Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

https://krebsonsecurity.com/2019/05/microsoft-patches-wormable-flaw-in-windows-xp-7-and-windows-2003/

by akeck • 7 years ago

151 73 7 years ago

rincebrain4• 7 years ago

Not even a wormable flaw could convince them to patch Vista, apparently (assuming it's not somehow magically invulnerable when the versions before and after it weren't).

dfabulich• 7 years ago

"Users of Windows Vista can download the updates (Monthly Rollup or Security Online) of Windows Server 2008 from the Update Catalog and install them manually." https://borncity.com/win/2019/05/15/critical-update-for-wind...

But this is definitely confusing. MS explicitly offers patches for Win 7, Server 2008, Server 2003, and XP, but there's no "Vista" link visible.

https://portal.msrc.microsoft.com/en-US/security-guidance/ad... https://support.microsoft.com/en-us/help/4500705/customer-gu...

dmix• 7 years ago

It makes sense not to mention Vista in a headline consider the very low usage rates.

If anyone should not expect security update news via popular news outlets its Window's Vista users. There are plenty of niche channels for niche product releases.

rincebrain4• 7 years ago

Not surprised the 2008 patch is intended to work on Vista, I was more bemused that they had an otherwise exhaustive list of versions and how to patch them, and just...left it off, not only in the headlines, but in a number of the enumerations.

NKCSS• 7 years ago

RDP is not on by default, so I don't see how that's a big deal.

chenzhekl• 7 years ago

Maybe the market share of Vista is so small, that Microsoft doesn't bother releasing a patch for it. There's no patch for Windows 8, either.

rincebrain4• 7 years ago

8 and 10 aren't vulnerable, according to their writeup about it.

As someone commented above, there's a footnote about how Vista users can use the Server 2008 patch, I was more amused that in an apparently-complete enumeration of versions in a table, they just...left it off.

will42742• 7 years ago

From netmarketshare.com:

- XP market share: 3.57%

- Vista market share: 0.23%

- Mac OS 10.10 market share: 0.51%

(10.10 went out of support the same year as Vista)

baroffoos5• 7 years ago

I don't understand why they would do this. If I was a microsoft manager I would be glad something like this happened because it would force people off of old OSs without having the bad rep of doing it through nag popups.

Now everyone on XP will feel safe because its still getting updates.

jafingi• 7 years ago

Many institutions and hospitals still use XP. And they pay Microsoft a lot to support it.

kbumsik• 7 years ago

Do they really still pay for XP? I thought it went completely EOL some years ago.

baroffoos5• 7 years ago

Those still using XP should have networking and USB features disabled.

Carpetsmoker7• 7 years ago

In the real world, there understaffed IT departments, insufficient budgets, time-consuming logistics, and complex systems which are not easily upgraded. Microsoft's options here are either "to hell with it, not my problem, just let the world burn" or taking responsibility and fixing problems which will affect people.

baroffoos5• 7 years ago

Budgets will find room for an update when an out of date OS starts causing damage to the business.

Patching an ancient OS is enabling the delay of updates with the excuse "Whats the point, it still works"

Steve44• 7 years ago

In addition to those reasons generally a computer system is a business tool. If a machine is doing what a company needs then why spend valuable time and money upgrading it to something else that will do exactly the same job.

I do appreciate the problem of security patches, but XP is pretty rock solid as a platform so for many businesses their tool does what they need.

sagebird2• 7 years ago

I would not be shocked if Windows XP had less vulnerabilities than Windows 10. Also, who cares? How would your behavior change if you learned one was more or less vulnerable than the other?

baroffoos5• 7 years ago

If I was managing systems that were EOL many years ago and an active risk of being exploited my behavior change would be either to update them or disconnect them from the outside world.

m_mueller• 7 years ago

Microsofts rather friendly attitude to downwards compatibility & longterm support, is IMO one of their strongest competitive advantages for Windows and Office. Not following this philosophy for their mobile platforms has also lead to their downfall there.

pjc50• 7 years ago

At this stage, anyone still using XP is doing so because they have no other choice: either it's intrinsically tied to low-end hardware, or to some piece of critical software, and it's too expensive or time-consuming to replace. Often this includes "embedded" PCs in scientific equipment and the like.

basch• 7 years ago

or they dont know or care. "it runs my spreadsheet fine"

walls• 7 years ago

We said this about IE6, but once major sites started dropping support, usage dropped to almost nothing fairly quickly.

cf141q53253• 7 years ago

Its especially unfortunate since KB4474419, the sha2 update for Windows Seven, defacto disabled updates for quite a few people with dualboot or encrypted system partitions in mid March.

cpach• 7 years ago

Disables updates? How?

cf141q53253• 7 years ago

The update fails and gets automatically reverted. I dont think you can get the monthly security updates without it, at least that was the case with the April rollout. Since its not immediately clear why the update fails, you can even now find quite a few people looking for help to diagnose the error online.

edit:

Here some context

https://answers.microsoft.com/en-us/windows/forum/all/kb4474...

its an easy fix for for dualboot if you can just replace grub with mbr again, but people with disc encryption are rather screwed it seems.

gruez• 7 years ago

encrypted system partitions

Does this include bitlocker? Or is this an issue with third party boot loaders so bitlocker is fine but truecrypt is not?

MagicPropmaker• 7 years ago

Wow! Good for Microsoft. You don’t see Apple releasing patches for 15+ year old operating systems.

justin66• 7 years ago

Neither did Microsoft, as far as I can tell:

https://portal.msrc.microsoft.com/en-US/security-guidance/ad...

Notre1• 7 years ago

There are XP patches. I wonder if that CVE page is autogenerated and doesn't include out-of-support operating systems.

https://support.microsoft.com/en-us/help/4500705/customer-gu...

auiya• 7 years ago

Apple makes all their OS releases free to their users, so there's much lower numbers of 15+ year old Apple OS's existing in the wild to begin with. If you'd said you don't see Apple releasing patches for 15+ year old computers, I'd be more inclined to agree.

zeusk• 7 years ago

Heh, because Apple prefers to arbitrarily leave out support for their older systems on newer OS releases.

Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

Related Stories