http://www.microsoft.com/technet/security/current.asp
MS03-038 : Unchecked buffer in Microsoft Access Snapshot Viewer Could
Allow Code Execution (827104)
snip other bugfixes.
My original post provoked some interesting replies.
Some points.
The Unices (HP-UX, AIX, Linux, BSD, etc) are inherently secure operating
systems out of the box. The Win3x, Win9x, WinME series are not and never
can be. The latter are single user, time sliced operating systems. The
former are genuine, permission locked multi-user, multi-tasking operating
systems.
The WinNT, Win2K, WinXP series are a different ball game. They followed
the Unix model (as does the Mac OSX) and are genuinely multi-user
multi-tasking out of the box. In fact WinNT used chunks of BSD code (quite
legally given the wide freedoms given in the original BSD licence)
especially in the networking code.
I would have no hesitation in using a Windows 2000 Server (fully up to
date with patches) in mission-critical applications. (Forget WinNT as it's
no longer supported for critical updates.)
WinXP I wouldn't touch as it's not mature enough. Microsoft opted with
WinXP to provide "useability" over security (form over function). It
ships, especially the Home edition, with far too much garbage enabled.
However, Microsoft has indicated that they will update XP to a more
"hardened" (less services running by default) release in the future. Lest
this be construed as criticising Microsoft only it should be pointed out
that the Linux Distributions have also had to learn this the hard way.
Early Linux distributions also shipped with dozens of services running.
The computing environment has changed and all Operating Systems now have
to start putting security first and bells and whistles second.
Microsoft's track record in critical problems in their core Operating
Systems is abysmal in comparison with the "professional" unices (AIX,
HP-UX, etc) but Microsoft were producing consumer products where ease of
use was paramount and indeed are greatly responsible for the ubiquity of
the "home computer".
Linux still has a better track record than ANY Microsoft Operating System
when apples are compared with apples. The core Linux kernel and services
have had very few critical bugs over the years. BUT, all modern Linux
Distributions (note the use of the word distribution) ship with many
thousands of disparate applications. And each distribution supports ALL of
the applications they ship. When did your hear of Microsoft issuing
bugfixes for WinAmp, Mozilla, Netscape, Adobe Acrobat, etc. Microsoft
supports Microsoft, bugger everyone else. Indeed Microsoft has, in the
past, conspired to break competitor's application ("DOS ain't done till
Lotus won't run").
The computing environment is changing (it's a big bad world out there) and
Microsoft is showing signs of changing. Much of that change is being
driven by Linux and you can see the fear in Steve Balmer and Bill Gates
pronouncements and actions. But Microsoft has existed as a monoculture for
a long time. They have tens of millions of lines of legacy code in WinXP
that have never been subject to peer review. It will take time but it will
happen if Microsoft wants to survive.
At the end of the day all Operating Systems are different. For example
there are far more freeware applications available for Linux (by many
tens of thousands) but there are still high-end applications that are only
available on Windows. (That however is changing - digital rendering for
CGI in multi-million dollar movies being an example). Religious wars are
facile wherever over doctrine or Operating Systems.
Regards
Gordon
