Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Windows Operating Systems Software Microsoft Security

Attack Code Found For Recent Windows Bug 184

Posted by Soulskill from the oh-by-the-way dept.
CWmike writes "Just a day after downplaying the vulnerability that caused it to issue an out-of-cycle patch last week, Microsoft warned customers late yesterday that exploit code had gone public and was being used in additional attacks. 'We've identified the public availability of exploit code that now shows code execution for the vulnerability addressed by MS08-067,' said Mike Reavey, operations manager of Microsoft's Security Response Center, in a post to the MSRC blog. 'This exploit code has been shown to result in remote code execution on Windows Server 2003, Windows XP, and Windows 2000.'"
This discussion has been archived. No new comments can be posted.

Attack Code Found For Recent Windows Bug More

Attack Code Found For Recent Windows Bug

Comments Filter:

  • Hmmm... (Score:2, Funny)

    by Anonymous Coward
    Lets see, perpetually vulnerable-to-script-kiddies Windows XP, or locks-up-every-5-seconds Ubuntu?

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Locks up every 5 seconds? What do you mean? What kind of computer are you using? Have you submitted a bug report?

      • Re:Hmmm... (Score:5, Insightful)

        by Venik ( 915777 ) on Tuesday October 28, 2008 @07:59PM (#25549231)
        Why should anyone bother submitting a bug report? If it's a minor issue and I have a workaround - sure, I'll submit a bug report. But if a system is completely unusable with Ubuntu, I will better spend my time finding a working alternative. Having said that, as a Unix sysadmin I have nothing against Ubuntu, other than using it on a server is not the best idea: there are many far more stable alternatives. The problem with most Linux aficionados out there is that few of them worked in a real production environment of a big datacenter. These guys may know how to configure Apache and MySQL on their Ubuntu PC, but they don't see a difference between getting something to work and getting it to be fast and reliable under constant heavy load.

        • Re: (Score:2, Insightful)

          by DiegoBravo ( 324012 )

          I also worked as Unix sysadmin for several years (but no longer... I love to sleep all night long) and from my experience:

          1) Most "big datacenters" have several key servers that are really unstable despite being Unix(tm), mostly because of evil combinations of HW/Applications/OS (patches and more patches from Oracle, NUMA configurations, etc)... as happens with any Linux.
          2) Most servers in datacenters are 99% idle, except when silly programmers try to execute infinite pooling loops or that sort of things. T

          • Re: (Score:3, Informative)

            by Venik ( 915777 )
            I don't know where you work, but unstable servers are usually a result of poor planning by system architects, insufficient funding, or inexperienced sysadmins. If I had any servers that were continuously unstable for the reasons you listed, I would lose my job. Sometimes you do have to support a system that has been outgrown by its users and applications, but there is no funding to get an upgrade and so you have to make do. This would be a valid reason for system instability. But to say that the server is c

            • Re: (Score:2)

              by wisty ( 1335733 )
              Inexperienced sysadmins? Why do sysadmins need experience? Don't your sysadmins get formal and on the job training and career development? Oh, I crack me up.

        • Well, you probably don't use a Debian based distro too much. To get a stable reasonably secure (known bugs out, most common DoS attacks out) and fast for the most common situations, you simply "aptitude install apache2".

          If you have a less common situation, you may want a different apache2 package, there are some other ones that differ on the configurations. Now, when you have a completely unusual situation, then you'll need to mess with apache configuration or maybe even compilation, but don't assume that a

    • Re:Hmmm... (Score:4, Interesting)

      by jimmyhat3939 ( 931746 ) on Tuesday October 28, 2008 @11:06PM (#25550591) Homepage

      I've run Ubuntu on a Dell Inspiron 9400 laptop for over a year without a single lockup.

      Now, I also run VirtualBox and Windows XP under that. *That* has locked up several times. So if that's what you mean, I agree.

