9 ms·

Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

151 points by akeck 7y ago

rincebrain 7y ago
Not even a wormable flaw could convince them to patch Vista, apparently (assuming it's not somehow magically invulnerable when the versions before and after it weren't).
- dfabulich 7y ago
  "Users of Windows Vista can download the updates (Monthly Rollup or Security Online) of Windows Server 2008 from the Update Catalog and install them manually." https://borncity.com/win/2019/05/15/critical-update-for-windows-xp-up-to-windows-7-may-2019/ https://borncity.com/win/2019/05/15/critical-update-for-wind... But this is definitely confusing. MS explicitly offers patches for Win 7, Server 2008, Server 2003, and XP, but there's no "Vista" link visible. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 https://portal.msrc.microsoft.com/en-US/security-guidance/ad... https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708 https://support.microsoft.com/en-us/help/4500705/customer-gu...
  - dmix 7y ago
    It makes sense not to mention Vista in a headline consider the very low usage rates. If anyone should not expect security update news via popular news outlets its Window's Vista users. There are plenty of niche channels for niche product releases.
    - bArray 7y ago
      On a side note, I think that Vista wasn't necessarily unpopular, it just had a good upgrade path/incentive for users (unlike XP to Vista).
      - n4r9 7y ago
        It was one of the least popular versions of Windows, no? Certainly its market share never exceeded XP's.
        bArray 7y ago
        I think Vista was the least popular as you say, but I think that was because the upgrade path/incentive wasn't there. The upgrade from XP to Vista meant a lot of software stopped working, especially from a driver perspective. If you're using some niche software that "just works (tm)", why change? Especially if it costs a lot of money to upgrade or your system isn't networked. The UK tried to upgrade its XP running backbone years ago, failed - and still got billet £10+ billion.
      - rincebrain 7y ago
        My perception for a long time has been that Vista, from a technical perspective, was leaps and bounds above XP, but the end user experience was sometimes lacking; 7 didn't provide drastic technical improvements so much as offering a much-polished Vista.
        tunap 7y ago
        Windows 7 should have been called Vista SP7. That is what I called 7's hasty premier after Vista's lackluster debut.
      - AdmiralAsshat 7y ago
        No, it was quite unpopular, period. See: https://xkcd.com/528/ https://xkcd.com/528/ There was the popular perception at the time that every other version of Windows was good, while the in-betweens sucked. Vista followed that expectation perfectly, as did Windows 8.
        will4274 7y ago
        > No, it was quite unpopular, period. See: https://xkcd.com/528/ https://xkcd.com/528/ I've always read this comic as making fun of people for having unjustifiably low opinions of Vista.
  - rincebrain 7y ago
    Not surprised the 2008 patch is intended to work on Vista, I was more bemused that they had an otherwise exhaustive list of versions and how to patch them, and just...left it off, not only in the headlines, but in a number of the enumerations.
- jlarocco 7y ago
  That's an incredibly ironic complaint coming from a Google employee. Let me know next time you guys patch Google Reader.
  - saagarjha 7y ago
    Reader is a discontinued product that nobody can use. Patching it makes no sense.
    - jlarocco 7y ago
      That was a joke, but it's why the OP was so ironic. Google has absolutely terrible support. You can't even use their products when they discontinue them, and they discontinue them all the time. Maybe I should have used Nest for my example, which people actually paid for, put in their houses, and now can't use any more. Last release of XP was 11 years ago. Extended support ended 5 years ago. Yet people who want to use it still can, and even still get occasional security patches. Even Vista is still usable and gets updated, as mentioned in a sibling comment.
      - semi-extrinsic 7y ago
        The difference is probably in part caused by the markets for Google vs. Microsoft products that we are discussing. If Google shafts a private person they might get angry and buy Apple next time, and Google loses a few hundred bucks. But if Microsoft shafts the XP machine in a hospital that runs their old MRI machine or whatever, that's a potential PR crisis and possibly a million-dollar lawsuit.
