Dan said:
I know this is an XP newsgroup but I thought users might like to know
about
this vulnerability. You can feel free to connect it to a general 2000
newsgroup or any other microsoft newsgroup that you may see fit to do.
FYI -- Windows 2000 still has a critical vulnerability as identified
by
eeye.com and eeye are great because they help keep Microsoft on their
toes.
The recent critical update(s) dated January 11 from Microsoft
fixed a vulnerability in 98SE, ME, 2000, XP
that this company had knowledge about for a while. This one is still
out
there and
overdue for being fixed.
http://eeye.com/html/research/upcoming/index.html
http://eeye.com/html/research/upcoming/20040802-C.html
Because the "advisory" article makes no mention of WHAT is vulnerable
then it is a worthless advisory and only useful for internal tracking
purposes within Eeye. "Oh look, I found a security hole" means nothing
when we all know there will always be security holes. Was it using file
sharing and hacking in through a printer server, or yet another buffer
overflow exploit, or a "default installation" with NO updating at
Windows Update which would include a patch to fix the vulnerability, or
WHAT? Telling the FBI that there is a car filled with explosives that
is going to suicide drive into a government building does little to help
them combat the problem without SOME description of the car and which
building. Issuing vague warnings is as useful as using an Ouija board.
Describing the problem does NOT necessitate divulging the vulnerability.
Why warn anyone about an undisclosed problem since obviously you aren't
helping them in any way to avoid the problem? The problem only occurs
under certain conditions, within a particular environment, and under
specific configurations, so obviously the users could be warned about
what they could do to avoid the problem without actually detailing how
to implement the problem. Something bad is going to happen to you.
What? Not going to tell you but it's happening right now. WHAT?
Sorry, but until there is a cure, we won't tell you. You mean I have a
disease? Yes, but we're not going to tell you what it is or what it
does nor are we going to provide any information to tell you how to
mitigate its effects until someday we discover the cure. Yeah, thanks
for NOTHING except for the angst. What's the difference between the
user that had absolutely no knowledge of the advisory and another user
that has been informed of the "advisory" but it left completely in the
dark as to WHAT it advising? Angst, that's what is the difference.
If you don't have anything good to say, don't say anything. Since the
advisory is completely uninformative to users, it has nothing good to
report (by way of advising users how to avoid the purported problem).
Say I have information on how a virus could damage monitors by burning
them out but I'm not going to say anything until a cure is found. As I
recall, the purpose of providing an INF file for monitors was because,
at one time, some monitors would fry if you ran them at an unsupported
refresh rate, like 80Hz. But until manufacturers provided INF files or
altered their circuits to prevent the damage, apparently you and Eeye
believe that users should not have been given any information about how
to protect their hardware, so let users burn up the monitors while
providing a worthless advisory about an undescribed problem that can
result in destroying their hardware.
Have you ever read the descriptions of hotfixes and security updates?
Do you really believe those descriptions provide ample and clear
instructions to hackers on how to implement the security breach? Yet
they provide information regarding the environment needed to produce the
problem and how to mitigate the problem if such prevention is known.
Also, after the "cure" is found in a patch or update and describe in a
hell of lot more detail than anything disclosed by Eeye, does that mean
the problem is instantly avoided simply by the release of the patch or
update? How about all those computers that have yet to install the
update and yet, according to you and Eeye, the information disclosed by
the description of the security would incur damage to all those
unpatched hosts. If describing the problem were so horrendously an
irresponsible action then why does Microsoft provide technical details
for released patches since obviously that patch isn't instantaneously
distributed and install on every Windows platform around the world?
