XP Systems Getting Emergency IE Zero Day Patch 179
msm1267 (2804139) writes "Microsoft announced it will release an out-of-band security update today to patch a zero-day vulnerability in Internet Explorer, and that the patch will also be made available for Windows XP machines through Automatic Update. At the same time, researchers said they are now seeing attacks specifically targeting XP users.
Microsoft no longer supports XP as of April 8, and that includes the development and availability of security updates. But the about-face today speaks to the seriousness of the vulnerability, which is being exploited in limited targeted attacks, Microsoft said. Researchers at FireEye, meanwhile, said multiple attackers are now using the exploit against XP machines, prompting the inclusion of XP systems in the patch."
Microsoft no longer supports XP as of April 8, and that includes the development and availability of security updates. But the about-face today speaks to the seriousness of the vulnerability, which is being exploited in limited targeted attacks, Microsoft said. Researchers at FireEye, meanwhile, said multiple attackers are now using the exploit against XP machines, prompting the inclusion of XP systems in the patch."
Microsoft has no spine. (Score:2, Informative)
Re:That's smart (Score:2, Informative)
Soo... apple is still releasing patches for OSX v10.1 "Puma", which came out the same time as XP originally... or is it that the OS X v10.5.8, the last supported OS by many of the machines from that time period (and came out between XP SP2 and SP3, to put things in perspective), is still getting security updates? Because the answer is no and no.
In fact, the oldest OSX which is still getting security updates (Lion) was released not quite three years ago. Great.
Re:just kill them already (Score:4, Informative)
Ironically, my laptop cost a lot more than my car.
The analogy isn't really fair, though. Your car doesn't get pulled abut and poked and investigated by random wandering people throughout the entire day looking for a vulnerability. Even in a crime-ridden area. Your car isn't a guardian on the front line between all your financial, personal and secret information and the public Internet (whether you have a firewall or not, the OS is still the guardian of your data here).
And, still, cars get recalled, discontinued, or just taken off the road no matter their age. If it's not a "vintage" car, good luck as it gets older getting it to pass whatever your local roadworthiness test is, especially with shrinking emission limits and tightened safety requirements.
I speak as someone whose car is 15 years old - I wouldn't touch a PC over 4-years-old for my own use unless it was incredibly well-managed (and, yes, I manage networks for a living and have managed much older PC's adequately - I'm only two years past a XP->Windows 8, Office 2003->2013, Server 2003->Server 2012R2 upgrade, precisely because it worked and it was managed adequately, but we still couldn't carry it forever). I speak as someone who buys an "old banger" of a car every time my one won't pass the next test or starts edging out of roadworthiness, and never pays more than the cheapest of new laptops for the next one.
XP is dead. Kill it. Stop dragging it. It was good and fun while it lasted, but 7 or even 8 (with some tweaks) isn't that much of a loss at all. And I've yet to see a decent reason for a program you are using not to be updated to run on 7 (and, sorry, that matters more than anything else - the OS is irrespective if you're putting all your trust, money and maybe even life / business into an app that people can't be bothered to maintain once a decade or so).
I've put people on Ubuntu in the in-between. I've pulled Windows 8 into a system people can recognise and get along with. I've needed to support the most dumb, and the most eager, and the most knowledgeable users simultaneously.
But XP is dead. The fact that I acknowledge it is extremely telling. I never kill anything without a purpose. It's tricky to even install the fucking thing on anything approaching modern hardware (a lot of BIOS do not support legacy IDE any more, and SATA installs can be a minefield of AHCI drivers in XP).
You want to keep it? Install Linux and virtualise it. But, for fuck's sake, stop running it as the primary barrier between your personal files, local network and the Internet (no Internet firewall in the world can stop you getting infected and spewing your data OUT of the network, especially in the consumer/home use price ranges).
Re:That's smart (Score:5, Informative)
Reality distortion field on.
Re:The irony? (Score:2, Informative)
No, you can only enable Automatic Updates and wait for them to get pushed down. The Windows Update site has not worked on XP for a couple years now, although I can't remember when it officially happened. It's the same with Windows Server 2003...
Re:just kill them already (Score:4, Informative)
Proper embedded applications using XP should be on Windows XP Embedded/ "Windows Embedded Standard 2009". WES2009 is XP based and will get security updates until 2019.