Microsoft Warns of Windows 7 Graphics Flaw 262
Barence writes "A flaw with the graphics driver in Windows 7 could compromise the stability and security of PCs, Microsoft has warned. The vulnerability lies in the Windows Canonical Display Driver (cdd.dll) for the 64-bit versions of Windows 7 and Windows Server 2008 R2. Microsoft claims that the flaw could lead to machines rebooting or even allow a hacker to remotely execute code, although it claims either eventuality is improbable. Concerned users are being advised to disable Windows Aero until Microsoft can issue a fix."
Servers (Score:5, Informative)
and Windows Server 2008 R2
This is why you don't use unnecessary things like Aero (and graphical displays) on servers. Granted Aero isn't enabled by default on Windows Server 2008, but it's still all unnecessary. Servers are meant to be configured and left running with minimal installs. You can do everything you need to from a command line, and sftp for editing those configuration files. When you have a minimalistic install there's also much less change of some random software having an exploitable bug.
GUI is still there for remote desktop and it's eas (Score:2, Informative)
GUI is still there for remote desktop and it's easier to configure then CMD only.
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
CLI does have its uses. There are things it offers that no GUI can, and vice versa.
But claiming you need it for "real work" is like claiming you need a printing press to print a sheet of paper with "real text" on it. Both are equally ridiculous statements.
For most work environments, neither CLI nor GUI alone covers all needs. Welcome to the real world, where we use the appropriate tools for each task.
Re: (Score:3, Informative)
No, they are not equal. The problem is that using GUIs as we know them today, is NOT using a computer. It is instead the same thing as fiddling with an appliance. A static thing. Good luck piping the output of a Firefox menu item to Gimp. Good luck scripting the interface. That’s the real problem. You can’t really. Everything is monolithic static applications. With the rare plug-in exception.
Real work = AUTOMATING
Do you know that saying, that the computer creates the work that you wouldn’t
Re: (Score:3, Insightful)
You can automate a GUI. AppleScript on Mac Classic used to be brilliant for this-- I'm not sure if it's still good or not.
Re: (Score:2)
If your OS only has configuration options in the GUI, then your OS is horribly broken. EVERYTHING should be configurable via CLI. if not then the people designing it made gigantic mistakes.
Re: (Score:3, Funny)
Welcome to the real world, where we use the appropriate tools for each task.
I painted my house with a hammer you insensitive clod!!!
Re: (Score:2)
Can you provide an example that is applicable to the configuration and maintenance of a server? The only thing I can think of are graphical representations of server usage logs, and honestly those aren't useful enough to warrant having a full graphical desktop installed (and you can just expose them on an internal web page).
The argument is not that the GUI is useless. The argument is that the extra complexity of installing a
Re: (Score:2)
The argument is not that the GUI is useless. The argument is that the extra complexity of installing a GUI stack is not worth the minimal benefits it brings.
On Windows, editing the registry is a PITA using the command line.
For one-off "add this registry item" work, the command line programs are fine, but for doing things like "find all mention of 'C:\Users' and replace it with 'D:\Users'", a graphical registry editor is not just the easiest, but pretty much the only way.
Re: (Score:2)
... seriously, I expect people to not RTFA, but you didn't even read the next sentence. Here it is, because I specifically mentioned exactly what you said:
Basica
Really? (Score:2)
Okay, that's twice in this thread that I've squinted at my monitor and said, "What the fuck?"
Is the bar really so very low on slashdot that saying you prefer a command line gets you +5 insightful? Actually, it clearly is.
We need to be able to moderate something "completely devoid of insight but somehow I connect with this". Or maybe we need "so obvious even a caveman can see it".
Re:GUI is still there for remote desktop and it's (Score:5, Insightful)
Re: (Score:2)
and scriptable far more easily, for repeating later when we're not around...
Re: (Score:2)
Re: (Score:2)
Poor underprivileged kids.... I grew up around Unix. we had a wyse terminal at home and I had my own login on the Uni mainframe (mom being a administrator had advantages) CLI in a real computing environment, with it's near endless scripting abilities Completely kicks the butt of a GUI.
call me when you can script a GUI as easily as a CLI.
Re: (Score:3, Insightful)
Re: (Score:2)
example fail.
How about, in one operation, finding all the text files on the entire disk, (I'll even let you assume a .txt extension on this one and exclude all files that don't have an extension), must follow a certain naming pattern, and also contain certain keywords inside the file.
Do that with your gui in less time then it would take me to read the man page to write the regex and then execute the command.
Starting...now!
