Microsoft Refuses To Fix NT 4.0 Exploit 735
shmigget writes "The Register is reporting that Microsoft is throwing in the towel as far as NT 4 is concerned on the latest security flaw to affect Windows 2000, XP, and NT 4. They quote Microsoft as saying 'The architectural limitations of Windows NT 4.0 do not support the changes that would be required to remove this vulnerability.'" There still is a workaround for NT 4.0. Instead of patching the problem, it's advised to firewall off port 135 on an affected machine.
ZoneAlarm (Score:5, Funny)
Re:ZoneAlarm (Score:2)
By firewalling, you merely hide the problem, you don't fix it.
Re:ZoneAlarm (Score:4, Interesting)
Moving on: I really don't see what the big deal is, so what if MS doesn't patch NT? The only people using NT are businesses that are reluctant or unable to upgrade. And since a firewall is a must for any business that has a link to the outside world (or even on a closed network for that matter, after all, if the workstations hooked up to the network, it's no longer secure). That being said, any good admin can patch this bugs with their trusty firewall and a few clicks.
Anyway, I'm really looking for a good OSS firewall. So any recommendations would be nice. Thanx!
Re:ZoneAlarm (Score:5, Interesting)
Linux: iptables
*bsd: ipfw
Having said that I have a growing dislike of firewalls for the simple reason that they tend to be overused and improperly implemented.
Traffic control is good. Thinking blocked ports or auto firewalling portscanners is going to make your network any more secure is not smart. I've also seen people block potentially insecure ports instead of closing them on the machines. Too often I find firewalls as the justification for the use of insecure crap like Exchange or Lotus Notes.
On the other side firewalls also tend to be set so strictly that they block legitimate traffic. It's getting comon to Block all ICMP messages even though they are needed for things like packet size negotiation and error reporting.
ZoneAlarm is a horrid example of an overzelous firewall blocking legitemate traffic and scaring users on the risks of harmless things like ident checks. Leads to fun things like ISPS shutting off servers over complaints from cluless users armed with Zone Alarm logs.
Re:ZoneAlarm (Score:3, Funny)
I hate firewall admins that block all ICMP. I hate them. It should be legal to kill them... well... at least hurt them.
I work with the DoD. They use encryption devices quite a bit. These devices always request fragmentation (they need some room too you know). I don't know how many times I've pleaded with a firewall admin to let ICMP type 3 (code 4) through.
I'm star
Re:ZoneAlarm (Score:4, Informative)
That's why you use rate limiting for logging, like this:
$fw -A FORWARD -p icmp -m limit --limit 10/min -j LOG --log-prefix="NEW RAPID ICMP "
will only log 10 outbound ICMPs per minute. Adjust to suit your personal preferences/requirements.
Re:ZoneAlarm (Score:3, Insightful)
Including logging.
What means, never try to log the intrusion attempts, leave alone portscans, every connection, etc. unless for the purpose of studying them.
Re:ZoneAlarm (Score:5, Insightful)
Some businesses are reluctant to upgrade because they are running mission critical apps (even on Windows) where changing the OS may force them to go through some sort of lengthy and expensive tests.
I once worked on software running on an archaic version of Unix. The OS was never upraged because doing so would force them to get the entire system recertified by the FDA (it was a system used in medical diagnostics). As it was, it was a pain to recertify individual programs on this system.
Re:ZoneAlarm (Score:5, Insightful)
And some businesses don't want to upgrade because of the cost. Not only would you be looking at licenses, but also hardware upgrades, retraining of IT staff, taking time out to plan an Active Directory implementation and all the testing involved in seeing if your apps run properly in the new environment. For a medium to large sized company that can represent a huge investment in time and money just to stay supported.
Re:ZoneAlarm (Score:3, Insightful)
MS OSes are unsupportable after three years simply because MS wants you to upgrade fast so they make more money. There are lots of IBM customers running computer systems 10 or 20 years old, and IBM has no problem giving them support. Sun is the same way.
