their ability to use their downloads automatically whenever they are on MSN, or whenever they download secured content whose manufacturer has notified Microsoft that their DRM needs an update to handle some new problem or hack. If these updates keep people from viewing their content, Microsoft basically says "tough".

        Me thinks your friend might want to consider a new player, if not a new OS.

        "They bind our hearts: 'Let's sell them again and again!'
        Our plan understands the sea; we can wait for her coming."
        From the song "Infant Girl" in the Japanese version of Mothra (1961).
    • Funnily enough, when I used XP's auto-update feature this morning (6/28), it didn't give me an option for either update.
  • "Yeah, we may have four new security holes (two critical) in our flagship secure commerce server, and three new holes in WMP, but YOU guys had a possible exploit (with a simple workaround) in OpenSSH! HA! Nyer nyer. Thhhhhpt."

  • OpenXP (Score:2, Funny)

    by Anonymous Coward
    Nearly 6 Months and only #ERROR# root exploits in the default install...

  • Be persistent (Score:2, Insightful)

    by Anonymous Coward
    "Will I ever get the bang for my MS buck?"

    If they don't treat you right the first time, buy buy again.

  • Link (Score:3, Informative)

    by Anonymous Coward on Friday June 28, 2002 @05:06AM (#3785335)
    http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/bulletin/MS02-032.asp

    Would it have killed ya to post this as well Timmy? =P

  • Bang! (Score:1, Funny)

    by hockeygeek ( 192147 )
    Banged for your MS buck? Sure, just bend over for Bill...
  • Oh you'll get your bang out of a MS product
    alright. No boom? No boom _today_, boom tomorrow, there's always a boom tomorrow.

    --Matt :)

    PS: I suppose one could also be banged by their lawyers.

  • Poor Salon (Score:2, Funny)

    by Joe Tie. ( 567096 )
    This is most certainly not the way to get microsoft to donate $750 million to them.
  • Will I ever get the bang for my MS buck?

    You're getting plenty of bangs and you still complain???

    Were is journalistic integrity nowadays ...

  • If only.... (Score:4, Insightful)

    by rattler14 ( 459782 ) on Friday June 28, 2002 @05:12AM (#3785356)
    If only real player didn't tank out a few years back (my window stills says it's buffering) and if quicktime was widely supported, this wouldn't even be an issue. Everyone seems to get forced into supporting the windows option for lack of a better option (and i'm talking about the masses here). i know all the linux buffs here can point out a million other options on a non-windows OS, but that's not gonna help my friends mother, who needs to read the instructions written on the sticky pad about how to check her yahoo mail.

    • Re:If only.... (Score:2, Insightful)

      by NeoSkandranon ( 515696 )
      If only Realplayer didnt install several other unasked for apps (realdownload? puh-leeze) and if only Quicktime didn't nag you to purchase the Pro version each and every time you used it, perhaps they would be more widely supported.

    • Yellow Sticky Script (Score:3, Informative)

      by ONOIML8 ( 23262 )
      Sounds like your friend needs to take that sticky pad and write a script. Then create a big icon for the script and call it "Get Yahoo Mail, Click Here".

      I have no idea if that can be done in windows. I know that it can be done with most, if not all, Linux desktop enviroments.

      Linux on the desktop does not need to be "difficult". Linux remains the better option over Windows, you just have to get over being lazy. The bad news is you have to learn something new. The good news is you're gonna learn something new, and it's going to work.

      So what if your friends mom can't/won't write scritps to automate her computing tasks. You do it for her for a fee (even if it's just chocolate chip cookies). You set up a Linux desktop for her once. Give her one button access to the things she wants to do and she'll be out of your hair. She damn sure won't be calling you to come fix her computer because of the daily BSOD.

  • Is it safe? (Score:5, Funny)

    by Vidmaster_Steve ( 455301 ) on Friday June 28, 2002 @05:12AM (#3785359) Homepage
    INT, STORE, NIGHT. CUSTOMER walks into a near empty store, he steps through the doors cautiously, peering around curious as to where the hell the clerks are.

    Customer: Hello..? uh... hello...? I want ta get a copy of Windows XP. Is anybody here?

    CLERK, unseen: Is it safe?

    Customer: Is what safe?

    Clerk: Is it safe?

    Customer, preturbed: Yes... It's safe. It's very safe...

