Windows: Unsafe at any speed?

24.10.2008
Ever have one of those old jalopies you just can't seem to get rid of? It chugs along, but the wheels keep coming off, the transmission's making a disturbing ka-thunka-thunka noise, and there's a viscous oily substance oozing from the crankcase? Yet its creators keep telling you that it just needs a little wax job and everything will be fine. No, I'm not talking about the McCain campaign; I'm talking about , issued Thursday more than two weeks ahead of the usual Patch Tuesday release.

Something has apparently gone terribly wrong with the network file and print sharing services for . (The flaw also affects Vista and Server 2008, but less severely.) Microsoft is not only issuing an out-of-cycle patch for the first time since April 2007, it's fixing a critical flaw that hasn't been reported by any of the usual suspects in the security community. So it must be HUGE.

Per :

...the list of services that could be affected by this latest hole, is astounding. Most importantly, anything that relies on Server Message Block (SMB) including the Common Internet File System (CIFS), any kind of file or print sharing, remote group policy enforcement, the print spooler, the indexing service, and network logon -- all of these are among the items impacted by a potential hijacking of the Server service. Essentially, anything that need[s] sharing or to be shared goes through the SMB protocol, which is managed by the Server service.

As IDG's Bob McMillan reports, security wonks needed just two hours to come up with code using that old hacker chestnut, the stack overflow exploit.

There was a time when Microsoft would sit on this sort of thing for weeks, waiting for an exploit to occur. So give them credit for being proactive. Still, it's kind of like GM issuing a warning saying your Chevy's engine may suddenly explode when you hit 60 mph, so you might want to bring it in for a tuneup.