RSSMicrosoft Patches Vista Flaw, 4 Others
By Ed Oswald | Published April 10, 2007, 3:37 PM
As part of April's Patch Tuesday, Microsoft corrected an issue within Windows Vista that could allow for a variety of attack vectors, along with issuing patches for three other Windows flaws and one in Content Management Server.
The Vista related flaw resides in Windows Client/Server Run-time Subsystem (CSRSS) process, Microsoft said in an advisory. Three separate flaws are fixed by the patch, including a critical code-execution problem and two less serious denial-of-service and privledge escalation risks.
Also affected are Windows 2000, Windows XP Service Pack 2 and Windows Server 2003, as well as 64-bit versions of those products.
Two critical flaws in Microsoft's Content Management Server, used to build and maintain Web sites, have been remedied. Microsoft says that a memory corruption vulnerability, as well as a cross-site scripting and spoofing risk existed.
A code execution flaw within Universal Plug and Play has been fixed, in addition to an issue within Microsoft Agent that could execute arbitrary code when specially crafted URLs are visited.
Finally, a kernel flaw has been addressed that would allow for privilege escalation attacks, although Microsoft only gave this its second-highest risk rating, "important." According to the advisory, the flaw is exploited due to incorrect permissions being given to a mapped memory segment.
Amol Sarwate, vulnerability research lab manager at Qualys, explained that out of the five patches, the Vista patch is the most important. "This vulnerability contains a fix for a zero day vulnerability so it is the most critical of the patches," Sarwate said. "It can be attacked via the Web to allow remote code execution."
Paul Zimski, director of product and market strategy at PatchLink seemed to agree, although added the Vista fix shows that there continue to be problems with Microsoft's new operating system.
"Organizations need to take notice that although Vista is more secure, it is certainly not immune from vulnerabilities. PatchLink recommends that organizations prioritize deploying the Vista-related, 017 and 021, patches ASAP," he told BetaNews Tuesday.
Both companies recommend applying all patches as soon as possible.
"Paul Zimski... added the Vista fix shows that there continue to be problems with Microsoft's new operating system."
Wait, I guess I missed the memo that said Vista was perfect, I'll have to find that. Its a fact of life, all OS's need updates/fixes/patches/SP's/etc. Vista, XP/2000, OS X, Linux distros. I ran Ubuntu on my laptop for nearly 7 months and every other day I was installing updates and fixes.
I bought a new laptop in Jan. and it runs Vista Home Premium. I admit it has its problems, but from what I've experienced they are minor annoyances at most. The worst thing about Vista to me was UAC. Turned that crap off about an hour after I got my laptop. For power users its unnecessary, for the avg. user its a good thing.
Score: 0
|Security is fine and good, but Vista has more needy bugs that need patches:
- Random system slowdowns for no good reason, I never see a process taking up the CPU.
- Explorer copy dialog is too much of a CPU hog and runs way too slow.
- Explorer move dialog, when merging folders, does not always properly remove the empty source folders.
- General performance issues, even with glass etc off in some DX9 games including Source engine (hopefully the DX10 support soon will help work around this).
- I WANT MY WIIMOTE TO WORK WITH VISTA :( (others have claimed to have it working, but both GlovePIE and BlueSoleil crash when I try to run either so I can't get it working. Works fine in XP).
- Other stuff I've forgotten about.
Score: 0
|Even Apple patches their products
Score: 0
|what abyssmal boot time? Vista runs fine (well for me) and it loads faster as its ready to go even though icons may still be loading. (again, also for me)
Why would the patches speed up the time. ITS A SECURITY PATCH, maybe you should get a mac because it spells it out for you and holds your hands through all those "words" in case you couldnt read the SECURITY bulletin.
Score: 0
|Microsoft Promised that Vista would implement a new patch mechanism that would not require so many reboots.
Score: 0
|every OS has to reboot, sometime.