Re: (Score:2)
also, if you haven't already sorted your files before you need to move them that's your own fault. :p
Re: (Score:2)
I can backup all my documents to an external drive with a simple drag-and-drop. I can't imagine trying to do that with a CLI.
Really? Typing 'rsync -av /home/user /mnt/external' takes longer than drag & drop? How would you do something like backing up all PDFs (and only pdfs) in a tree with a GUI? Does drag & drop recognize when two files are identical and only transfer files that have changed? Can it resume an interrupted transfer without copying the entire thing again? Can drag & drop tran
Re: (Score:3, Insightful)
In my experience, working the way you like is vastly superior to working the way some Internet stranger likes, regardless of the geek cred it'll give you on Slashdot.
Re: (Score:2)
When I can rattle off half a dozen features one has that the other doesn't, it ceases to be a matter of opinion. rsync is just plain better. It's ok for you to use the GUI if that's what you like, but don't go around saying that it's better.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
Administering IIS has been a pain in the ass since day 1. Unlike NCSA, Netscape, and Apache servers, you had to point-and-click through a zillion tabs and dialog boxes in IIS to configure and tune the server - or for more advanced tuning, do something even worse: hark back to the day of C= BASIC 2.0 and do the equivalen of PEEK and POKE to the IIS Metabase. Microsoft has FINALLY seen the light and now offers the ability to edit configuration files. This makes things MUCH easier since you can see right in fr
Re: (Score:2)
On a desktop that would be ridiculous.
On a server, on the other hand, everything should be editable from the command line. In my opinion, the installation of a GUI shouldn't even be considered. sftp and ssh are perfectly usable and acceptable for remote access. At no time in the history of a server should a GUI ever consider coming into play. As has been previously stated, you're just introducing more points of failure and vectors for attack when you do so.
Re: (Score:2, Insightful)
GUI is still there for remote desktop and it's easier to configure then CMD only.
That's because Microsoft has a crippled CLI, and yes, that included Powershell..
Re: (Score:2)
Re:Idiotic Moderators. (Score:4, Informative)
Powershell is by far, one of the best Microsoft has created on the scripting side. Why? They basically took a shell and enhanced it by making it object aware, and giving it access to .net. In Microsoft lingo, cmdlets replace unix utilities.
I am not a fan of the naming conventions they use in powershell! It makes it harder to write terse scripts.
Please see
http://w3.linux-magazine.com/issue/78/Bash_vs._Vista_PowerShell.pdf [linux-magazine.com] for a comparison of powershell vs Bash.
http://blog.brandonbloom.name/2009/04/powershell-condemned-to-reinvent.html [brandonbloom.name]
Re: (Score:2)
But a remote desktop shouldn't require any kind of display driver on the host.
Re: (Score:2)
CDD (the affected driver) is for GDI (read: pre-Vista, although quite a lot of current software still uses GDI) applications to display on a display using the Desktop Window Manager. Disable Aero, and you're using XPDM instead of DWM, and it's GDI all the way.
Although I believe the DWM disables itself for remote desktop, anyway.
Re: (Score:2, Insightful)
Re: (Score:3, Insightful)
I don't know that you're wrong in calling Microsoft's approach wrong, or have more than an idea of why you might be wrong, but the fact that everyone else uses the "wrong" approach sets off the BS-meter.
Re: (Score:2)
There was no freely availalbe Xserver/XClient for Windows until recently .....
VNC will work on any graphical system, Windows, X, And most others .... that's the point it is *not* tied to X and so can be universal
The X approach is wrong (for various reasons)
- But X is simple enough that it's inadequacies can be worked around
Windows is wrong (for various other reasons)
- But this is Windows so there is no way to work around it's inadequacies...
Re: (Score:2)
Why?
Because those that don't know X are doomed to reimplement it poorly, and those that do know X just use X.
Re:GUI is still there for remote desktop and it's (Score:5, Insightful)
I can see that. Perhaps you are a small business and you don't want to train your network admins on CLI tools, so they use the "easier" (read: "requires less training") GUI rather than the faster CLI. Fair enough, not everyone can afford fully-trained network engineers to manage a few small in-house servers.
But, seriously, Aero? Even the least experienced network admin doesn't need to enable Aero to administer the server. It's a waste of CPU and memory resources for something that (hopefully) you spend a few minutes a week on. If you insist on using a GUI to administer your servers, fine, but at least make it the simplest GUI you can use to get your job done.