  - dang 7y ago
    That crosses into personal attack and you can't do that here, regardless of how strongly you feel about someone or their employer. Please don't do that here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- NKCSS 7y ago
  RDP is not on by default, so I don't see how that's a big deal.
- chenzhekl 7y ago
  Maybe the market share of Vista is so small, that Microsoft doesn't bother releasing a patch for it. There's no patch for Windows 8, either.
  - rincebrain 7y ago
    8 and 10 aren't vulnerable, according to their writeup about it. As someone commented above, there's a footnote about how Vista users can use the Server 2008 patch, I was more amused that in an apparently-complete enumeration of versions in a table, they just...left it off.
- will4274 7y ago
  From netmarketshare.com: - XP market share: 3.57% - Vista market share: 0.23% - Mac OS 10.10 market share: 0.51% (10.10 went out of support the same year as Vista)
baroffoos 7y ago
I don't understand why they would do this. If I was a microsoft manager I would be glad something like this happened because it would force people off of old OSs without having the bad rep of doing it through nag popups. Now everyone on XP will feel safe because its still getting updates.
- jafingi 7y ago
  Many institutions and hospitals still use XP. And they pay Microsoft a lot to support it.
  - kbumsik 7y ago
    Do they really still pay for XP? I thought it went completely EOL some years ago.
    - DKnoll 7y ago
      Yep, NHS for example.
      - andygates 7y ago
        We had extended support for a couple of years but now it's dead dead deadski. Like any other large industrial org, there's some bits of million-pound kit with integrated, essential XP. Likewise old essential software where the support has literally retired, running on 2003. We've got roadmaps for replacing it, but they're not instant. We manage it as best we can. But broadly we're just about to go to 10 on desktops, so we're not as bad as the police!
        DKnoll 7y ago
        Glad to hear it. When I worked for a NHS software vendor a couple years ago there were still XP workstations about. I guess it probably varies by the trust as well.
      - ollie87 7y ago
deleted 7y ago
[deleted]
ccnafr 7y ago
Don't read Krebs articles... or he'll doxx you. Like he did to some researchers on Twitter who disagreed with his dumb opinion.
- Nextgrid 7y ago
  Care to elaborate?
- ryanlol 7y ago
  But where does the second x come from?
- nkrisc 7y ago
  How could he doxx you just by reading an article on his site?
cf141q5325 7y ago
Its especially unfortunate since KB4474419, the sha2 update for Windows Seven, defacto disabled updates for quite a few people with dualboot or encrypted system partitions in mid March.
- cpach 7y ago
  Disables updates? How?
  - cf141q5325 7y ago
    The update fails and gets automatically reverted. I dont think you can get the monthly security updates without it, at least that was the case with the April rollout. Since its not immediately clear why the update fails, you can even now find quite a few people looking for help to diagnose the error online. edit: Here some context https://answers.microsoft.com/en-us/windows/forum/all/kb4474419-will-not-install/658900bc-3103-4a0e-a9ed-08c5c2d31e76#?page=7 https://answers.microsoft.com/en-us/windows/forum/all/kb4474... its an easy fix for for dualboot if you can just replace grub with mbr again, but people with disc encryption are rather screwed it seems.
- gruez 7y ago
  >encrypted system partitions Does this include bitlocker? Or is this an issue with third party boot loaders so bitlocker is fine but truecrypt is not?
MagicPropmaker 7y ago
Wow! Good for Microsoft. You don’t see Apple releasing patches for 15+ year old operating systems.
- justin66 7y ago
  Neither did Microsoft, as far as I can tell: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
  - Notre1 7y ago
    There are XP patches. I wonder if that CVE page is autogenerated and doesn't include out-of-support operating systems. https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708 https://support.microsoft.com/en-us/help/4500705/customer-gu...
- auiya 7y ago
  Apple makes all their OS releases free to their users, so there's much lower numbers of 15+ year old Apple OS's existing in the wild to begin with. If you'd said you don't see Apple releasing patches for 15+ year old computers, I'd be more inclined to agree.
  - zeusk 7y ago
    Heh, because Apple prefers to arbitrarily leave out support for their older systems on newer OS releases.

