New Security Hole found in Windows
Friday, July 25, 2003 by yrag2 | Discussion: WinCustomize News
Microsoft Corp. on Wednesday warned customers of a serious hole in all versions of Windows that could completely compromise a vulnerable machine.
The vulnerability lies in the DirectX technology that is included with Windows and is used to run multimedia presentations. One of the technology's components, DirectShow, contains two buffer overruns in the function that is used to check parameters in MIDI files.
An attacker who could create a malicious MIDI file and entice a user into opening it or visiting a Web page containing the file would be able to execute any code he chose on the user's machine. The code would run in the security context of the user.
The weakness affects several different versions of DirectX in various configurations and is the second serious problem to affect Windows Server 2003 in the past week. Microsoft last week had to issue a patch for a vulnerability in the Remote Procedure Call (RPC) protocol that handles message exchanges over TCP/IP. The vulnerability, which arises because of incorrect handling of error messages, affects a particular Distributed Component Object Model interface with RPC.
The vulnerability lies in the DirectX technology that is included with Windows and is used to run multimedia presentations. One of the technology's components, DirectShow, contains two buffer overruns in the function that is used to check parameters in MIDI files.
An attacker who could create a malicious MIDI file and entice a user into opening it or visiting a Web page containing the file would be able to execute any code he chose on the user's machine. The code would run in the security context of the user.
The weakness affects several different versions of DirectX in various configurations and is the second serious problem to affect Windows Server 2003 in the past week. Microsoft last week had to issue a patch for a vulnerability in the Remote Procedure Call (RPC) protocol that handles message exchanges over TCP/IP. The vulnerability, which arises because of incorrect handling of error messages, affects a particular Distributed Component Object Model interface with RPC.
voo
Reply #2 Friday, July 25, 2003 7:34 PM
Reply #2 Friday, July 25, 2003 7:34 PM
Longhorn will have alot of security bugs or whatever when its new.
By time Longhorn comes out id imagine XP SP3 be out and it should be rock solid etc
By time Longhorn comes out id imagine XP SP3 be out and it should be rock solid etc
XX
Reply #3 Friday, July 25, 2003 9:00 PM
Reply #3 Friday, July 25, 2003 9:00 PM
i prefer to have lot of patches than lot of unpatched holes.
George Rogers Jr
Reply #4 Saturday, July 26, 2003 2:59 AM
Reply #4 Saturday, July 26, 2003 2:59 AM
Your right Ian & Mr.XX of course....its just SEEMS every two weeks you read about another major "security hole" at the Neowin site about Xp - it would be nice to go a few months without one. 
werewolf
Reply #5 Saturday, July 26, 2003 12:47 PM
Reply #5 Saturday, July 26, 2003 12:47 PM
The only problem is that *sometimes* the patch can hose your system and you then need a patch for the patch of the patch 
macrobaye
Reply #6 Sunday, July 27, 2003 1:41 AM
Reply #6 Sunday, July 27, 2003 1:41 AM
*cough* if any of you have a problem with security, get a mac *cough*
no, seriously!
(118 Days and not a single crash (PowerMac G4 DP1.25GHZ))
no, seriously!
(118 Days and not a single crash (PowerMac G4 DP1.25GHZ))
Tech-Cat
Reply #7 Sunday, July 27, 2003 2:31 AM
Reply #7 Sunday, July 27, 2003 2:31 AM
*cough* if any of you have a problem with security, get Linux *cough*
Sorry Windows, but most Viruses and Hackers target Windows.
Sorry Windows, but most Viruses and Hackers target Windows.
TheD2JBug
Reply #8 Sunday, July 27, 2003 8:15 AM
Reply #8 Sunday, July 27, 2003 8:15 AM
I find the last two posts kinda questionable when placed into the context that this is WINcustomize.com
DaWebMassa
Reply #10 Sunday, July 27, 2003 9:46 AM
Reply #10 Sunday, July 27, 2003 9:46 AM
If you are REALLY concerned about security... get a typewriter.
XX
Reply #11 Sunday, July 27, 2003 1:38 PM
Reply #11 Sunday, July 27, 2003 1:38 PM
hm it's simpler if youre concerned about security is just to use a computer without any connections to internet.
that way you got all benefits of computer without any problems from connection to internet
that way you got all benefits of computer without any problems from connection to internet
Tech-Cat
Reply #14 Monday, July 28, 2003 1:09 AM
Reply #14 Monday, July 28, 2003 1:09 AM
...but still Windows has competition from Linux and Mac. They have had great influence on Windows skinning. The Crystal icons originated on Linux. Aqua skins originated on Macs.
TheD2JBug
Reply #15 Monday, July 28, 2003 10:51 AM
Reply #15 Monday, July 28, 2003 10:51 AM
not denying that .. but this is hardly the place to be all preachy about alternative OSes, due to the fact that this is a windows skinning website.. It would be more appropiate to go to slashdot
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Friday, July 25, 2003 5:03 PM