Microsoft: Windows 7 not affected by latest flaw
Microsoft issued a formal security advisory late Tuesday on a reported zero-day flaw in Windows Vista and Windows Server 2008. However, the software maker also said that the flaw does not affect the final version of Windows 7, contrary to earlier reports.
"Microsoft is investigating new public reports of a possible vulnerability in Microsoft Server Message Block (SMB) implementation," Microsoft said in the advisory. "We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time."
The flaw could allow an attacker to gain control of a system, although Microsoft said that "most attempts to exploit this vulnerability will cause an affected system to stop responding and restart."
The software maker said it is working with security software partners to provide information that can be used to create protections. Once its investigation is wrapped up, Microsoft said it will take action, which could include releasing a patch during its next monthly cycle or doing an "out-of-band" release, if necessary. Tuesday was Microsoft's monthly release for patches, which included five critical Windows updates addressing eight vulnerabilities.
The software maker said the latest issue affects the "release candidate" version of Windows 7, but not the final version that was completed in July. Also, the recently completed Windows Server 2008 R2 is not vulnerable, Microsoft said, nor are the earlier Windows XP and Windows 2000 operating systems.
Microsoft is already dealing with a separate, still unpatched flaw reported last week. Attacks have already been seen based on that vulnerability. Microsoft has taken issue with the fact that that flaw, like the latest one, was reported publicly as opposed to being privately disclosed to Microsoft, giving the company time to patch it.
During her years at CNET News, Ina Fried has changed beats several times, changed genders once, and covered both of the Pirates of Silicon Valley. These days, most of her attention is focused on Microsoft. E-mail Ina. 
Good to see they dodged the bullet with their latest build.
By the way: Most people focus on "how good is 7" and "how bad is Vista", but none seem to realize that the transition from one "operating realm" to another, that is "paradigm shift" from one way of working to a different one hardly ever is taken by virtue only.
As Thomas Samuel Kuhn stated on "The Structure of Scientific Revolutions" paradigms are "incommensurable" that is you can't measure one using the ideas of the other.
As much as Microsoft people have tried to convince us that Windows Vista is Windows at its root and that Windows 7 is the "ultimate perfection" (as can be interpreted by the choice of numbering), in reality Windows 6.0 (Vista) is a badly conceived hybrid between Windows 5.x (2000/XP) and a future fully managed code Windows (probably the REAL Windows 7.0).
As such Windows 6.1 (Windows 7) is just a correction and extension on this hybrid metaphor, but still incomplete and faulted. Although it behaves far better than the initial hybrid, this correction in no way will be the only measure of its success.
If technological merit was the only factor used to judge and adopt OS realms, NextStep would have overtaken Windows 3.1 and Macintosh; BeOS would have superceded MacOS 8 and 9; and OS/2 would have replaced DOS long ago. Even far back, the more technologically sound VAXstation (and compatible) would have overtaken the IBM PC. But in the end, neither NextStep nor BeOS were compatible with neither of the installed bases (Windows or Macintosh), OS/2 was compatible but required excessive resources and offered no real gain (in the same conundrum as Vista), and the VAXstation, although highly compatible and well executed, offered no real advantage for customers using VAX minis (just like the Windows 7 vs. Windows XP dilema)
So one must factor other issues in order to better predict Windows 7 future. Sadly, only time will tell.
If this was TLDR, sorry, had to make my point clear.
Oh wait - that's right: you don't actually know what you;re talking about, do you?
Ina, the link to bulletin says that the page cannot be found.
Folks, please remember that you lose all credibility in your post if you include the words Winblows, Windoze, Micro$oft. Or CRAPple, Snow Kittie, etc. Or if you speak of Ballmer or Jobs as if they are personally responsible for all of the failing or triumphs of their respective companies.
Did you even read what I wrote? I was hoping to ward off the trolls by point out how the ridiculous words they use shows them to be mindless fanboys. It looks like it worked, the usual inane W7 vs SL is lower than usual.
Please note that I call Windows XP by its correct title because it is and was a success.
Instead, how about a reward system? People find vulnerabilities, clearly point them out to an OEM and they get a financial reward if it is found to be valid? It could go through a single third party agency that would be paid by all the major OS OEM's to stay impartial.
Naaaaaah, that too would be doomed to failure as it makes too much sense.
The general idea I agree with though. All software has bugs. I at least like a notice and a chance to make it right for my customers before some script kiddie gets a chance to hack the world like he's really something special. But then again, I don't develop for customers anymore. However, the point is I agree with the idea.
I wouldn't even mind it becoming law. The only problem with legislation though is they always screw up the law and it never does what it was intended to do. They'll probably use it as another chance to go after pirates instead of what it would really be intended for. So, it's probably safer to not do that.
What we can do though is respect the real researches that do and not respect the "hackers/crackers" that don't. However, I don't think there is a problem letting the public know there is an exploit. Just don't tell the public how to do the exploit until after the software company has been notified.