  • Hotpatching (Score:5, Insightful)

    by nmb3000 ( 741169 ) on Tuesday October 28, 2008 @06:37PM (#25548441) Journal

    For those interested, there was a really cool hack [nynaeve.net] of hotpatching the files and services that are affected by this exploit. The Microsoft patch isn't designed to be hotpatched, instead requiring a reboot to replace the needed files. However, by using a binary diff and DLL injection you can apply the patch on the fly without rebooting.

    I wish Microsoft would put more effort into making the official patches not require a reboot. Consumer operating systems are one thing, but rebooting Windows servers gets annoying really fast.

    • Re:Hotpatching (Score:5, Insightful)

      by TubeSteak ( 669689 ) on Tuesday October 28, 2008 @06:50PM (#25548553) Journal

      However, by using a binary diff and DLL injection you can apply the patch on the fly without rebooting.

      Is that something you would want to do on a production server?
      And if you were MS, is that something you would want to support?

      • Re:Hotpatching (Score:4, Interesting)

        by Dr Caleb ( 121505 ) on Tuesday October 28, 2008 @06:57PM (#25548633) Homepage Journal

        >And if you were MS, is that something you would want to support?

        If you were MS, and wanted to brag about 5 Nines uptime, wouldn't you design the patch so you didn't have to reboot production servers once a month?

        Glad I spent all weekend patching, now that the exploit has escaped.

        • Re:Hotpatching (Score:5, Interesting)

          by vux984 ( 928602 ) on Tuesday October 28, 2008 @07:16PM (#25548771)

          If you were MS, and wanted to brag about 5 Nines uptime, wouldn't you design the patch so you didn't have to reboot production servers once a month?

          5 nines is ~5.3 minutes downtime per year

          You don't acheive that with a single Linux box either, unless you simply aren't keeping it up to date, even if you manage to avoid 'rebooting it' you are still going to have serious trouble reliably preventing 'unavailability of services' from reaching 5.3 minutes over a year.

          It takes either a mainframe or a cluster to reach 5 9's with any reliability. Windows doesn't run on a mainframe, and if you have cluster, a few scheduled reboots now and then don't result in any downtime, since you don't have to bring the entire cluster down.

          So your argument really doesn't apply.

          • Re: (Score:3, Interesting)

            by MostAwesomeDude ( 980382 )

            No, I've managed to have a single Linux box reach 99.999%. It's mostly a matter of not updating the kernel; everything else can be upgraded monthly with ~15 seconds downtime, for an average of ~3 minutes annually.

            • Re:Hotpatching (Score:5, Insightful)

              by vux984 ( 928602 ) on Tuesday October 28, 2008 @07:58PM (#25549215)

              No, I've managed to have a single Linux box reach 99.999%

              "Managed to have"? You are talking about 5 9's as something that you can reach. People who demand 5 9's consider that the minimum they will accept. They don't want systems that can reach 5 9's they want systems guaranteed not to be less than 5 9's. That's a HUGE difference.

              So if we sign an SLA, how certain should I be that you can deliver 5 9's? ... From one box? Not very.

              That fact that you might 'manage it' simply isn't good enough. What happens when a piece of hardware fails? or if an update doesn't go smoothly? With a single box you have no contingency and 5 minutes to resolve any problems and perform any updates that might be needed for the entire year.

              My point stands: anyone serious about delivering 5 9's simply isn't using a single box, because you simply can't depend on it. MAYBE you'll get 5 9's out of it, but getting 5 9's from a single box is like winning a prize from a scratch and win. Its not exactly a miracle, but its hardly something you can rely on.

              Hell, even promising 4 9's from a single box is taking on some heavy risk. It's not hard to envision an unexpected hour of downtime on a box over the course of a year.

              • Re: (Score:2)

                by mlts ( 1038732 ) *

                If someone is promising a high quality SLA, they almost never will be using one box for their offerings. They will be using two or more machines connected via redundant disk controllers to a common SAN or disk array, and all the boxes will be connected to each other via heartbeat monitors.