Re:ZoneAlarm (Score:3, Insightful)
What did you think Windows ever claimed to be? A cheap, poorly-written OS that aspired to replace Unix but failed miserably? That may be the reality, but MS has been claiming all along that Windows NT and its successors are supposed to replace Unix, VMS, AS/400, and mainframes, so your argument seems to fa
Re:ZoneAlarm (Score:5, Interesting)
Because HVAC systems, for example, get old and become unsupportable by wearing out. Through daily operation they become no longer able to do what they once did. This does not happen to OSes; the IBM 1620 monitor still does everything it did on the day it was released, if you can find a 1620 in running condition. 1,000,000 years from today, MS Windows v1 would still function as it always did if someone would provide hardware it can run on.
OSes "become unsupportable" because the vendors get tired of servicing the stuff they sold and would rather play with shiny new stuff (which earns bigger margins). "Unsupportable" actually means "we don't feel like meeting the needs of our customers anymore, unless they pay for our latest innovations whether they want them or not."
I'm always wary of saying, "we *cannot* do soandso". In software that's usually malarkey; we *can* do that but you won't like the cost. So, be honest and say that, instead of pretending that something is impossible when it clearly is not. "We can fix NT4 for you, but it will cost you $1 million" is honest and at the same time will deter just about anyone pressing for a fix. And if some customer is really ready to pony up $1 million to fix an 8-year-old system, take the $1 million and deliver the fix. Congratulations: you just found a million bucks in unanticipated revenue!
Re:ZoneAlarm (Score:3, Funny)
Re:ZoneAlarm (Score:3, Informative)
Re:ZoneAlarm (Score:4, Funny)
Re:ZoneAlarm (Score:2, Insightful)
Re:ZoneAlarm (Score:3, Funny)
Re:The Ford Version of M$ (Score:5, Informative)
Sorry, but due to the design limitation of your 1965 Ford, we are unable to retrofit your car to fix a recently-found problem in the braking system. Third-party companies may provide small fixes that can help alleviate (but not completely fix) the problem. This problem is not present in our current line of products.
Windows NT 4.0 hit end-of-life [microsoft.com] back on December 31, 2002. An IT department should know that commercial software companies, MS included, routinely EOL software and drop support for them. A 7-year-old OS is going to have moth holes in it. If your company cares about security, upgrade to something more modern and (theoretically) secure. If you can't afford it, then evaluate migrating to OSS solutions. If you can't afford that, well, you're in big trouble.
MS makes it clear on their Product Life Cycle pages what support they plan to give for all products. Anyone caught surprised by this probably shouldn't be making IT decisions for an organization any larger than 1.
Re:The Ford Version of M$ (Score:3, Insightful)
More linke your 1996 Ford only lasts four years, after that, we refuse to maintain it.
Unlike car manufacturers we do not publish full design information or permit reverse engineering. Not only are you on your own, we'll sue your ass off if you even ty to fi
Borg icon (Score:2, Insightful)
Re:Borg icon (Score:2)
Re:Borg icon (Score:3, Interesting)
Actually, it's not. As a matter of fact, everytime I see it I wince then roll my eyes. It's about as subtle as an iron pipe to the head; hell, I can't remember ever finding it even slightly amusing.
Re:Borg icon (Score:3, Informative)
I never cared for the Borg icon--I think the GPL is just as Borg-like as MS. The new icon is too dark. It looks like a box with some features on it that are difficult to make out. I had to read the alt in the image tag to figure out it was "Windows". I don't see anything wrong with using a window as the icon for Windows, just find one that's lighter. I'm not sure what restrictions MS places on use of the Windows logo, but if they can use it than that's what they should use--just like they do for Apple.
Re:Borg icon (Score:4, Interesting)
Why in the world are you expecting objective news here on
Re:Borg icon (Score:5, Funny)
Me too. However, since we're discussing a Windows security hole, shouldn't one of the glass panes be broken?
Re:Borg icon (Score:3, Funny)
-Announce a 'strategic partnership' with the Plexiglas people
-Send their own team of glaziers to study Plexiglas
-Suddenly announce that they are changing strategic direction and dissolve the partnership
-Six months later, Microsoft ClearPane, which looks remarkably like Plexiglas, is shipped.