Don't blame the hacker... blame the vendor who failed to detect the vulnerability before the hacker does in the first place. "Don't shoot the messenger."
I know that they are being somewhat reckless when they do this. But it's not really their job to inform the software vendor about the exploit.
Besides, sometimes, it takes an egg in the face for a company as big as Microsoft to act.
Tell the exploit silently to the company? What's the fun in that? Many of these hackers do this, not really for the money, but for glory and pride.
So I'm not so sure if a financial incentive will help. It might even get worse because there might be a lot of wannabe hackers out there who will motivated by money to find exploits and Microsoft would spend a lot of time reviewing those submissions and the hassles of explaining to most of the exploit they found are already patched, for example.
Though nobody is dying, they are the modern day bonnie and clydes and billy the kids of our day. Back then, the press was in love with their exploits too.
But then, again, they're still just a messenger. And you would be entering the sticky first amendment debate when you go there (well, we were already there when contentcreator suggested a *mandatory* notification).
Also, withholding information can be tricky and maybe as dangerous as well. What if the exploit notification was ignored? And what if this exploit is already well know "under ground" (so to speak)?
Usually, vendors DO get notified, but they quietly stuff it under the rug, or worse, ignore it completely. It usually takes public disclosure to get them to act. Note that Microsoft is not alone in this... I think only Linux and *BSD (because the source code is publicly viewable) will act immediately on a tip, or at worst will still publicly say why not. Firefox also acts fairly rapidly, for the same reasons.
Most proprietary vendors usually won't bother, unless they're forced to or the threat is imminent.
The scheduler bug has been there since the days of NT and was still working the last time I checked.
at HH:MM /interactive cmd.exe
You need administrative privileges for that "bug". And if you have administrative privileges, you're a local god, anyway, you can already FUBAR your system in any mysterious way.
http://www.electronista.com/articles/09/09/08/windows.7.returns.remote.bsod/
http://www.tomshardware.com/news/Windows-Seven-Vista-Exploit-DSoD,8620.html
How has Windows been bum raped? Despite all the lies and attack ads that Apple floods the market with, Windows still holds over 90% of the desktop/laptop OS market. Sounds like an attempted bum rape that failed to me.
http://seclists.org/fulldisclosure/2009/Sep/0039.html
Awesome. Did you actually have anything there, *******?
http://seclists.org/fulldisclosure/2009/Sep/0039.html
VI. SYSTEMS AFFECTED
Windows Vista/7 All (64b/32b|SP1/SP2 fully updated) and possibly Win Server 2008
as it use the same SMB2.0 driver (not tested).
**** drone
Really? Vista has gone two years without a single remote exploit surfacing in the wild. You sound like it's XP that is going public next month. But even more amusingly, you sound angry that Windows 7 turns out not to be affected by the latest bulletin. Big deal! Even when it is affected by a vulnerability, its mitigations still make it almost impossible to exploit the vulnerability.
Sorry if you can't digest the thought that you're running the most vulnerable platform left, but whether or not you WANT to believe it doesn't change the fact that it's the truth. Are you that worried? Don't be. If the Mac gets bombarded like some people (like Nils) are predicting, and Apple takes too long to address the issue, nothing is stopping you from migrating back. A paycheck, maybe, but I doubt even that. You don't know enough about computers to be employed even by Apple.
Too bad :-)
Neither Apple or PC's have any consumer equipment that can handle memory in this level so it's a moot point.
Too bad indeed.
yep! i might need 17TB to build a space ship and invite all Apple dudes to get aboard; with "up-in-the-sky" fees.
A bargain! :)
Oh drat, I only have a $2 million dollar bill on me... got change?
LOL!
I love it when silly boys like weegg are put in their place.
Unfortunately, the only thing to show off is the price tag and the pathetic names (almost as bad as Vista). I mean, even if you addressed the 16 TB, there are no apps that would use that space (not counting bloatware)
Vista came out in jan of 2007 and by December had 43 serious security flaws.
Leopard came out in October and by December had 243.
There are vastly more security holes now then vista and xp combined.
For any nonbelievers just go count them as there in every updated mac.
I own macs but i don't fall for all the hype and know just because the mac no a big target yet doesn't mean its secure.
Once they are more than 15 to 25% of the market........ you will see malware for them EXPLODE!
Building rock-solid software takes time I know. Microsoft had 6 damn years to do it in with vista. Vista is almost as bad as Windows ME was. That shows ****-poor workmanship.
Until then, all of these comments (pro and con) are pointless.
- by keano12 September 12, 2009 7:41 PM PDT
- To make things simple, Vista is still a good Operating system even with some flaws and Windows 7 will be the better OS but as the saying goes, "Nothing is Perfect." Only God and Jesus is perfect.
- Like this Reply to this comment
-
(56 Comments)