151 points by akeck 7y ago

Not even a wormable flaw could convince them to patch Vista, apparently (assuming it's not somehow magically invulnerable when the versions before and after it weren't).

dfabulich 7y ago
"Users of Windows Vista can download the updates (Monthly Rollup or Security Online) of Windows Server 2008 from the Update Catalog and install them manually." https://borncity.com/win/2019/05/15/critical-update-for-windows-xp-up-to-windows-7-may-2019/ https://borncity.com/win/2019/05/15/critical-update-for-wind... But this is definitely confusing. MS explicitly offers patches for Win 7, Server 2008, Server 2003, and XP, but there's no "Vista" link visible. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 https://portal.msrc.microsoft.com/en-US/security-guidance/ad... https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708 https://support.microsoft.com/en-us/help/4500705/customer-gu...
- dmix 7y ago
  It makes sense not to mention Vista in a headline consider the very low usage rates. If anyone should not expect security update news via popular news outlets its Window's Vista users. There are plenty of niche channels for niche product releases.
  - bArray 7y ago
    On a side note, I think that Vista wasn't necessarily unpopular, it just had a good upgrade path/incentive for users (unlike XP to Vista).
    - n4r9 7y ago
      It was one of the least popular versions of Windows, no? Certainly its market share never exceeded XP's.
      - bArray 7y ago
        I think Vista was the least popular as you say, but I think that was because the upgrade path/incentive wasn't there. The upgrade from XP to Vista meant a lot of software stopped working, especially from a driver perspective. If you're using some niche software that "just works (tm)", why change? Especially if it costs a lot of money to upgrade or your system isn't networked. The UK tried to upgrade its XP running backbone years ago, failed - and still got billet £10+ billion.
    - rincebrain 7y ago
      My perception for a long time has been that Vista, from a technical perspective, was leaps and bounds above XP, but the end user experience was sometimes lacking; 7 didn't provide drastic technical improvements so much as offering a much-polished Vista.
      - tunap 7y ago
        Windows 7 should have been called Vista SP7. That is what I called 7's hasty premier after Vista's lackluster debut.
    - AdmiralAsshat 7y ago
      No, it was quite unpopular, period. See: https://xkcd.com/528/ https://xkcd.com/528/ There was the popular perception at the time that every other version of Windows was good, while the in-betweens sucked. Vista followed that expectation perfectly, as did Windows 8.
      - will4274 7y ago
        > No, it was quite unpopular, period. See: https://xkcd.com/528/ https://xkcd.com/528/ I've always read this comic as making fun of people for having unjustifiably low opinions of Vista.
- rincebrain 7y ago
  Not surprised the 2008 patch is intended to work on Vista, I was more bemused that they had an otherwise exhaustive list of versions and how to patch them, and just...left it off, not only in the headlines, but in a number of the enumerations.
jlarocco 7y ago
That's an incredibly ironic complaint coming from a Google employee. Let me know next time you guys patch Google Reader.
- saagarjha 7y ago
  Reader is a discontinued product that nobody can use. Patching it makes no sense.
  - jlarocco 7y ago
    That was a joke, but it's why the OP was so ironic. Google has absolutely terrible support. You can't even use their products when they discontinue them, and they discontinue them all the time. Maybe I should have used Nest for my example, which people actually paid for, put in their houses, and now can't use any more. Last release of XP was 11 years ago. Extended support ended 5 years ago. Yet people who want to use it still can, and even still get occasional security patches. Even Vista is still usable and gets updated, as mentioned in a sibling comment.
    - semi-extrinsic 7y ago
      The difference is probably in part caused by the markets for Google vs. Microsoft products that we are discussing. If Google shafts a private person they might get angry and buy Apple next time, and Google loses a few hundred bucks. But if Microsoft shafts the XP machine in a hospital that runs their old MRI machine or whatever, that's a potential PR crisis and possibly a million-dollar lawsuit.
- dang 7y ago
  That crosses into personal attack and you can't do that here, regardless of how strongly you feel about someone or their employer. Please don't do that here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
NKCSS 7y ago
RDP is not on by default, so I don't see how that's a big deal.
chenzhekl 7y ago
Maybe the market share of Vista is so small, that Microsoft doesn't bother releasing a patch for it. There's no patch for Windows 8, either.
- rincebrain 7y ago
  8 and 10 aren't vulnerable, according to their writeup about it. As someone commented above, there's a footnote about how Vista users can use the Server 2008 patch, I was more amused that in an apparently-complete enumeration of versions in a table, they just...left it off.
will4274 7y ago
From netmarketshare.com: - XP market share: 3.57% - Vista market share: 0.23% - Mac OS 10.10 market share: 0.51% (10.10 went out of support the same year as Vista)

