Slashdot Log In
Windows XP SP2 Could Break Some Applications
Posted by
CowboyNeal
on Sat Mar 06, 2004 09:23 AM
from the they-were-cruft-anyway dept.
from the they-were-cruft-anyway dept.
Denver_80203 writes "An article from InfoWorld states that the upcoming Windows XP Service Pack 2 could break some 'unsecure applications.' In a quote from Tony Goodhew, a product manager in Microsoft's developer group says 'It doesn't really matter how long it is going to take you to do the work; security is an important issue and developers need to start doing that work now.' Or: 'The great bulk of applications will not be affected by memory protection. The number one that leaps to mind is execution environments with just-in-time code generation. The .Net Framework is one.' Fortunately for us, they are offering a course to guide the unsecure masses."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Great! (Score:5, Funny)
Thank you Microsoft!
Re:Great! (Score:5, Insightful)
How are you suppose to correct these apps? I bet some don't even have company's behind them anymore.
Parent
Re:Great! (Score:5, Insightful)
It's hardly new for Windows to drop backwards compatibility in areas. Many applications which are partly 16-bit and partly 32-bit won't run on Windows XP, but do run on Windows 95/98/ME for example
Windows XP has application compatibility features which allow you to set the OS version to previous releases and provide compatibility with older registry layouts, for example. That kind of compatibility feature is unlikely to help with stricter security controls of course (unlesss there's an option simply to turn off the new security features).
Parent
Re:Great! (Score:5, Insightful)
Parent
Java? (Score:5, Interesting)
Is this supposed to mean that Java will stop working?
--t
Re:Java? (Score:5, Informative)
The right thing to do is to call VirtualProtect(addr, size, PAGE_EXECUTE_READWRITE, &prevProtect);
That will mark the memory pages as being read/write/execute (where as previously they were only read/write). People should have been doing this before anyway (as the pages were never guaranteed to be executable), and if they didn't it's their bug.
I'm betting that Sun can download the beta and test Java on XP SP2 to make sure they're compliant though. Hell, Microsoft could probably even do some compatibility testing for them and enable a compatibility layer for Java. But then again Sun might sue them for that. MS probably just wants to stay away
Parent
The "unsecure" list (Score:5, Funny)
Better security is good (Score:5, Informative)
Regardless, enforcing decent security like this is good.
Now all the hackers will have to try other methods of hacking windows, heh. I'm sure that there is no shortage of them!
Re:Better security is good (Score:5, Informative)
The RPC and DCOM changes are much more likely to have wider impacts - especially for enterprise applications.
The ICF changes are fairly light (unfortunately in my view) and not that hard for end users\admins to modify so even if there are issues workarounds will be fairly simple.
Parent
More work.....sigh. (Score:5, Informative)
For each software build, we have to test against the various OS versions, and different service packs builds. Not fun...
Duh??? (Score:5, Funny)
I don't think the will "cry out in anguish" if they've got any sense. In today's market they'll jump for joy, knowing that their jobs are safe for another few months.
Parent
You cannot make an omelet without breaking eggs. (Score:5, Insightful)
Granted it was needed as their reputation, in regards of security, has always been low to none.
I really hope this will rid Windows XP of future remote exploits, since that's still the biggest threat Windows is facing.
Having said that, this wont fix all security problems, there will always be the luser that executes whatever is mailed to him/her, but it's still a step in the right direction.
The blind leading... (Score:5, Funny)
The blind leading the seeing?
Where do you get the Beta (Score:5, Interesting)
'Tis a gentle touch of irony... (Score:5, Insightful)
I like it (Score:5, Insightful)
Second, they've gone so far as to break application compatibility in order to clean up a number of deeply embedded security holes in Windows.
Personally, I think this is a Very Good Thing(tm). Microsoft may finally be "Getting it"
Re:I like it (Score:5, Insightful)
I bet that most of the things broken should have been fixed back in the NT5 guidelines pre-Win2000.
Parent
Re:I like it (Score:5, Insightful)
While I agree, I'm becomming a strong advocate for looking at the world from the point of base motivations.
Microsoft is primarily motivated to keep stock prices going up -- or at a minimum -- stable.
If these changes become too painful for those who don't care about security, it will cause a decrease in the deployment of Windows XP and XP-specific programs.
If this happens -- or may happen -- Microsoft will do something to make people happy...even if that means back stepping.