~Philly
No surprise (Score:5, Informative)
No, I don't like it... but support for NT4 is dropped at 30 june 2003 and that's not really far away.
Re:No surprise (Score:5, Insightful)
However, support for NT4 is dropped on June 30th, NOT March 26th. They should still support their products with something better than a half-assed work around.
How can we trust that Win 2003 support will end 4 years after its release, and not when they come across a "really difficult" problem that may require some thought and work?
Re:No surprise (Score:3, Interesting)
Haha, I found that sentence funny.
If you're looking for something better than a "half-assed" work around, why are you using NT4? After the Win9x series, I'd say it's Microsoft's worst product. Windows 2000 replaced it, and is much better.
Re:No surprise (Score:5, Funny)
oh, you are so forgetting microsoft bob [telecommander.com].
Re:No surprise (Score:3, Informative)
I can't comment on Word as I rarely use word processors anynway. Developer studio isn't a bad product - despite lacking a few features (including an ANSI C compiler). Windows NT is really not a good product compared to some things they offer.
Re:No surprise (Score:3, Informative)
Re:No surprise (Score:4, Insightful)
Perhaps they had an analyst estimate the time/effort involved in fixing this issue, and found that it's based on such a fundamental flaw in the very foundation of NT 4.0 that it would take until well past June 30th to code a fix. If that's the case, then they're not actually cutting off the support early.
I dunno. Just a thought.
Re:No surprise (Score:5, Informative)
http://www.microsoft.com/ntserver/ProductInfo/Ava
The key part of that page is:
On the page that you linked to, the end date for System Builder (ie: OEM) availability for NT 4.0 Workstation is 30 June 2003 whereas the end date for online support is 30 June 2004.Re:No surprise (Score:5, Informative)
Considering that this is a security vulnerability that they are talking about, Microsoft needs to look at what they committed to their customers in that timeline and better get a fix out ASAP!
Re:No surprise (Score:5, Funny)
Didn't you read the EULA? It specifically said, "This product is supplied without any warrantee for any use whatsoever. Even as a high tech coaster in an oversized box. If the media is damaged, we will replace it with undamaged media, which we also don't guarantee has any usable software on it, within 90 days of the purchase date. Do not use in the presence of electric current. If cough persists, discontinue use."
Re:No surprise (Score:5, Insightful)
Who wants to buy an operating system from a company that lets their OSes die before their EOL? I sure wouldn't. The point of an EOL announcement is telling the world that 'as of xx/xx/xx, this product is dead as far as support goes'. Not 'when date xx/xx/xx is nearish, you're SOL'.
But, then, I'm just an admin, what do I know?
Re:No surprise (Score:5, Interesting)
For that matter, who wants to buy an operating system whose security fixes can only be released(or not released, as seen here) by a single company, due to it's closed-source nature?
The only fix is to firewall off the server? WTH kind of a fix is that? That's one step away from keeping the network cable unplugged!
Re:No surprise (Score:2, Interesting)
This is true. However, as a company, you'd think that MS would feel obligated to support its products until the minute they drop support...which in this case isn't for another couple months. This would be like buying a new TV with a 1 year warrantee and bring it back 11 months into its life for service only to be told, "Sorry, it's just too close to expiration for us to care."
As I type this on my NT box
design flaw (Score:2, Funny)
So why do they keep trying with NT 6 er.. XP
Re:design flaw (Score:5, Interesting)
Windows 2000 Professional was Windows NT 5.0
They're not very different from what I've seen. Cleartext, Skinnability, User switching, and a new UI are the only differences I've noticed.
Hot News... (Score:4, Interesting)
Re:Hot News... (Score:3, Insightful)
Funny how w2k was fixed with this vulnerbility. Its not too broken. What is broken as Microsoft's wallet and quarterly expectations. They wanted to end NT4 support back in 2002 but enough people complained so they extended it until this June.
Microsoft does not want to spend money fixing a product in which people no longer buy. To them it just costs money to fix since its no longer on sale. What economic benefit is that?