                The good thing, both VMWare and Hyper-V in Windows Server 2008 help make this task a bit easier, by allowing for a virtual machine to be hosted on a cluster, so if the primary machine fails, the others can take over witho

            • Re:Hotpatching (Score:5, Funny)

              by caluml ( 551744 ) <slashdot@spamgoe ... minus herbivore> on Tuesday October 28, 2008 @08:50PM (#25549647) Homepage
              My current longest uptime:

              $ uptime ; uname -r
              00:49:19 up 1222 days, 14:09, 1 user, load average: 0.00, 0.00, 0.00
              2.6.11-hardened-r14

              Yeah, it doesn't actually do much. Just lets me win willy-waving matches.

          • 5 nines is ~5.3 minutes downtime per year

            You don't acheive that with a single Linux box either

            Wow--5.3 minutes per year? Shit--that's like 8 reboots on my linux box...

            Even though they release kernel updates for my distro about once per month, most of them involve being a local user to exploit some strange privilege in some strange area of the kernel that I don't use--and I don't have local user accounts except for root and a few services like maybe mail, dns, and/or possibly apache. So once you take out all the updates that aren't remotely exploitable, I end up with about 3 reboots per year--an

            • Re: (Score:2)

              by Splab ( 574204 )

              You have no idea what 5 9's are all about if you think that one box can handle it.

              • You have no idea what 5 9's are all about if you think that one box can handle it.

                Yeah, I do know what 5 9's are all about.
                You could do it with one box--but you'd have to be damn lucky.

                The point I was trying to make is that I have a handful of linux boxes at various client sites doing things like intranets, spam filtering, IM servers, etc...most of them have 5 9's of uptime BY ACCIDENT. It's not like I'm promising the clients 5 9's of uptime or anything--I just maintain the box and it gets it. Sure, one of these days a drive will fail, and my response time will be 30 minutes or so,

          • The majority of them, that is, you know, the ones with 400+ days of uptime.

        • You are an idiot. 5 9s gives you just 5 minutes per year of downtime. You think if something fails in a system, you can get it back up in 5 minutes? Hell no. You want reliability like that, you do it with redundant systems. Well, in that case the individual units can certainly go down. Perfectly valid strategy. You patch them whenever you feel like, making sure that only one is down at a time and that it comes back up to full operational status before you do the next one.

          A single system, well you are just r

      • Re: (Score:2)

        by Chirs ( 87576 )

        Actually, yes. The company I work for has spent a fair amount of resources to enable safe patching of running binaries. When you're aiming for 99.999% uptime and better, rebooting to apply a patch is suboptimal.

        • Re: (Score:2)

          by ozphx ( 1061292 )

          Your company sucks.

          If taking a single node down is going to unacceptably increase your risk, then you are in the realms of "trying for 5 nines", and not "guaranteeing 5 nines".

          The risk of corrupting process state is going to be a hell of a lot worse than a reboot, and the cost another node is going to be less than a "fair amount of resources".

      • Re:Hotpatching (Score:4, Informative)

        by DamnStupidElf ( 649844 ) <Fingolfin@linuxmail.org> on Tuesday October 28, 2008 @09:05PM (#25549797)

        Come on, it's dead simple and it's safe. Just install a page fault handler and mark all the pages of the DLL as being unavailable, examine the current thread state of all processes and mark them if they are currently executing in the unavaiable pages, and if so simply return success from the page fault handler until the thread leaves the locked region (essentially single step through the DLL until it finally returns to the caller). If a thread was not originally executing in the protected pages and enters it, just stall it. Once all threads are stalled or not accessing the locked pages, patch the DLL and mark the pages available and uninstall the page fault handler.

        What could possibly go wrong? Only if the data structures that the DLL uses internally are modified will this be difficult, in which case the patched DLL will just have to convert its own data during the patch time. If changes to user data structures are required, then the patched DLL would have to burn some space in each new data structure to identify it as a patched version and treat it appropriately, while detecting the old data structures reliably. That might be a little harder than the general case, but not impossible.

        Is getting 0wned something you would want to happen on a production server that can't have downtime?