That said, I can see them putting out XP SP2 (forcing the app vendors including MS themselves to deal with security) and then offering a variety of moderately painful workarounds. Ideally, the workarounds would break with each minor update, forcing the security issue.
Putting the changes in XP only, though, does fit with Microsoft's motivation to get people to upgrade. Now they can say "well, W2K is not nearly as secure as XP", even though they could back port the changes to W2K -- though there is no motivation to do so.
From motivations, though, it's hard to beat OSS on security. The code is there, and if something is not secure it will be made secure because the developers are personally driven to make it so.
(ObDisclaimer: Keeping in mind that security is always a process not a product. Tools can be handy or even critical, though how they are used and why is much more important.)
Parent
Sounds like... (Score:5, Interesting)
Actually, I'm very interested to see if the SP2 pop-up ad blocker will actually work in IE since MS has dragged their feet on this issue. Half the battles we have been fighting lately at work involve IE and pop-ups that install crap without any notification.
Memory protection only on 64-bit platforms for now (Score:5, Insightful)
Actually, only the Itanium and AMD K8 [microsoft.com] are affected by this immediately; Microsoft isn't yet marking memory nonexcutable by default on the good old x86 processors that we all use.
Regardless, it is trivial for developers to update their code for things like JIT compilers, with a simple function like this:
I added that piece of code to my company's JIT compiler some years ago, just to ensure that the proper flags were set. I figured Microsoft would eventually switch to nonexecutable data and stack segments, much like the OpenWall [openwall.com] project has done with their Linux patches. Glad to see Microsoft is finally taking the first steps.
Seen this coming for ages ... (Score:5, Informative)
A lot of stuff is going to break, but I think that this is good in a way. MS have finally put security ahead of backward compatibility. Once these changes are in place and apps are working with them, the system is going to be more secure. For once MS should be applauded - yes, you can argue it's a bit late, but at least they're doing it now.
If you want to check out what changes SP2 actually makes, have a read of this white paper:
Changes to Functionality in Service Pack 2 for Microsoft Windows XP [microsoft.com]
Lengthy, but worth a read, especially if you have apps that you think might be affected.
A downloadable version is available here [microsoft.com].
Good (Score:5, Insightful)
I highly doubt that Linux authors would think twice about breaking buggy apps to force the issue.
Microsoft just can't win (Score:5, Insightful)
Windows adds NX security to prevent buffer overflows, Slashdot bags on Microsoft for breaking a few apps in the process (apps which were arguably broken in the first place, just the spec was never enforced).
I understand there's a slight bias on this site, but Jesus Christ you guys.
Re:Microsoft just can't win (Score:5, Insightful)
Parent
Pain in the ass, but a step in the right direction (Score:5, Interesting)
Applications reported having SP2 problems (Score:5, Informative)
- Zone Alarm 2 (uninstall stops working)
- BS Player (driver fail to load)
- Roxio Easy Media Creator 7
- Microsoft Intellipoint 5.0
- Azureus BitTorrent client
- ATI's Rage3DTweak for Radeon
- Easy CD Creator 5
- eMule
- Tritton NAS-120's Managment Interface
- Leadtek WINFAST TV PVR (driver fail to load)
- ISO Recorder Powertoy
Also, a user reports the Windows XP SP2 firewall blocking incoming FTP traffic even without an installed firewall, and XP's built-in disabled.
Maybe it's "beta diseases", but it does seem like a lot to break for a service pack, even in a beta. These are usually quite stable as they contain mostly bugfixes, not Win32 API changes (which these problems are supposedely caused by).
execution-restricted memory by default (Score:5, Insightful)
Microsoft isn't stupid. I'm sure they'll figure out a way to allow old apps to run with the old allocation behavior. Their entire business relies on legacy compatability. At worst you'll need to set some flag on the application launch.
The other thing to note is that crackers have also had ways to defeat execution-protected memory for years as well. It makes a buffer overflow exploit a bit more difficult, but where there is a will there is a way.
For example, even if the protection prevents you from writing executable code directly into memory, you can still typically do things like overwrite the stack and hijack the program's execution to a system call with malicious parameters (in Unix, the classic call to hit is system()...no custom code execution required, just a 'rm -rf
Braddock Gaskill
Sun Hot Spot (Score:5, Interesting)
This is exactly what's needed (Score:5, Insightful)
Now microsoft has always tried to make it easy to run old programs. Think of how long dos lasted so businesses could use their old proprietary programs. This caused a lot of problems with windows crashing. Windows xp was supposed to fix that shit, but now a new slew of shit has come about. Now what they're saying with sp2 is that they recognize their customers want security and stability over backwards compatibility.