If customers need the patch fixed then they need to pay Microsoft to fix it. Up
It's old (Score:5, Insightful)
Re:It's old (Score:3, Informative)
And you'd be suprised at how many old systems are churning away in business and industry. The Y2K projects led to scrapping of many old systems, but old systems are still there. Much of a case of "If it's not broke, don't fix it." and getting the highest possible return on investments.
Mmmmm... Money (Score:2, Funny)
"Well, it's too hard to fix on your existing install, but if you upgrade to a new OS, we'll be happy to fix it." - MS Exec
"Umm, ok, I guess." - Unwitting companies
There is no step 2, baby, it's all profit!
While I like a good MS bash.... (Score:2, Insightful)
Re:While I like a good MS bash.... (Score:3, Insightful)
How much (Score:2)
These days it's all Windows 2000 and XP, and people are considering dropping the 2000 support sometime in the near future.
Re:How much (Score:2)
Re:How much (Score:5, Insightful)
Re:How much (Score:2, Insightful)
Microsoft security (Score:2)
Re:Microsoft security (Score:2)
What about Microsoft's SLA's? (Score:5, Interesting)
Seems strange but... (Score:5, Insightful)
Then again, people still buy new models of cars which have had huge saftey problems in the past, even though other choices are availble; perhaps the real phenomenon is that marketing is sometimes more powerful than good judgement.
Re:Seems strange but... (Score:2)
Wow. (Score:2)
They're basically saying that they can't fix it because the OS makes it impossible to do so. Not because it's inherent in some protocol, or because it is a natural effect of some kind of desired behavior or something, but because the OS DOESN'T SUPPORT IT?????
That's just wrong.
Re:Wow. (Score:3, Insightful)
They're basically saying that they can't fix it because the OS makes it impossible to do so. Not because it's inherent in some protocol, or because it is a natural effect of some kind of desired behavior or something, but because the OS DOESN'T SUPPORT IT?????
That's just wrong.
You're working yourself up here... Consider this like Red Hat
Re:Wow. (Score:5, Insightful)
Except that the source code to Red Hat 3.0 is publicly available, so a fix could be made by anybody. The problem here is that the only people who could fix NT4 is Microsoft and they are refusing to do so. Worse, we can only take their word for it that a fix would be nearly impossible.
I'm not a big proponent of open source, but this is a case where there are clear advantages.
Re:Wow. (Score:2)
They should have probably used the word "infeasible" rather than "impossible". But then I'm no marketing weasel. Perhaps they had their reasons.
End of Life (Score:4, Interesting)
I'm mean we all go on about how bad MS is but you can expect them to support everything forever can you?
Rus
Re:End of Life (Score:2)
No, you're right. But wouldn't it be great if you could had the source code available so that you could backport a fix? Granted NT is ancient in computer years, but lots of shops still use it extensively.
Fair point. In that case... (Score:3, Interesting)
Yeah, I know, wishful thinking. Makes no sense if most people would rather just pay for an upgrade.
Re:Not until 06/30/03 it isn't! (Score:3, Informative)
And here [microsoft.com]
Just goes to show you should look up your facts (Score:5, Informative)
It's ok (Score:3, Interesting)
Kinda makes one think of benefits of open source; if something like this happens, you can always hire some hacker to fix the hole, wherever it is, for the right amount of money.
nt (Score:2)
NT4 needs to DIE. If you prefer the Windows platform, you've had ample time to move to 2K, or else another platform.
Re:nt (Score:2, Insightful)
UPGRADING ISN'T ALWAYS
Please advise me: (Score:5, Insightful)
Solaris 2.6 maybe ? (Rapidly approaching EOL/EOS)
What else ?
Point is: NT4 is so old (and so BS), I can see why they want it to die (apart from the reason that they want to sell the new OSs)
be advised (Score:3, Insightful)
If you have a sun, you will be provided with software with all the fixes free of charge. A friend of mine bought a nice ultraspark on Ebay a while back and he was provided with all that he needed.