    • Re: (Score:3, Informative)

      by cheater512 ( 783349 )

      Just switch to Linux servers instead.
      The ability to not require rebooting for years comes as standard. :)

      Downtime due to upgrades is limited to how fast you can restart the app.
      You can swap the files while its still running, then just restart it.

    • Me: Did you shut down the server?
      Other Tech: Nope. I thought you did it. Now I can't get to the internet.
      Me: Son of a bitch... Automatic Updates again... it needs a power-off and then cold start to work.
      *15 minutes later*
      Me: Where the hell are the backup tapes?
      Other Tech: I have no fucking clue. What the hell did you do?
      Me: I learned to never trust automatic updates. That said, I have a resume` to refresh.
      Other Tech: But nothing is working still.
      Me: Your problem now.
      *2 minutes later*
      Me: I can't ev
    • What would be smart for Windows to do is to not randomly reboot. For example, I was asked to run a PowerPoint presentation at a funeral. No problems there, except the laptop was running Vista, midway through the presentation the computer showed "Logging Off" and the computer rebooted. Naturally, there wasn't anything I could do about it, I rebooted the thing and it ran mostly smoothly the rest of the way, but seriously MS, by default don't reboot I don't care if its a patch that if not applied it can turn

      • Re: (Score:3, Insightful)

        by tlhIngan ( 30335 )

        What would be smart for Windows to do is to not randomly reboot. For example, I was asked to run a PowerPoint presentation at a funeral. No problems there, except the laptop was running Vista, midway through the presentation the computer showed "Logging Off" and the computer rebooted. Naturally, there wasn't anything I could do about it, I rebooted the thing and it ran mostly smoothly the rest of the way, but seriously MS, by default don't reboot I don't care if its a patch that if not applied it can turn

        • Upgrade your software. Seriously, if you're a business, you shouldn't be using Home versions of the software.

          A) It wasn't business, I was doing it for a friend because I was the only mildly technically inclined person she knew, B) it wasn't my laptop (otherwise it would be running Ubuntu) and I wasn't really given much of a choice to use a different laptop but then again I didn't think that Windows would randomly restart (haven't been an admin of a Windows box for ~3 years, done some work for work on an XP box but wasn't admin and do a bit of VM with XP every now and then)

          The HOME versions of XP and Vista (XP Home, Vista Home Basic, Vista Home Premium) do this automatically. Supposedly there's a way around it with some registry hacking, but I've never bothered. You get around 5 minutes from when the dialog pops up to hit the "Reboot later" button, which just silences it for another 5 minutes.

          And who thought this to be a good idea

      • Re: (Score:2)

        by Allador ( 537449 )

        There is not a mechanism for this to happen in windows unless you (or your sa's) specifically configured it to do so.

        So this wasnt MS doing anything to you ... this is you setting something to happen and forgetting that you did so, or your SA's setting it to happen.

    • Re: (Score:2)

      by mlts ( 1038732 ) *

      Actually, in production critical environments, they go through a staging process where they try a patch on a test box or two, then put the patch (even if its an out of band emergency fix) on a WSUS server that the production boxes update from.

      This is very important. I've seen 0.01 revisions for firmware for a hardware issue which are just relatively small fixes to install make terabytes of data inaccessible until the machine was backed off and restored... and a production machine being down for 7 hours usu

  • That's it! I'm switching to a Linux Desktop (Score:5, Funny)

    by Anonymous Coward on Tuesday October 28, 2008 @06:43PM (#25548493)

    Slashdot's unbiased coverage of an exploit for a patch that was released last week has finally convinced me to stop using MS products. I'm also beginning to think this MS might be evil as well.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      LOL! Yea... especially considering that doing some SIMPLE things like these:

      1.) Stopping "File & Print Sharing", via your local connection, removing it as a Client/Protocol there (if you're not on a Lan Manager based OR Active Directory IP based LAN/WAN, or home network? Who cares! It's slowing you down just broadcasting extra packets anyhow OR listening for them too, wasting IO + resources) & the SYSTEM ICON in Control Panel (as to options &/or quick tasks to perform for that) make it a snap to

  • Clarification (Score:5, Informative)

    by Raconteur ( 1132577 ) on Tuesday October 28, 2008 @06:48PM (#25548535)
    Just in case the /. entry seemed as ambiguous to you as it did to me, the linked article states "Our investigation has shown that it does not affect customers who have installed the update."

