Windows 7 Not Vulnerable To SMB Flaw
- 2
- Add a Comment
Microsoft was quick to issue an advisory after first reports suggested that a Windows flaw could attack both Windows Vista and Windows 7. After the flaw was discovered, Microsoft was quick to note that Windows 7 was NOT one of the operating systems that could be attacked. In an advisory the company stated the following information:
General Information
Executive Summary
Microsoft is investigating new public reports of a possible vulnerability in Microsoft Server Message Block (SMB) implementation. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time.
We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers.
Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.
Microsoft is concerned that this new report of a vulnerability was not responsibly disclosed, potentially putting computer users at risk. We continue to encourage responsible disclosure of vulnerabilities. We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone’s best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed.
The article goes on to state that neither Windows 7 nor Windows XP have any issues with the SMB problem.
Comments welcome.
2 Comments
the oracle
September 9th, 2009
at 10:34am
Kind of makes you wonder who is telling the truth, since I spoke a couple of days ago about this, and I cited and article in slashdot, and one on Betanews, both saying that it was true.
Microsoft has been known to deny something, then very quietly resolve the problem, under the guise of something else.
If the articles on slashdot and Betanews were not true, I’d think we’d be seeing some sort of legal response from Microsoft, instead of a PR.
Ryan Farmer
September 10th, 2009
at 9:56pm
Microsoft has a different methodology for patching Windows than Linux and the free software stack have for patching their stuff.
The Linux methodology is that anything that could potentially be exploitable is tagged as having security implications and is fixed, while Microsoft usually waits til there is some kind of attack code out there *already* infecting Windows systems.
That’s the reason why they try to tell you that open source software has more security bugs, because open source software tends to fix things that Microsoft lets go for years and only fixes when they can no longer hide the problems.