The reason they're finally starting to do this is probably to compete with linux since those people most likely had to leave their old familiar apps with new ones. They see that people would rather deal with the adjustment of a new look and feel over constant reboots.
Now while everyone can point fingers and laugh at
Remember guys, microsoft isn't stupid.
Only install odd numbered service packs (Score:5, Funny)
Besides, the combination of my Netgear firewall, McAfee Virusscan and just not opening strange attachments in my email protects me just fine.
Disable the HTML e-mail feature that I don't use! (Score:5, Informative)
Re:Disable the HTML e-mail feature that I don't us (Score:5, Informative)
Or you could just sit and blame Microsoft for your inability to read their supplied documentation pandering to a community that is as inept and continue to use the product without a clue as to how it works.
Parent
Tidbit from OSR - XP SP2 will break some drivers (Score:5, Informative)
According to their newsletter at www.osronline.com, XP SP2 will include mandatory runtime memory pool overrun checking for all drivers. While this will improve the OS' security, it will ALSO cause mysterious failures on upgraded systems due to poorly-written legacy XP drivers. I make no judgements as to the wisdom of this course, but it's definitely worth knowing about beforehand. Of course, if they'd done this FROM THE START, then there would be no failures from it with the upgrade...
The Emperor has no clothes (Score:5, Interesting)
Now MS says, with their new firewall, I don't *have* that option? Now anybody who wants to write an app to use a port must first notify MS that it wants to use that port.
Doesn't this mean that malicious programs will just quietly open up firewall ports on their own without notifying the user?
Secondly, what does this mean:
"Another product that Microsoft needs to update is the
"The great bulk of applications will not be affected by memory protection. The number one that leaps to mind is execution environments with just-in-time code generation. The
Translation:
Mostly only unmanaged C++ programmers will be affected by these security changes. If you had just programmed the Microsoft way to begin with and used
Memory protection only occurs on NEW processors. The vast majority of the world runs Windows on NON-SECURE processors.
Stranger still, Microsoft has had buffer overrun checking BUILT IN to Visual Studio
Lastly, Microsoft's greatest security problems are not buffer overruns or firewall holes. They're AUTOMATIC ACTIVEX control installation from malicious pop ups to install spyware. They're wide open access to the email address box and a by-default scripting system that allows malicious emails to respawn themselves. They're bugs in the Internet Explorer control that allow malicious URL's.
NONE of these "security innovations" even take a crack at stopping those!
What DO these security innovations do?
Destroy a previously lucrative software market for antivirus tools.
Take the firewall OUT OF THE CONTROL of the user and put it firmly inside the OS to determine what's good for you. (Remember DRM? Isn't it interesting that the main thing broken from this portion of the update are peer-to-peer apps and FTP sharing?)
Further entrench
I'm all for security, and now these boxes will be secure... But no moreso than the typical user installation out there today that uses a third party antivirus/firewall solution and keeps their system up to date with the latest patches.
This is about as effective at what MS did with Outlook XP and *by default* turning off the ability to get attachments out of your email. You had to setup a profile configuration OR edit your registry settings to get that feature back.
Y'know, there comes a point where you have to say, I can ride my bicycle without training wheels.
I understand that MS is fighting a bad PR image. But if this is how Microsoft "innovates"... Well, might as well just have lightweight users use Macs (which will hold their hands) and pro users/developers can use Linux.
Congratulations to MS (Score:5, Insightful)
Now, if we see built-in virus protection, tainting or sandboxing of executable code recieved by email, proper MIME handling, and flagging of double extensions, AND AUTOMATIC UPDATES THAT ARE ON BY DEFAULT, it'll be mostly there.
Even forcing users to take an extra step (like the 'chmod u+x' required on *NIX) to make emailed and downloaded files executable would help a _lot_. Sure, viri would just start saying "click properties, then tick 'executable'" in the messages; but it'd stop a lot of the worst offenders from viewing things without thinking.