    • But not everyone has installed the update. (Score:5, Insightful)

      by khasim ( 1285 ) <brandioch.conner@gmail.com> on Tuesday October 28, 2008 @06:59PM (#25548649)

      This is added incentive to complete YOUR testing of this patch ASAP.

      Remember, only incompetent admins apply patches without testing them.

      In our environment, the patch would have been put into testing the day after it was released (no sense getting caught by a brown paper bag bug) and then into production NEXT Sunday.

      With a known exploit out there, we'd be getting more people to test the test systems TODAY. With the goal of putting the patch into production TOMORROW evening.

      • Comment removed (Score:5, Insightful)

        by account_deleted ( 4530225 ) on Tuesday October 28, 2008 @07:44PM (#25549077)
        Comment removed based on user account deletion

        • Re: (Score:3, Insightful)

          by Fulcrum of Evil ( 560260 )

          So, do you think I'm an incompetent admin given what I have to work with?

          Sure. You don't have a test network to at least smoke patches on or you would've said something. What happens when your SBS box barfs? how long is recovery and when's the last time you tried it?

          • Comment removed (Score:5, Informative)

            by account_deleted ( 4530225 ) on Tuesday October 28, 2008 @10:25PM (#25550341)
            Comment removed based on user account deletion
            • How about a SBS box and some clients that can at least accommodate smoke testing? Sure, your client's box may explode or conflict with an app they use, but it'll happen less with smoke tests.

              • Re: (Score:2)

                by Zarquil ( 187770 )

                I hate being the cynic, but both times I've been burned have been on small, specialized apps that aren't going to be blink across the mind's eye of Microsoft's testing matrix. The likelihood of any or all of his clients sharing it are presumably small (unless he wrote it himself).

                Smoke testing on a general scale like that is not likely to give a great return beyond the Microsoft testing.

        • Depending on what sort of software is running on those servers, and what those companies allow you to do, you could do _some_ testing with vmware server.

          Stuff like vmware server is free. Download it and install it.

          Create a windows guest with the required virtual hardware.

          Install the cheapest licensed Windows SBS on it.

          Make copies for testing different software configurations and scenarios.

          The courts in my country are unlikely to smack me down as long as I don't run them all at the same time, but your countr

          • Would be strange that you can't afford the USD600+ (inclusive of the 2 x 500GB drives for storing all those vmware images), if you're doing this as a business. Maybe you should bill those companies a bit more.

            I don't know about the grandparent, but I'd rather take that money home. If a company wants a patching/testing infrastructure, they can pay for it instead of me having to cut my already slim profit-margins.

            To be blunt, no small business wants to pay double for their SBS install--because that's what it would take to get a real server and a test server--or a real server and a VM. (Need more memory and space in the real server for the VM.)

            Many clients are fine with leaving it up to MS to get the patches

      • Remember, only incompetent admins apply patches without testing them.

        In our environment, the patch would have been put into testing the day after it was released (no sense getting caught by a brown paper bag bug) and then into production NEXT Sunday.

        Your strategy fails to deal with certain 0-day scenarios. Not that competent admin would actually run critical services on Windows.

      • Re: (Score:2)

        by afidel ( 530433 )
        Yep that's what I just finished doing. We started testing last Friday but due to some changes going into production last weekend we weren't able to test all systems. We blocked all known paybload sites for the in-the-wild exploit at the firewall and set it to email us if those rules triggered. This morning we got a hit. We went into emergency response mode. The patch testing went to the top of the pile for all application groups. We located the affected workstation and pulled it from the network, confirmed

      • Remember, only incompetent admins apply patches without testing them.