If you simply have a 486, all the BSD and Linux
Whats a Bxploit? (Score:2)
Rus
Re:Whats a Bxploit? (Score:3, Funny)
Or is it a bizarre acronym? Back-Exploit, 'cause its an old software version?
What's up with the topic and image? (Score:2)
So if it had been found earlier.... (Score:2, Insightful)
What's sad is that there is a 2k/XP fix...and I bet an NT fix would not be that hard considering they are quite similar OS's.
"Can't" isn't the same as "won't" (Score:5, Informative)
The article quotes them saying they can't fix it, there's too much stuff to do.
Using your firewall to block port 135 is fine, unless you actually need RPC for something useful. In that case, I'd say that a firewall that discards all malformed packets (more complicated) is in order. Or an upgrade to Win2K. After all, it's been out for, what, 4 years now?
Re:"Can't" isn't the same as "won't" (Score:3, Insightful)
If you're doing something useful with RPC, and you are not doing it behind a firewall (that discards all RPC packets), then you are dumb like bricks. RPC isn't something you want to be doing via the internet, afaik.
All their enterprise customers might be annoyed, but this should never affect them. If some
Honesty Filter (Score:5, Funny)
"Windows is fundamentally insecure. Suck it up."
Gotta love the honesty.
-Waldo Jaquith
... ways (Score:2, Funny)
Coming Soon! New Microsoft tagline (Score:5, Funny)
Doesn't have quite the same ring to it.
- JoeShmoe
.
Bxploit? (Score:2)
Give them a break. Really. (Score:5, Funny)
Plus, why are people so irksome in not upgrading to ever newer and more expensive operating systems like they're supposed to? Constantly forcing Microsoft to keep looking back over legacy code. It's ugly, dirty and scary back there, not like in candy XP land.
Done supporting it? Release the code! (Score:2, Insightful)
An explanation (Score:2)
Bring out your dead... (Score:3, Funny)
Microsoft: Yes you are, you just don't know it.
NT4: Really, I'm very much alive.
Microsoft: No, you're very sick and could give over any minute now.
(I'm so ashamed I can't recall that conversation verbatum...
Getting old, I suppose.)
Good opportunity to test open/shared source... (Score:5, Interesting)
Microsoft: "Um, we don't want to fix this. But here's the kernel source, so why don't you fix it for us?"
Beady-eyed kernel hacker: "OK!"
It's not such a silly idea [everything2.com] with a practically end-of-life'd product; bugs and exploits would get found and fixed and since Microsoft doesn't seem to want to support certain OS changes, we'd do it for them. And it would be a great PR boost. "Microsoft supports freedom to innovate!". Hm.
NT4 is as old as Linux 2.0.0 (Score:4, Interesting)
And yes, with Linux, you have the source, so you could fix this yourself, right? Microsoft says this requires a large architectural changes. I think any person or group willing to re-architect NT4 or the 2.0 kernel would better spend their time and effort upgrading to a newer OS version.
It's not the number of releases.... (Score:5, Insightful)
If I install a machine with 2.0.39, is there any known big vunerability? If one was discovered would there *then* be a 2.0.40? With free software there's not much interest in backporting features, since upgrading to the latest version is free, should you need those features.
Anything that has outlived it's time as the mainstream stable branch wouldn't normally be updated except for security fixes, so I expect both 2.0 and 2.2 to have very slow release cycles now. Unlike Windows, where you expect some feature creep (for example DirectX upgrades) without having to pay for an OS upgrade.
Anyway, this isn't really about that either, but it's about the EOL date Microsoft has set. What do you think would happen if RedHat said "Uh RedHat 8 is fundamentally flawed, so we won't fix this bug even though its still under support. Block this service, or upgrade to RedHat 9, oh and you'll need a new support contract for that version." Would you find that acceptable?
Kjella
Another workaround for NT4 (Score:3, Insightful)
MS is right... and wrong. (Score:3, Interesting)
Microsoft do have a point, NT 4.0 *is* 7 years old now (released 1996) and supporting it is probably a major headache for them, at least until June when it reaches end of life (bear in mind that end of life for most software is 5 years). How long can you keep patching software? I guarantee that if they did take the time to patch it many other things would break resulting in the need for more patching and more headaches.
