main

Microsoft: Vista's Secure, Not Perfect

Daniel Fleshbourne   on 29 December 2006 - 17:40 · 20 comments & 9476 views

Advertisement (Why?)
Last week's disclosure of a zero-day vulnerability in Windows Vista doesn't put a lie to the claim that it's the safest Microsoft operating system so far, a company security manager has said. "The finding of vulnerabilities in any software is to be expected," said Stephen Toulouse, senior product manager with Microsoft's security technology group, in a blog posting earlier this week. "This is all part of the process of creating complex software today, and no one is immune to it. It's not, as they say, big news to us in the security industry."

Proof-of-concept code for an unpatched bug in all supported versions of Windows, including Vista, went public last week, prompting warnings from security vendors who classified the flaw as a low or medium threat. Microsoft has said it was "closely monitoring" the situation, but has not released any additional information since Dec. 22. Toulouse countered that the exploit doesn't invalidate Microsoft's contention that Vista is more secure than its predecessor, Windows XP. "This product [is] the most secure version of Windows we've produced to date. That doesn't mean 'zero vulnerabilities.' No one can claim that crown," he added.

View: The full story
News source: CRN

Post a comment · Send to friend Comments · There are 20 additional comments
(2 replies) #1 phiberoptik on 29 Dec 2006 - 17:41
News Flash - Imperfect Software, created by Imperfect Beings.
#1.1 +guylaroche on 30 Dec 2006 - 05:24
Isn't all software therefore flawed?
#1.2 billyea on 30 Dec 2006 - 08:07
Quote - guylaroche said @ #1.1
Isn't all software therefore flawed?

Yes.
Even "Hello World" is flawed.
#2 spook_man on 29 Dec 2006 - 17:51
Could this be considered an oxy-moron?

I can go 200 mph on P rated tires.. hmmmm...
(3 replies) #3 xploit1030 on 29 Dec 2006 - 18:09
This should shock no one, it was only a matter of time. I wouldn't have guessed that the first vulnerability would have been found it all previous OSs though.
Anyhow now that it is overwith everyone can move on and start approving those VISTA patches in WSUS that are bound to come out soon.
#3.1 toadeater on 29 Dec 2006 - 19:23
Quote - xploit1030 said @ #3
This should shock no one, it was only a matter of time.


I think it shocked Jim Allchin.

During a telephone conference with reporters yesterday, outgoing Microsoft co-president Jim Allchin, while touting the new security features of Windows Vista, which was released to manufacturing yesterday, told a reporter that the system's new lockdown features are so capable and thorough that he was comfortable with his own seven-year-old son using Vista without antivirus software installed.

http://www.betanews.com/article/Allchin_Su...irus/1163104965
#3.2 PureLegend on 29 Dec 2006 - 19:52
Quote - toadeater said @ #3.1
Quote - xploit1030 said @ #3
This should shock no one, it was only a matter of time.


I think it shocked Jim Allchin.

During a telephone conference with reporters yesterday, outgoing Microsoft co-president Jim Allchin, while touting the new security features of Windows Vista, which was released to manufacturing yesterday, told a reporter that the system's new lockdown features are so capable and thorough that he was comfortable with his own seven-year-old son using Vista without antivirus software installed.

http://www.betanews.com/article/Allchin_Su...irus/1163104965
Never seen that before. So how does this "lockdown" work? Is this just UAC he's rambling on about?
#3.3 raskren on 29 Dec 2006 - 20:53
At the official Windows Vista blog he has clearly stated that his son doesn't use email applications, instant messaging clients, and downloads are blocked. He is also running under a Limited account.

http://windowsvistablog.com/blogs/windowsv...e-in-depth.aspx

toadeater is just spouting off nonsense. Where does it say J. Allchin was shocked?

Last edited by raskren on 30 Dec 2006 - 00:25
#4 Lasker on 29 Dec 2006 - 20:12
MAC OS X and all flavors of linux are not perfects either, you can find vulnerabilities and bugs everywhere
#5 waxman830 on 29 Dec 2006 - 20:24
YAWN!!!!!!!
(1 reply) #6 olger901 on 29 Dec 2006 - 21:34
well I can


<?php
     echo "Hello World!";
?>


Hey, whatta ya know, it doesn't contain a security bug!
#6.1 RealFduch on 01 Jan 2007 - 03:50
Actually it has. If I call this app hosted on php 1.7.2 and pass thousand of As and some code as a parameter name and value the engine will execute arbitrary code atoed in the data.
(1 reply) #7 Sekhmet on 29 Dec 2006 - 22:13
Actually "most secure Windows to date" doesnt mean jack, considering how terribly bad all previous Windows versions were.
#7.1 billyea on 29 Dec 2006 - 22:24
Windows XP + SP2 is regarded as VERY stable and fairly secure.
What you're talking about is anything earlier.
#8 macstorm on 29 Dec 2006 - 23:41
OMG what a conclusion!
#9 thenay on 30 Dec 2006 - 01:08
No software is free from defects regardless who makes it.
#10 billyea on 30 Dec 2006 - 01:49
Talk about stating the obvious.
#11 7Dash8 on 30 Dec 2006 - 04:18
Unfortunately some people need the obvious stated to them. All the anti-MS fanboys out there were hyping the story about the Vista flaw up so much, it needed someone to come out and state the bleeding obvious - no OS is completely secure, no matter what anyone says.
#12 Croquant on 30 Dec 2006 - 15:33
This is just the tip of the Post-RTM bug iceberg. You watch, there's gonna be a flood of unpatched vulnerabilities revealed in 2007 and beyond.
Edit this comment #13 Guest on 02 Jan 2007 - 16:06
Of course, everyone knows that all man-made software is subject to human error and Microsoft admitted a long, long time ago that neither Windows nor any other Microsoft product would ever be "perfect" because of this.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)