        Okay, I'll bite on playing devil's advocate here - so what's your test proc?

        This is an patch developed and distributed by the OS manufacturer. I don't know what files are being touched by the fix, but how are your folks testing against those files, all apps which touch those files in execution, and what constitutes a successful test?

        I agree with what you're saying in principle, but in practise it is very difficult to truly test OS vendor patches comprehensively. How do you ensure that every piece of funct

        • Seems like an honest question, so I'll give you an honest answer. :-)

          Most companies that bother with an 'IT department,' rather than That One Guy, will have standardized desktops by role. That is to say, you take a computer, you put it on the network, you authorize it into your management system (be it Microsoft SMS, Novell Zenworks, whatever) and wait. Or you whip out your image CD for that role, plop it in the drive, reboot, and walk away.

          In any event, a standard load for that role is plopped onto the P

  • the droning *gong* of microsoft cracks (Score:4, Interesting)

    by drDugan ( 219551 ) on Tuesday October 28, 2008 @07:04PM (#25548679) Homepage

    This is like a droning gong.

    *Gong* Bring out your dead *Gong* Windows is insecure *Gong* Bring out your dead *Gong*

    It seems to me there is a fatigue that sets in regarding unpleasant information. How many times does one have to hear a thing, especially an unpleasant thing they don't want to hear, before that person stop listening to it? This happens to me at least. We see this (as a parallel) in politics all the time, when we're told this guy or that person broke the law. Its like a background din you have to tune out to get through the day.

    It's made worse because there is no solution.

    For the user of windows, there is nothing they can do about the fundamental insecurity that leads to repeated, consistent, and regular security updates like this. The only option is to change OS, which if you're the average computer user, that is not an option without significant expense. It's unpleasant to hear that crackers are breaking into computers and turning them into zombie swarms of attacking botnets. Hear the same bad thing enough times, eventually people stop listening.

    I was fortunate: my windows laptop was stolen in 2004 and I made the switch, and now use Mac and Linux now exclusively. Not that Mac is any panacea - I still can't stand Finder, I think it is awful, and curse it every time I need to move a few files to some other folder on another drive (usually I just use "mv"). BUT at least I'm not forced to start ignoring serious security threats that I can't prevent or address effectively. (I don't consider a long series of "After the crack" patches effectively addressing the problem)

    • Nope, never forced to ignore serious [tuaw.com] security vulnerabilities [slashdot.org]

    • Re: (Score:2)

      by afidel ( 530433 )
      Dude, this is the third out of cycle MS has released in the 4 years since they went to the patch tuesday standard and it was because it was found by reverse engineering an in-the-wild worm. Also you might notice that Windows 2008 and Vista are lower priority because security improvements in default ACL's means that this exploit is only exploitable by authenticated users, not by anonymous bind, it's not like MS isn't doing things to improve security including reducing the attack surface of 2008 with Server C

  • I'm not Microsoft lover, but (Score:5, Insightful)

    by dkleinsc ( 563838 ) on Tuesday October 28, 2008 @07:11PM (#25548725) Homepage

    I'll give them credit for patching this quickly. This could have been Yet Another Windows Worm (TM) that brings all legitimate network traffic to a halt. And us Slashdotters have been after them for years for taking too long to patch things, so it would be completely hypocritical to get pissed at them for doing what we'd want them to do.

    I'll hate them for having the exploit possible in the first place, I'll hate them for requiring reboots, I'll hate them for forcing crappy software down our throats, but every once in a while they do something right.

    • How the fuck does this keep happening? I can understand a remote exploit here and there. But seriously. How dumb/slow/lack of testing do you have to be to put these in the wild. Last bug that made Slashdot affected everything back through like 98 or something. I know "MS sux" is the big joke around here, but seriously.