    Clerk: Is it safe?

    Customer: Lissen! Are you going to come out, or what?

    Clerk: Is it safe?

    Customer: THIS ISN'T FUNNY!

    Clerk 2: It puts the lotion on its skin and puts it in the basket.

    Clerk: Shut up man. Is it safe? Is it safe? IS IT SAFE?

    Customer: STOP IT! I JUST WANT A COPY OF WINDOWS XP! (Customer breaks down to the floor, sobbing) I just want a copy of XP...

    Clerk: Is it safe?

    Customer screams and runs out of the store, climbs into his car, which immediatley spins out and slams into a fire hydrant. The car bursts into flame. The customer bails from the car and runs down the darkened, abandoned street. He gets a half dozen steps from the car, and then he, illogically and without reason, bursts into flame himself.

    Clerk 1: Thirty seconds, You owe me five bucks.

    Clerk 2: I don't have five bucks.

    Clerk 1: Take it from the register.

    On-topic discussion part.

    THEY TOLD ME IT WAS SAFE! I TRUSTED YOU MICROSOFT! I TRUSTED YOOOOOOOOOOOOOOU! YOU BLEW IT UP, YOU MANIACS YOU BLEW IT UP!
    "PokeySteve, are you drunk?"
    "Yes, but on love.
    And whisky.
    But mainly whisky."

  • At last an end to these senseless free patches... (Score:3, Funny)

    by Anonymous Coward on Friday June 28, 2002 @05:14AM (#3785364)
    Microsoft has also anounced that this is to be the last free patch. All subsequent security patches will be available only to registered users at $14.95 per user licence. Very fair price, after all you can't have programmers working for nothing, that would be unamerican.

  • Better update options? (Score:3, Interesting)

    by Saggi ( 462624 ) on Friday June 28, 2002 @05:22AM (#3785378) Homepage
    Most software is expected to have bugs. But when it comes to OS great care should be taken into removing these, especially those involving security. But bug tracking is an art form. You can never remove bugs 100% as the difficulty in finding the bug increases dramatically as you approach 100%.

    When it comes to software like the media player, this is much more serious. This goes into much more than just one single OS. I run Win95, Win98 and Win2000, and all these may be affected. On top of that the media player keep posting me to update the software. Wouldn't it be nice if the system gave me the option to update to the most stable and secure version or the latest version? You might think I have that option, as I may choose not to download the latest, but make my way through the download jungle to find an earlier version. But this jungle is impossible to move through for ordinary people.

    I understand that Microsoft wait with disclosure of the bug until they have a patch. This is often criticized, but in some cases it make sense.

  • Security is MS's big weakness so why... (Score:4, Insightful)

    by 00_NOP ( 559413 ) on Friday June 28, 2002 @05:27AM (#3785392) Homepage
    ...don't the Linux vendors (especially IBM) flog this issue for all it's worth? I really think this is where the fight for market share should be.

    However, the fact that it isn't makes me think that the vendors aren't entirely confident with the Linux security offer.

    Perhaps it's too technical - there are plenty of security patches for GNU/GPL/Linux - I use that title advisedly, as they are rarely in the kernel (at least one a week AFAICS) - but they are generally on a faster turnaround than MS. But it's still not brilliant....hmmmm. Must think about this some more.

    • Danger Danger Danger (Score:3, Interesting)

      by Llywelyn ( 531070 )
      >Perhaps it's too technical

      *Exactly*.

      In a world where we cannot convince people that MHz don't matter, and people believe that security is a product, attempting to convince them of the security issues with MS will prove fruitless.

      MS will just release statistics and compare their OS with the number of security holes found in OS + Applications and people will believe it to show that Linux is less secure. They will turn up their marketing engines and hype that Open Source means Lower Security and people will believe it.

      True Story: I was attempting to convince a certified MS XP technician that MS didn't understand security. Keep in mind this is someone deep within the ranks of the Microsoft Heresy (like the Cainite Heresy, but more Hideously Evil(TM)).

      I cited Scheiner, cDc, L0pht, and a half-a-dozen others. I talked about how open source was a good thing, the reply I got back can be summarized:

      1) Security is a product ("A firewall will make you secure")

      2) He thought the only reason you would want to secure your system was to keep people from browsing the pr0n there (and seeing the other files).