As GP said, the simpler your interface, the less likely there is to be an exploitable security flaw in it. The more complex you make your remote access capabilities, the more likely it is that someone else can find a vector in to them.
SFTP/SSH exchanges very little data and has very few possible attack vectors. "Classic" GUI has a few more attack vectors and possible failures and exchanges a lot more data, but it adds simplicity for those not comfy with the CLI, so there's a logical trade-off there.
Aero adds a lot more traffic, a lot more complexity, a lot more potential vectors for both failure AND attack, and does not make the GUI any more functional for administrative tasks.
Now, if you're using Server 2008 on your desktop as your daily machine, and you like sexy GUI, OK, I can see Aero being enabled. But there's no reason to enable Aero on an actual server.
Re: (Score:3, Insightful)
I'm not sure if being paranoid is the right step - careful, sure, paranoid - no.
In the end, the goal of IT is to enable it's users to be more productive. Sometimes overparanoid IT guys can make life more difficult for the Users - this should be minimized.
All of the Windows Server components are always on-the-disk in Server 2008/R2. IIS on the disk, whether you use it or not. But only when enabling it you'll actually get the services you need for it.
This doesn't hurt. It doesn't compromise security.
Re: (Score:2)
If you are running systems so close that running Aero has an actual practical effect, then you are running underpowered servers.
Personally, I don't think that a server needs a video card with DirectX 3D support, a hardware pixel shader, 32 bits per pixel, etc. If you really, honestly need a GUI to administer a server, a much simpler VGA card will suffice, and will have much more stable drivers.
Once you start turning on 3D effects, you will send a lot more data over the stream for your remote desktop. Maybe not enough to affect your network, but it certainly adds complexity to the whole process.
You have to make decisions for your o
Re: (Score:2)
IT does NOT add a 'lot more' traffic, or a 'lot more' complexity.
It add a minor bit of each.
As we can see, it adds enough complexity to open an additional potential security hole. For what?
Pretty windows on your server.
It's like putting doily [wikipedia.org] drapes in your warehouse: it has no useful effect, yet marginally increases your fire hazard. Should be a no-brainer.
Re: (Score:2)
Does Aero even work if you remote desktop in?
My guess is it drops back down to Basic.
Re: (Score:2)
Bah. I always switch to the classic mode anyway. It updates the screen faster, is more responsive, and seeing as how I grew up with this (see links), I already think it's pretty enough - http://toastytech.com/guis/c64g.html [toastytech.com] http://www.guidebookgallery.org/pics/gui/desktop/full/amigaos10.png [guidebookgallery.org]
Question:
Why does this flaw affect NT 6.1 and 6.2, but not 6.0 (vista)??? And why's the driver called "Canonical"?
Re: (Score:2)
Because it's fugly?
Re: (Score:2)
Right - but Aero is not installed or enabled by default, and drivers that support Aero are not included in the box either. RDP won't show you Aero if it's not available on the system. So out of the box, you get a plain if a bit ugly GUI that a low-end graphics card can handle.
Most servers do not come with a display adapter that supports Aero. I've tried just to see if it was even possible, but the ATI ES1000 that comes standard in my IBM xSeries servers just doesn't cut it :)
So, most of the people using Ser
better yet (Score:5, Funny)
This is why you don't use unnecessary things like Aero (and graphical displays) on servers.
This is why you don't use unnecessary things like Windows Server 2008 R2 on servers.
There. Fixed it for you
Re:Servers (Score:5, Insightful)
Re: (Score:2)
Then don’t use stupid terminal services? Who came up with that crap anyway? You have a decent powerful CPU and graphics system right there on your system. Stop making excuses, and use it.
Re: (Score:2)
I guess you didn't bother checking out this [microsoft.com] or this [microsoft.com].
Re: (Score:2)
You idiot, they were there 10 years ago~
Re: (Score:2)
Amazing. So they only took 30 years to catch up instead of 40! Incredible!
Re: (Score:2)
This is why you don't use unnecessary things like Aero (and graphical displays) on servers.
Why on Earth would you connect a screen (be it CRT or LCD) to a server, in the first place? I cannot think of any reason for doing this, if it is a SERVER.
Re: (Score:2)
Or even worse... (Score:2)
No way! (Score:5, Funny)
Oh, sure, fine... (Score:4, Interesting)
Re: (Score:3, Funny)
Signs of infection include a symbol with quadrants 1 through 4 as green red blue yellow.
Worse yet, (Score:5, Funny)
it might render your porn poorly.
Re: (Score:3, Funny)
it might render your porn poorly.
Or cause you to reboot prematurely.