      If it's because Windows is the Most used OS in the world, why don't we hear about Apache remote exploits? With Apple and Linux taking market share with College kids and the Server market why a

      • Windows is huge compared to a typical Linux server setup -- Server 2003 takes up 20 times as much disk space as Ubuntu's server offering, and on the desktop, it's still a factor of three or four. On one hand, a lot of that is going to be help files, images, GUIs, and so forth; on the other, there's just going to be a lot more executable code that might be running.

        This isn't an excuse for Windows to have exploits, but it's probably a large portion of the cause.

  • Microsoft didn't downplay this (Score:5, Informative)

    by Anonymous Coward on Tuesday October 28, 2008 @07:17PM (#25548789)

    Instead they issued an out-of-cycle patch and they gave it a very high severity rating in their bulletins. None of us are Microsoft lovers. But you don't have to lie to us just to be able to pat us on the back. It's disgusting, please stop it.

    • Re: (Score:3, Informative)

      by felipekk ( 1007591 )

      Please mod parent up.

      Microsoft even contacted partners to make sure they were applying the patch as soon as possible.

      I don't know where the author got the downplaying from...

  • Just a day after downplaying the vulnerability that caused it to issue an out-of-cycle patch last week, Microsoft warned customers late yesterday that exploit code had gone public and was being used in additional attacks

    .
    How does this translate into downplaying the threat?

    October 23, 2008 (IDG News Service) Microsoft Corp. fixed a critical bug in its Windows operating system Thursday, saying that it is being exploited by online criminals and could eventually be used in a widespread "worm" attack.

    Micro

  • Metasploit (Score:5, Informative)

    by slimjim8094 ( 941042 ) on Tuesday October 28, 2008 @08:14PM (#25549373)

    Be warned; this is already on metasploit. The intrepid can find this for themselves...

    Testing it to see if it actually works though.

    • The intrepid can find this for themselves...

      Well, unless this thing runs in WINE so I doubt those who are intrepid can find it for themselves...

      (For those who are clueless and won't get the joke, Intrepid Ibex is the codename for Ubuntu 8.10)

  • From milw0rm here [milw0rm.com]

    -metric

  • Vista rulez... (Score:2, Interesting)

    by Computershack ( 1143409 )
    Glad I'm running Vista or I might have to look like I remotely give a shit about something that might affect me if I weren't connected to the internet via a router running NAT you know, just like pretty much most people on broadband are?

    Seriously, this is only really gonna be a problem to someone connecting on dialup and it's gonna take so fucking long to send the information that the person running the exploit is most likely to have died from old age before they get anything worth a toss.

    • I see a bigger issue in buisness networks. Many places rely heavilly on windows file and print sharing so blocking it complely is not an option and iirc the basic browse/name resoloution system tends to get upset if you try and do any kind of firewalling.

      One infected machine behind the firewall could easilly reak havok.

  • Downplaying the vulnerability ? (Score:4, Insightful)

    by DavidD_CA ( 750156 ) on Wednesday October 29, 2008 @01:20AM (#25551315) Homepage

    I'm sorry... downplayed?

    Is there any admin in the world that didn't get the message that this was kinda sorta urgent?

    This was the first time in four (?) years that Microsoft went out-of-cycle on their patches. That alone got attention, and would hardly be considered "downplayed".

    Every stinkin' newsletter I got last week all mentioned it. Vendors mentioned it. Slashdot mentioned it a dozen times. And Microsoft sent out many many bullitens.

    What would it take to satisfy the submitter's requirements for sufficient attention? CDs mailed out via FedEx Next Day to every registered owner of Windows?

    Perhaps the real downplaying is what Slashdot tends to do whenever a Linux-releated bug is found.

    • I saw all the fuss last week about this, so I went ahead and read the MS release. My reaction: "meh". Yes, we're running windows. About 100 desktops and 13 servers. No, we don't patch everything at the drop of a hat.

      This patch will be rolled out here in 2-3 months, along with a bunch of other MS patches. Do we test everything thoroughly? No, that would be far too much time and effort. We wait a few months so that everybody else can do the bulk of the testing for us, then internally we simply roll pat

Slashdot Top Deals

The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.

Close