      3) The threat level is minimal--no one would want to break into *your* system.

      4) Believing that security was a real issue was like believing everything anyone told you (down to "three headed big foots in Utah").

      Of course this is absolutely absurd, but thats what he believed. While you may not be able to sell the general public on all of that, it gives an impression on how MS treats security and how their marketing department would convince their users to treat it.

      Sad, but true.
    • IBM's cheddar.com commercial is pretty good.
  • Funny, a few days ago, i was having to do the ole ./configure , make , make install with openssh 3.4. Tonight i had to hit windowsupdate and grab the various fixes (flame away, i run win xp pro on my desktop, but at least i redeem myself by running my backup, dns, and dhcp on redhat 7.3). Any OS can have bugs and issues. But i still much prefer linux/open source for stuff that needs security. I patch my linux box a LOT less often then i have to run windows update. And i dont have to reboot my damn linux box every time i update samba or openssh or bind.
  • > Will I ever get the bang for my MS buck?

    Umm...I think you've just been banged for your MS buck. :)

  • Bang for Buck (Score:2, Funny)

    by mqduck ( 232646 )
    Will I ever get the bang for my MS buck?

    I don't know about you, but I've paid $0 in my lifetime for MS software, so you could say I've gotten at least my share of bang. But I wouldn't say that. I'd say that MS owes me for forcing their way into an OS monopoly, therefore forcing me to use their Piece of Crap in order to use lots of apps I want to use (ie, games).

    Love and kisses,
    Jeff

  • Anyone read Cringley's Pulpit this week? (Score:5, Interesting)

    by Anonymous Coward on Friday June 28, 2002 @06:05AM (#3785451)
    Maybe Cringley's right ... [pbs.org]
    • Why do we stand for this?

      Why do you, whoever you happen to be, stand for this?

      The only way this can truly change is through market intervention: legal solutions will be iffy and likely do more harm than good; internal forces certainly won't cut it; and petitioning is useless.

      Support Apple, Support Linux, Support OpenBSD, but don't support Microsoft!

  • Technical Details (Score:5, Informative)

    by rob-fu ( 564277 ) on Friday June 28, 2002 @06:25AM (#3785482)
    For anyone who cares, here [microsoft.com] is the link to the technical details of this vulnerability. The only reason I have this is because my Critical Update notification won't shut the hell up about patching to the newest version, and I had it open...

    Not trying to whore for karma; just thought someone would be interested.

  • Oh please... (Score:5, Funny)

    by red5 ( 51324 ) <gired5@gmail . c om> on Friday June 28, 2002 @06:28AM (#3785488) Homepage Journal
    Will I ever get the bang for my MS buck?

    Oh please, when was the last time you actually bought a microsoft product?
      • Oh please, when was the last time you actually bought a microsoft product?

      Last time for me was when I found (in 2000) that I simply couldn't buy a laptop in the UK without a Microsoft OS (and other preloaded software). Funnily enough, even though I replaced it with a Linux distro, I'm still waiting for my refund [slashdot.org].

      Tell you what, when I receive the money, I'll buy a legit license key for the copy of XP on my (gaming) desktop. Fair enough?

    • Oh please, when was the last time you actually bought a microsoft product?

      Oh, about five years ago.
    • I bought a copy of Code Complete [amazon.com] last week.

      What, you mean software? Why would I want to use a Microsoft software product?

  • now if they only allowed us poor windoze users to remove wmp in the first place, but no, it's a part of the os now
  • After a week in which I spent hours remotely updating apache and openssh on my colocated boxes, it's hard to get worked up about another Microsoft patch.

  • Trojan End User License Agreement (Score:5, Interesting)

    by eswan ( 16407 ) on Friday June 28, 2002 @07:01AM (#3785556) Homepage
    Has any body else actually read the EULA that comes with the media player 6.4 patch?

    Digital Rights Management (Security). You agree that in order to protect the integrity of content and software protected by digital rights management ("Secure Content"), Microsoft may provide security related updates to the OS Components that will be automatically downloaded onto your computer. These security related updates may disable your ability to copy and/or play Secure Content and use other software on your computer. If we provide such a security update, we will use reasonable efforts to post notices on a web site explaining the update.