This may affect Linux as well as MS (Score:5, Insightful)
In the past, MS has broken Windows 95/98 applications, but Windows XP/2000 had compatibility modes available for the older applications. If it is as they say, and newer apps will be intentionally broken without any way of going into a compatibility mode, this will be bad.
I have difficulty believing MS would not include some kind of compatibility mode, however. It'll be interesting to see what they do. It won't really affect me though, I don't use XP and can't stand that OS (Windows 2000 is still my favorite Microsoft OS; Windows XP is just 2000 with some pretty GUI changes and some compatibility fixes.)
Parent
Imagine the other headline (Score:5, Insightful)
Ok, imagine this alternate Slashdot headline:
MS sales buries secure XP
Itoldyouso writes - A leaked memo indicates that the Microsoft developers created a much more secure version of their flagship operating system. However, because it would have caused problems with a small number of applications that were designed insecurely, the Sales & Marketing teams vetoed the new secure version, in an attempt to avoid a customer backlash. It is now official - Microsoft's commitment to trustworthy computing is a complete joke.
I have a feeling that post would rile a lot more people here.
Parent
Re:Lets not bag on MS (Score:5, Insightful)
Does this Service Pack allow itemized upgrading? A reboot? Uninstalling broken patches? More than one reboot?
Parent
Re:Lets not bag on MS (Score:5, Insightful)
Parent
Microsoft's Long-Term Perspective (Score:5, Insightful)
You evidently don't understand how Microsoft works as a business. Unlike most software shops, they take the long-term perspective. Many of their competitors have learned this the hard way. (E.g., "Internet Explorer is a failure." As of version 3, it was a failure in terms of market penetration, but MS didn't care.) Full Microsoft product cycles typically take about ten years.
Every major new Microsoft product or technology takes the better part of a decade to take over the desktop. By about 2007-2008 or so, once there starts to be a large installed base of Longhorn machines (which will have .NET preinstalled), .NET will really start to take off for shrinkwrap applications. Five years down the line from there, it will be just about ubiquitous. In the meantime, programmers are learning it and it's becoming a familiar feature of Visual Studio (an excellent IDE).
Parent
Re:.NET framework (Score:5, Interesting)
Parent
Re:.NET framework (Score:5, Interesting)
Parent
Re:These are a few insecure programs that won't wo (Score:5, Interesting)
The real problem is that the benefits it (should) bring will not get deployed to the bulk of systems that need it - at 210Mb I can't see the majority of systems out there that really need it getting the whole thing downloaded, at least not within any reasonable time frame. Hopefully by the time it is actually released they will have a lite version on Windows update that can push the security improvements in a much smaller package.
Their decision to at least try to implement some long overdue fundamental improvements to the security of the architecture is to be welcomed no matter how over due it is. However despite that their decision not to add any outgoing filtering capability to the ICF doesn't make any sense to me and seems, well, just stupid really.
Parent
Re:Uh oh (Score:5, Interesting)
From the developer's guide [microsoft.com]. Emphasis mine.
The security technologies included with Service Pack 2 will allow for better protection against network-based attacks.. Windows Firewall is now turned on by default and all ports are closed except when they are in use.
I hope their firewall doesn't open ports automatically, or it's nothing more than swiss cheese.
Parent
Re:Uh oh (Score:5, Informative)
Parent
Re:Uh oh (Score:5, Funny)
Are we talking about Windows XP SP1?
Parent
Re:Uh oh (Score:5, Informative)
I believe, BTW, the problem is an integer overflow one; a length field has a number substracted from it without previously checking that it is large enough to not wrap around to 2^32-(a little bit). This kind of thing happens a lot, and was the cause of the most recent Apache hole (among many others), so criticising MS for having one similar is a little harsh.
Parent
Re:not surprised by /. (Score:5, Insightful)
No, it's soooo 2004. Anti-MS/pro-Linux bias was restricted to very small groups of hackers in the 1990's, but it's progressively growing into the collective conscience, as more and more security failures in MS software get more and more people pissed-off.
Parent
Re:Start doing that work NOW! (Score:5, Funny)
They that give up functionality to obtain a little security deserve neither functionality nor security.
Yeah, or something like that.
Parent
Re:some funny quotes (Score:5, Insightful)
There applications that will break are _not_ (necessarily) insecure. They just behave in a way that makes it impossible for Windows to tell isn't somebody trying to execute some code in an overflowed buffer.
Typical MS press relations, blame everyone else.
Parent