New Windows XP Zero-Day Under Attack 241
wiredmikey writes "A new Windows kernel zero-day vulnerability is being exploited in targeted attacks against Windows XP users. Microsoft confirmed the issue and published a security advisory to acknowledge the flaw after anti-malware vendor FireEye warned that the Windows bug is being used in conjunction with an Adobe Reader exploit to infect Windows machines with malware. Microsoft described the issue as an elevation of privilege vulnerability that allows an attacker to run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights."
Upate to the most current (Score:3, Informative)
Remember kids. (Score:0, Informative)
Remember kids, use a free software PDF reader.
Re:Upate to the most current (Score:0, Informative)
Re:Upate to the most current (Score:4, Informative)
10" are not gone, just changed.
http://www.asus.com/in-search-of-incredible/us-en/asus-transformer-book-t100/ [asus.com]
Re:Upate to the most current (Score:5, Informative)
Re:Useless exploit, just gives admin to a local us (Score:4, Informative)
I don't know if you're joking, I suspect you are, but for the benefit of the following readers I'll explain.
Here's how it works. User is tricked into accessing an infected pdf which contains code to elevate the user's privileges. the infected document's code downloads further exploits to root-kit the box. Right now the exploit is in a pdf, but infected websites are sure to follow.
If it's out there, and it has a picture of a puppy (or, in the USA, the word "free"), some user will click on it.
If you read the TFA, then you know it also is a Server 2003 bug as well.
Privilege elevation exploits are a nightmare for Terminal Server and Citrix boxes because it is a conduit for installing tools (using the admin rights) to grab other users' credentials and to continue from there to own the entire environment.
Server 2003 as well (Score:5, Informative)
Did the submitter RTFA, or just submit as soon as (s)he saw the words "XP exploit" somewhere?
It's not mentioned, in the Slashdot article, but it's also a Server 2003 bug.
https://technet.microsoft.com/en-us/security/advisory/2914486
This means Server 2003 Terminal Servers and Citrix boxes.
Comment removed (Score:5, Informative)
Re:Upate to the most current (Score:5, Informative)
GP AC here. I looked around to see if Adobe had anything to say about this and I saw a post where an Adobe employee claimed that the inclusion of the McAfee software was required to fund the development of Flash Player because they provide it freely to users. It was also pointed out that users can opt-out and how they supposedly understand users' concerns about bundled crapware so they will always offer an opt-out. I can't seem to find the link now, but the way it was worded just sounded so smug and entitled. The question that comes to mind is, why not make it opt-in instead? The answer is because their original intent was to trick users into installing it.
Isn't it funny how a multi billion dollar corporation that made shitloads per software license of Creative Suite (and individual component applications therein) and distributed Flash Player (a necessary plugin for their own customers' audience) for years without the need for bundled crapware is all of a sudden "forced" to start including it; all around the same time that they discontinued Flash support on mobile devices and went to an even more expensive subscription model for their bread and butter products?
I'd definitely say Adobe is evil.
Re:Upate to the most current (Score:4, Informative)
My CNC requires a parallel port which doesn't even exists anymore and my CNC software can't run on Windows versions above XP.
You can buy single lane PCIe parallel port cards for about $30. If you pick a decent one, they act like totally bog standard parallel ports and don't require drivers etc.
I don't know if you need harware virtualisation to connect the parallel port to a VM (I suspect not, but such processors are cheap now anyway--I think AMD offers it across the range).
There's a good chance the PC will die long before the mill: a good, well maintained mill will last nearly forever. Probably worth investigating contingencies for when that happens.
Also, have you checked to see if the mill runs off g-code? Many do which makes it pretty machine independent.