    Security update? Who's security are they protecting? There is no option to uninstall media player. Your choices (if you wish to continue using Windows) are

    A: Leave your system open to bugs that give system level access to the next worm (imagine nimda with a malicious /default.htm)

    B: Bite the bullet and install the patches. But if Microsoft releases an update that silently and without notification installs itself and 'disable(s) your ability to ... use other software', you're SOL. But hey, it's ok. Don't you know Microsoft is supporting 'Trustworthy Computing'?

    • Since when did WM's DRM remove the ability to use WinAmp? Just don't buy "secure crap" music and you're fine.
      • Since when did WM's DRM remove the ability to use WinAmp? Just don't buy "secure crap" music.

        Look at that EULA again:

        These security related updates may disable your ability to copy and/or play Secure Content and use other software on your computer.

        WinAmp is one of those "other software on your computer" which may be disabled. Duh.

        Essentially, this is a backfit of their XP license [slashdot.org] and DRM technology for the 60% of WinSlaves that are using Win98.

        Given that Windows Security is an oxmoron, there's no reason to "upgrade" your computer this way. Outlook, IE or some stupid piece of junk like a plug and play deamon that you never knew listened to the network will eat you anyway.

        If you just must have M$ in your house, blind it to the network by NOT installing the network card drivers or pointing it to a bogus gateway IP number. Never use it to surf, read email or anything else that M$ will never do right. I admit that I have such a beast in the corner for talking to cameras and an old scanner. It's legal and I own it. But I'll never ever trust it. Red Hat's dual boot (GRUB) let's me get the information off of it.

    • Oh, that's _really_ cute. Operative word being 'other software'. I am so glad I'm not a Windows developer right about now....

      Legally, this means "I agree to allow Microsoft to make updates, that will be automatically downloaded, and that may break any non-Microsoft software for any reason, or for no reason". There's absolutely no limitation on the 'disable your ability to ... use other software' clause. 'And' applies the 'disable' part to the 'other software' part, nowhere is 'other software' defined. Also note it's up to Microsoft what they consider 'reasonable efforts'!

      They're getting to be sneakier than the music industry contract lawyers. That is rather disturbing...

  • "Will I ever get the bang for my MS buck?"

    No

  • Trying to force DRM? (Score:5, Insightful)

    by epsalon ( 518482 ) <slash@alon.wox.org> on Friday June 28, 2002 @07:16AM (#3785582) Homepage Journal
    M$ announces bug. Everybody required to download a critical update...

    What's the bug?

    DRM doesn't work... turns out you can hear copyrighted MP3s. This is a big security vulnerability and you mush download this patch, otherwise the finanical security of the RIAA will be at stake, and that's unamerican.

    [Note: This is intended as a joke and as food for thought. This is not fact.]
      • turns out you can hear copyrighted MP3s. This is a big security vulnerability and you mush download this patch [This is intended as a joke]

      If it's a joke, I'm not laughing [slashdot.org]

    • M$ announces bug. Everybody required to download a critical update... What's the bug? DRM doesn't work

      No, DRM patches are more important than critical updates. Microsoft demands the right fo ram them down your throat weather you want them or not...

      "You agree that in order to protect the integrity of content and software protected by digital rights management ("Secure Content"), Microsoft may provide security related updates to the OS Components that will be automatically downloaded onto your computer."

      -

  • Windows update: patched and go. (Score:3, Informative)

    by Otis_INF ( 130595 ) on Friday June 28, 2002 @07:19AM (#3785594) Homepage
    This morning windows updater had already downloaded the patches, all I had to do was confirm the installation.

    People can whine all they want about that there are security flaws and ofcourse it's sad these still pop up, but the patches are there, the system to install them is VERY easy (just click one single button) so in the end, the end-user is not that much hurt by them, simply because the patches are installed so easily.

    The discussions about 'security flaw free' software are endless and allthough they should be held, are nowhere near consensus: as long as there are humans involved in hammering out code and as long as the computer/software based checkinglogic is not up to par as where it should be, these flaws WILL be there, possibly in every tool written by man. Until computer science reaches the point where a compiler can proof that software is security flaw free, we should be grateful that the FIXES for security flaws are installed using the most easiest way: by simply clicking one single button.
    • "we should be grateful that the FIXES for security flaws are installed using the most easiest way: by simply clicking one single button."

      No. That is their responsibility.

      On my redhat servers I do not have to click anything or reboot for updates. I just read my email to see what was done. I believe that you need to go reboot your servers now?