baroffoos 7y ago

I don't understand why they would do this. If I was a microsoft manager I would be glad something like this happened because it would force people off of old OSs without having the bad rep of doing it through nag popups. Now everyone on XP will feel safe because its still getting updates.

jafingi 7y ago
Many institutions and hospitals still use XP. And they pay Microsoft a lot to support it.
- kbumsik 7y ago
  Do they really still pay for XP? I thought it went completely EOL some years ago.
  - DKnoll 7y ago
    Yep, NHS for example.
    - andygates 7y ago
      We had extended support for a couple of years but now it's dead dead deadski. Like any other large industrial org, there's some bits of million-pound kit with integrated, essential XP. Likewise old essential software where the support has literally retired, running on 2003. We've got roadmaps for replacing it, but they're not instant. We manage it as best we can. But broadly we're just about to go to 10 on desktops, so we're not as bad as the police!
      - DKnoll 7y ago
        Glad to hear it. When I worked for a NHS software vendor a couple years ago there were still XP workstations about. I guess it probably varies by the trust as well.
    - ollie87 7y ago

deleted 7y ago

[deleted]

ccnafr 7y ago

Don't read Krebs articles... or he'll doxx you. Like he did to some researchers on Twitter who disagreed with his dumb opinion.

Nextgrid 7y ago
Care to elaborate?
ryanlol 7y ago
But where does the second x come from?
nkrisc 7y ago
How could he doxx you just by reading an article on his site?

cf141q5325 7y ago

Its especially unfortunate since KB4474419, the sha2 update for Windows Seven, defacto disabled updates for quite a few people with dualboot or encrypted system partitions in mid March.

cpach 7y ago
Disables updates? How?
- cf141q5325 7y ago
  The update fails and gets automatically reverted. I dont think you can get the monthly security updates without it, at least that was the case with the April rollout. Since its not immediately clear why the update fails, you can even now find quite a few people looking for help to diagnose the error online. edit: Here some context https://answers.microsoft.com/en-us/windows/forum/all/kb4474419-will-not-install/658900bc-3103-4a0e-a9ed-08c5c2d31e76#?page=7 https://answers.microsoft.com/en-us/windows/forum/all/kb4474... its an easy fix for for dualboot if you can just replace grub with mbr again, but people with disc encryption are rather screwed it seems.
gruez 7y ago
>encrypted system partitions Does this include bitlocker? Or is this an issue with third party boot loaders so bitlocker is fine but truecrypt is not?

MagicPropmaker 7y ago

Wow! Good for Microsoft. You don’t see Apple releasing patches for 15+ year old operating systems.

justin66 7y ago
Neither did Microsoft, as far as I can tell: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 https://portal.msrc.microsoft.com/en-US/security-guidance/ad...
- Notre1 7y ago
  There are XP patches. I wonder if that CVE page is autogenerated and doesn't include out-of-support operating systems. https://support.microsoft.com/en-us/help/4500705/customer-guidance-for-cve-2019-0708 https://support.microsoft.com/en-us/help/4500705/customer-gu...
auiya 7y ago
Apple makes all their OS releases free to their users, so there's much lower numbers of 15+ year old Apple OS's existing in the wild to begin with. If you'd said you don't see Apple releasing patches for 15+ year old computers, I'd be more inclined to agree.
- zeusk 7y ago
  Heh, because Apple prefers to arbitrarily leave out support for their older systems on newer OS releases.