Re: (Score:2, Funny)
There's an app for that...
Re: (Score:2)
You might become infected just by watching porn.
Re: (Score:3, Funny)
my fellow admirer of the pornographic arts.
It's better to just say "man".
Otherwise we'd end up with heroes called Superfellow-admirer-of-the-pornographic-arts.
I have noticed something related (Score:5, Informative)
It seems there are some flaws in Aero on 64 bit systems.
Re: (Score:3, Informative)
BC2 is probably trying to cache everything into your available video ram, hence aero shutting down because it is out of ram. It does require 128megs, so perhaps BC2 is trying to utilize the whole 1 gig since its there.
Re: (Score:2, Informative)
You are correct, lots of games will try to claim all available video ram when running in fullscreen. It's generally a good idea to turn of aero when gaming, although it's kind of a hassle. There is a method for apps to request Aero to shutdown without the need for user intervention (of all games Civ IV actually does this) but very few games seem to make use of it.
Re: (Score:3, Informative)
You can just right click and go to the compatability tab and select disable windows themes. It will turn off aero automatically.
Re: (Score:2)
Re: (Score:2)
It doesn't if you're running a multi-monitor setup.
Re: (Score:2)
Re: (Score:2)
I'd prefer not launching to what the original Hitman does if you try to run it in windowed mode - it centers itself, meaning it's half on each monitor, and there's no title bar... of course fullscreen doesn't work properly either.
Re: (Score:2)
I have disabled Aero (I think it's ugly) on my gaming system, and I still run into issues related to it. When starting certain games, a "helpful" bubble pops up to tell me Aero has been disabled, but its appearance causes the game to end before it even has finished loading. At least Microsoft is an equal opportunity employer, with all those mentally handicapped developers. "Look at me! I detected a USB device!"
Will a future edition of Windows have a TREAT button for the system to be rewarded whenever it doe
Re: (Score:2)
Yawn, (Score:2, Insightful)
Why do I have the feeling this is overblown? I'm running W2K8R2 x64 as a Workstation OS, it is rock stable, possibly the best OS MS ever produced. Yet I'm sure there are _plenty_ of bugs like this one. Doesn't Microsoft issue bug reports like this every month? Doesn't _any_ OS company produce bug reports like this every month? Why is this one so special? Cause, I'd like to know.
I'm not saying it's should'nt be fixed, reported, or taken care of. I'm not saying Windows is the best OS. OS X can be pwned throug
Re: (Score:3, Insightful)
I think it's special because there haven't been all that many bugs with Windows NT 6.1 OSes (7 and R2). They seem to have less security issues than past Windows OSes, and are doing quite well compared to other OSes out.
However, this is Slashdot and the editors do not like Windows at all as evidenced by the broken Windows logo the Gates Borg logo and so on. They often go out of their way to find things wrong with Windows to post as front page news. Hence something like this makes the news since there hasn't
There is talk of useing GPU Computing in them and (Score:2)
There is talk of useing GPU Computing in them and will something like this make easier to hack them?
This has been happening to me for months (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I have paid top-of-the-line antivirus software.
Well then. This is evidently your problem. :)
Re: (Score:2)
Anti-virus software can't do anything about your busted-ass overheating video card. (Which is exactly what you're describing.)
Reminds me of jwz's discussion of toolkits (Score:2)
http://www.jwz.org/xscreensaver/toolkits.html [jwz.org]
My favourite bit (at the moment):
Let's suppose that down in the bowels of some particular version of some particular toolkit library, there lurks a bug. Let's suppose that the nature of this bug is something relatively obscure: say that it's something like, if you hold down 5 keys on the keyboard for 10 seconds then drag the middle mouse button, the text entry widget gets a SEGV. (In fact, I'm not making this up: I saw this very bug once, years ago.)
Now, that's the sort of bug that is not likely to be noticed or fixed, because it's the sort of thing that people "never" do. If that bug was reported against, say, a web browser, nobody would much care: User: "I can crash my web browser by doing this crazy thing!" Developer: "Uh, don't do that then." And that's not a totally unreasonable response.
However, in the context of security software, it matters, because then it's not merely a cute trick that crashes the program: now it's a backdoor password that unlocks the screen.
WinServer? (Score:4, Interesting)
Areo isn't even installed by default with Windows Server 2008 - you have to install it, reboot, and then enable it. That's hardly any attack vector at all IMO.
Windows 7 first thing I did. (Score:2)
After installing it was to disable all of the extra GUI junk in the UI. It now looks like Windows 2000 and runs slightly better too.