    • One thing that's always bugged me about these kinds of updates? What do you do if the machines don't have internet access? I know that that invalidates most of the vulnerabilities (except inside the lan), but what happens someday in the future when the machine finally goes online and tries to download 3000 security updates?

      Maybe vendors should have to release these updates on CD as well.

      NOTE: I'm not focusing on MS here, other vendors should be asked to do the same.

  • Just got this in my inbox? (Score:4, Interesting)

    by oliverthered ( 187439 ) <oliverthered@hotmail. c o m> on Friday June 28, 2002 @07:34AM (#3785630) Journal
    i'm waiting for someone to do a dns hijack of update.microsost.com and load a
    nice new trojan on everyone's box that their av software doesn't detect. if
    these morons were serious about security, they'd use ssh, not http, for
    updates (and let you turn off html rendering in your email client).
    • The email was from Thomas Greene of The register [theregister.co.uk] fame.
      So I better give him the credit.

  • So who actually read the technical right up: (Score:4, Informative)

    by Mr Guy ( 547690 ) on Friday June 28, 2002 @08:36AM (#3785868) Journal
    This isn't really a Media player bug, even though the media player allows it to happen. This is an IE/Outlook bug.
    From http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/bulletin/MS02-032.asp [microsoft.com]
    What causes the vulnerability? The vulnerability results because of a flaw in how Windows Media Player handles certain types of licenses for secure media files when the media file is stored in the IE cache. Specifically, when a type of secure Windows Media file is opened, the media player erroneously returns information to the server that discloses the location of the IE cache as it processes the request to the site for the licensing information.
    If you don't use IE or Outlook, you are fine.
    • If you don't use IE or Outlook, you are fine.


      That's the problem. You have to use IE. It's what Windows Media Player uses to draw its window. It's integrated in the operating system, remember?

  • Geez... (Score:2, Funny)

    by edremy ( 36408 )

    Will I ever get the bang for my MS buck?

    Timothy, you do every day. What would /. be without the daily "M$ sucks! Lets all post about how horrible M$ is!" story to increase those page loads?

    Why, /. might actually have to talk about things of interest to geeks!

  • Given M$ history with backward data compatibility (Score:5, Insightful)

    by crovira ( 10242 ) on Friday June 28, 2002 @11:07AM (#3786661) Homepage
    and their repeated use of backward IN-compatibility to force people to upgrade or lose access to their old data, this phrase from "Cringely's Pulpit" scared the fuckin' crap out of me: "then encrypting the data EVEN INSIDE YOUR COMPUTER PROCESSOR."

    Its the ultimate in Big Brother technology. The eradication of memory or of access to memory.

    Ever seen people with disorders of the hipo-thalamus? They can't form short term memories. Their lives are hard and extremely confusing since the world is a new mystery every damn day. They are extremely vulnerable to being scammed from one minute to the next.

    Whoever proposed this inside of M$ is an absolute diabolical monster. A human being (given the events of the last two centuries and the incredible slaughter perpetrated on each other, that is NOT a compliment,) with delusions of god-hood. One that looks bad even compared with the most the megalomaniacal tyrant to slaughter people in order to change their minds about something.

    At least when you kill people, you're show for the sub-simian scum you are and/but your victims a're well and truly safe from further predation.

    But this deliberate creation of the potential for maiming of the aggregate memory of an entire culture makes the death camps is so utterly base, so vile, so despicable, so ... I'm a loss to find words to describe the enormity of the evil.

    And M$ will find enough "Judas Goats," enough imbeciles to plunge mankind into a second dark ages. Would that the road to the coming Hell was not paved with moot intentions and banal disregard.

    Slavering drooling monsters and utter despicable despots, we can overthrow. But our doom will come in the form of some utterly reasonable man in a suit who's just doing his job.

    There are a hundred million graves prematurely filled by the victims of some utterly reasonable men in some (uni)form of suit, who's just doing his job.

    The ultimate triumph of Voltaire's bastards will be even more thorough and degrading than the patrician nightmare of the religious maniacs who merely preach evil and bring subjugation and death.
  • Will I ever get the bang for my MS buck?

    Just remember, YOU'RE the bang-ee.

Slashdot Top Deals

For God's sake, stop researching for a while and begin to think!

Close