Score: 0
|I figured Mary Jo Foley might know a little more about this complaint than you. It was at her site that boot times were discussed. Are you trying to say that the impact of a Microsoft security patch is limited to security? You must be new here.
Score: 0
|I have an OS2 box with no reboots for 3 years. Before that (we moved) it had a 5 year uptime.
Also, for Unix and it's derivatives it's not uncommon to go 6+ months without rebooting, and yes those are client and server systems.
Score: 0
|Still ... a reboot is a reboot.
Latz, SB
Score: 0
|The patches did nothing to speed Vista's abysmal boot time. This was discussed by other sites as the number one complaint of Vista users. I took all the Linux distros off my systems, it may be time to restore them.
Score: 0
|Have to laugh that last week's critical patch caused problems for a huge number of new PCs with the Realtek HD audio. Patch the patch, MS? At least it's bringing in money for us techies - cleaning up after Automatic Updates. ;)
Score: 0
|See: Made up facts.
Score: 0
|Whatever happened to
the April Malicious Software Removal Tool?
Score: 0
|you know what we need to make this newsworthy? a nice new ridiculously malicious virus that takes down half of the internet. its been ages since the last retardedly massive internet worm meltdown. maybe all these patches and periodic updates are finally starting to pay off...
Score: 0
|we could always remove the patches and see what happens
Score: 0
|let the flaming begin...
Score: 0
|its not even worth starting a flame war anymore. periodic patches are expected. without the stinging reminder of brutal system demolition every 2 to 4 months its just another patch... no drama in that.
Score: 0
|What? You mean, "bash bash bash M$ bash bash linux rulz bash winblows bash bash ipod #1 bash bash open source"??
Score: 0
|just did today's 3 updates to vista now i lost all my dvd and thumb drives... yea for microsoft! tried to revert back using system restore and still the same. uninstalled my drives and ide controller still giving me the same problem says the drivers are missing or corrupted and they are microsoft's drivers....
Score: 0
|I don't believe you.
Score: 0
|ya i know i was just really bored so i decided to kill some time by coming up with a nice lie about microsoft's patchs killing my dvd and thumb drives just to waste some time. and of course if you follow the link below it will take you to an imaginary fix for the problem
http://support.microsoft.com/kb/320553
Score: 0
|Thanks.
None of my USB or virtual drives show up in the explorer window (unless I access them by typing in the drive-name).
Was able to work around it by putting links on the desktop (setting the drive letters via disk-manager).
Hopefully this will make that redundant.
Of course, this issue occurred on my system well before the patches were applied so I think it may have something to do with something unrelated and the patch just worsened it for some folks. Wouldn't be the least bit surprised if it was an nForce issue in reality.
(Note that the fix is for XP *and* Vista systems and is not related specifically to any specific patch)
Score: 0
|Yeah except the patch doesn't look like it was the cause of the issue and anytime you use childish terms to describe a company it makes your post look like you are trolling.
Score: 0
|No, it's not the patch. It's a driver issue, according to the page.
The wrong device driver was installed during installation. I'm surprised we don't see more of this actually, given the amount of drivers windows must be able sift through during setup.
Score: 0
|i've been running vista home premium since day after launch and have had absolutely 0 problems with it everything works perfect (now you can call me a liar)until last night after i rebooted from the patch install i went to watch a dvd and noticed all the drives were gone. i have 2 thumb drives that have always showed up before in explorer one oddity i did notice is my 1gb sandisk i use for readyboost still shows up in explorer but the drivers say they haven't loaded that started after i enabled readyboost on it you can still r/w to it. that knowledge base article obsiously doesn't relate to what caused my issue but i just wanted to list it incase it happens to anyone else seems to do the trick to get your drives back.
Score: 0
|If the kb doesn't relate, why did you attempt to use it to support your disdain for a patch that the kb doesn't have anything to do with?
I read the post you linked it in, and you were definitely using it to support your claims of a bad patch.
Score: 0
|