On the other hand, they are still going to get a nasty backlash from the millions (billions?) of people still using NT 4.0. Yes, you can laugh at businesses who haven't moved to 2000 or XP yet but if you are a multinational company who depends on NT facing the huge costs of moving to 2000 it's a big deal.
Microsoft recommends we firewal port 135 - which every network administrator with a brain should already be doing! Unfortunately, good network administrators are in very short supply.
Re:MS is right... and wrong. (Score:4, Interesting)
I'm always suprised in how much volatility we've come to tolerate in software. In other industries, the customers would be fleeing in hordes.
I take all this as just more evidence that the software industry won't reach maturity for at least several more decades.
Comment removed (Score:5, Informative)
The crucial difference. -- open source (Score:4, Insightful)
Why they aren't making a patch, from Microsoft (Score:5, Informative)
The Windows NT 4.0 architecture is much less robust than the more recent Windows 2000 architecture, Due to these fundamental differences between Windows NT 4.0 and Windows 2000 and its successors, it is infeasible to rebuild the software for Windows NT 4.0 to eliminate the vulnerability. To do so would require rearchitecting a very significant amount of the Windows NT 4.0 operating system, and not just the RPC component affected. The product of such a rearchitecture effort would be sufficiently incompatible with Windows NT 4.0 that there would be no assurance that applications designed to run on Windows NT 4.0 would continue to operate on the patched system.
Sure it's idiotic that their system couldn't handle a patch. But if that's how it is, then it's a good thing they made their more recent versions dynamic enough to be fixable!
Translation. (Score:3, Funny)
Translated:
You will upgrade when i tell to you evil communist!
bullshit (Score:3, Insightful)
So let me get this straight (Score:4, Insightful)
So now Microsoft is refusing to issue a fix for NT 4, arguing that there is no way they could make it so that no other existing apps stop working. But a fix for 2k and XP has already been done. That's because of the great differences between NT 4 and 2k/xp, nonetheless they are based on the same product.
So how come that, being 2k and xp SO different from NT, that they can still run the same apps without needing any modification? How come there is no way to patch a NT4 system so that it can still run the same apps but they can surely do it over 2k and XP, and the same applications will still run without a problem over the same system.
This is clearly a move from Microsoft to force their customers to either upgrade their NT 4 installations, or else they are left to their own luck. Many people WON'T upgrade their NT 4 because that just works for them, because their hardware is not powerful enough for a 2k/xp system, or because any other reason they can think of.
Windows NT 4 has been in the market for about seven or eight years now (if my memory isn't failing it was released almos alongside with Win95). This recently discovered vulnerability has always been there since then. What would have happened if someone discovered before w2k was released? Would still Microsoft be unable to release a patch for it because it would break the whole system down?
I've seen many posts saying that noone should have port 135 open to the world. That port shouldn't be listening for request from the whole world, in the first place. There is no way you can know which ports that (for some obscure reason, valid for Microsoft of course) are listening represents a threat to the security of the system. Sure, the same could be said (no) about Linux and other systems, but there's always a way to shut them off and not let the system in a non working state.
And that's all I have to say about it.
ding dong the bitch is dead, (Score:2)
M$ Exec's - "Wats this respongeability you say?"
The kind of product support you would expect from a comercial Unix killer rather than the kind of "support" you got from windoze 3.1. Oh my, the difference was only a matter of time. Pthththfit! That's some kind of incentive to "upgrade" to w2k, I mean XP.
Re:Please....ths is not that big an issue. (Score:3, Informative)
Hmmm yes, except they say [microsoft.com] NT4 IS supported, until 2004. They also sell support contracts for it.
This is very bad because it screws up lifecycle planning.
Re:nt 4.0 came out 1996 (Score:3, Informative)
As a matter of fact RedHat 6.2 is still being supported, but not for much longer.
I imagine that you could easily hire somebody to support it for you, which would be quite feasible due to the availability of source code. You aren't tied to