Truth be told if I could replace the GUI with the one from windows 95 I would, and why do they keep changing how control panel looks/works, I would like some freeking consistency.
Re: (Score:2)
why do they keep changing how control panel looks/works, I would like some freeking consistency.
The not-so-savvy computer users out there won't notice or care about improvements under the hood. Making visual, easily noticeable changes is about the only way to ensure the average end-user even realizes it's a different OS.
The annoying changes for you and me lead to more sales, in theory, from the layman.
Ring 0 (Score:2)
Is Windows 7 still running the graphics driver in Ring 0? They moved it from Ring 3 (least privileged) to the most privileged mode in NT 4.0 as a performance hack. Still reaping the 'benefits' of that decision today.
Re: (Score:2)
True driver writers are morons but still...
Re: (Score:2)
Since Vista, Microsoft have been moving most drivers back into userspace. In Vista and Win7, display drivers are hybrids: they contain a small kernel space (ring 0) driver that handles direct communication with the graphics device (i.e., scheduling DMA operations and such), and a user space (ring 3) driver that does all the heavy work.
That's why, even in the early days of Vista when the drivers were terrible, it didn't actually blue-screen much. You'd get a screen flicker then a message informing you that t
Re: (Score:2)
Is Windows 7 still running the graphics driver in Ring 0? They moved it from Ring 3 (least privileged) to the most privileged mode in NT 4.0 as a performance hack.
Windows Vista and 7 only run a small portion of the video driver in Ring 0... just the part that directly talks to the hardware. The rest runs in the same abstraction layer as the rest of the drivers on the system. That's why Vista and 7 can reboot a crashed video driver most of the time without requiring a reboot.
BTW, NT4? Seriously? Why don't yo
It was a feature (Score:2)
I recall that Microsoft made a huge deal about the new Aero look, back when Windows Vista was released, [microsoft.com] touting it as some kind of major revolution for PC computing (even though it was "just" a GUI.) They even used bullsh*t "hype" language that it would "enable you to manage the windows on your desktop by arranging them in a visually striking yet convenie
Re: (Score:2)
Re: (Score:2)
The point is. Linux has a lot of problems that most people excuse and overlook or blame elsewhere, vs actually trying to fix them. Windows has problems too but even for smaller problems they will get hounded for being such a horrible system. Sure lets discuss windows problems, we should demand that Microsoft keeps their product at high quality, but I am tired of this "well I use Linux so I am so much better off" nonsense. Wow they are two different systems with different code bases and they have diff
Re: (Score:3, Informative)
Well, yes: Because this driver is not vendor specific. It's part of the actual OS itself. When was the last time you saw, say, a huge flaw in the Linux framebuffer, or something like that?
If the vulnerability is caused by the vendor of a chip, or the shoddy documentation of s chip maker: hell yes, blame the third part. In this case... MS can only blame themselves. Their own 'canonical display driver' is shoddy, not a 3rd party chip maker.
Re: (Score:2)
This vulnerability was found in Aero, not in a video driver.
Vulnerabilities have been found in X before, and fixed. This is no different.
Not sure where the anger comes from, but you might consider a nice hot cup of tea and a short break. Cheers.
Re: (Score:2)
XFree86 was even worse.
One day Linux will get a decent stable X server but I won't hold my breath. Thank god for alt-sysrq.
Re: (Score:2)
I won't debate it a lot, but I did like XOrg better than XFree86.
Re: (Score:2)
(. .)
You missed two brackets in your comment.
Re: (Score:2)
You’re thinking of |. .|
Re: (Score:2)
You never know... he might’ve been born back when breast-feeding was more common.
Re: (Score:3, Funny)
Canonical
Could they have released a borked up driver named after the competition so that in time people looking into Ubuntu might recognize the name Canonical and associate it with something that "compromise the stability and security of PCs?"
I think this post demonstrates a new level of paranoia when it comes to Microsoft.
Re: (Score:2)
I think this post demonstrates a new level of paranoia when it comes to Microsoft.
If you choose to name your company by using a word in common usage like canonical, you're bound to get problems at some time, not least because you can't TM it.
Re: (Score:2)
Yeah!
Same reason xWINDOWS is so screwed up, to taint Microsoft! YEAH!!!
Re: (Score:2)
They just get it coming and going don't they?
Microsoft is not releasing information about their bugs, they are trying to hide them.
Microsoft is releasing information about their bugs, why are they doing this, they should not tell us about this and just fix it.
I guess its true what they say, you can't please everyone.