12.27.09

Windows Users Left Vulnerable Over Christmas, as Usual

Posted in Security, Servers, Windows at 5:06 am by Dr. Roy Schestowitz

Boycott Novell on hand

Summary: Users of IIS on Windows Server are served another blow while they are on vacation; other minor news from the past week

JUST ABOUT every year — including the previous one — Microsoft clients are left to be worried about their computers. Statistics suggest that roughly one in two Windows PCs is a zombie PC.

This Christmas is no exception, but the main victim appears to be users of Windows Server with IIS. Microsoft already neglects Windows Server when it comes to security [1, 2, 3] and now comes this (reported on Christmas Day):

“Microsoft IIS vuln leaves users open to remote attack

A researcher has identified a vulnerability in the most recent version of Microsoft’s Internet Information Services that allows attackers to execute malicious code on machines running the popular webserver.

The bug stems from the way IIS parses file names with colons or semicolons in them, according to researcher Soroush Dalili. Many web applications are configured to reject uploads that contain executable files, such as active server pages, which often carry the extension “.asp.” By appending “;.jpg” or other benign file extensions to a malicious file, attackers can bypass such filters and potentially trick a server into running the malware.

How predictable. This begs for an explanation: why did the US government choose a Microsoft veteran to head security for example?

Howard Schmidt is still being analysed and Bruce Schneier writes:

I head this rumor two days ago, and The New York Times is reporting today.

Reporters are calling me for reactions and opinions, but I just don’t know. Schmidt is good, but I don’t know if anyone can do well in a job with lots of responsibility but no actual authority. But maybe Obama will imbue the position with authority — I don’t know.

Speaking of this additional Microsoft influence in the United States, Amico has just hired a Microsoft veteran.

Amico Engages Former Intel and Microsoft Software Developer for North American Expansion

[...]

Mr. Glass has over 20 years of experience in software development and has previously provided services for top companies such as British Telecom, Intel, Cisco Systems, Barclays and Microsoft.

Microsoft employees write buggy code. To give an example from several days ago, watch what Xbox is up to:

Microsoft Accidentally Charges $800 for Arcade Game

[...]

In all seriousness, this is certainly just an error on Microsoft’s part – someone meant to type in “800 MS Points” (or $10) and ended up pricing the game at 80 times that.

It could be a human error at the input level, but still…

Looking at something a little different now, Motley Fool, a Microsoft fan site for the most part, is worried about the continued decline of Internet Explorer, which represented a form of Microsoft grip on the Web.

StatCounter, an analytics firm, says that Firefox’s share of the browser market now stands at 32.06%, up almost seven percentage points from last November. Internet Explorer’s share fell more than 12 percentage points over the same period.

[...]

Microsoft investors have reason to worry. This is a war, and it’s being fought in the browser. The most functional environment for cloud computing will win this conflict. Going by the trend in the numbers, users increasingly believe that’s Firefox.

More information in:

According to some of the latest figures, Microsoft loses share in both Web browsers and Web servers. Security problems are among the catalysts spurring this trend.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. InteLeaks – Part XXVII: 'Pulling a Nokia' on Intel (Outsourcing to Microsoft)

    The recommendation of an Intel marriage with Microsoft (even in units that deal mostly with Linux) is an insulting slap across the face of developers employed there; we take a look at recommendations made to IoTG (Intel) by a firm with Microsoft orientation



  2. IRC Proceedings: Thursday, January 21, 2021

    IRC logs for Thursday, January 21, 2021



  3. InteLeaks – Part XXVI: Harbor Research is Horrible 'Research', Lacking Actual Technical Background

    Having looked at the members of staff of Harbor Research (individually), it seems clearer now why they have an affinity for Microsoft and why they're directing Intel to liaise with Microsoft and become a prisoner of Microsoft (even in areas where Microsoft is increasingly irrelevant)



  4. Links 21/1/2021: Raspberry Pi Pico, Ubuntu 21.04 Picks GNOME 3.38, KDE Plasma 5.21 Beta

    Links for the day



  5. How a Newly Inaugurated President Biden Can Advance Software Freedom (If He Actually Wishes to Do So)

    Techrights has 'Four Suggestions' to President Biden, the 46th 'front end' of American plutocracy



  6. InteLeaks – Part XXV: Intel's Brain Drain Leads to Unusual Measures

    As the company once known as 'chipzilla' loses its relevance and dominance in the market it's reaching out to retired people, trying to get them back onboard



  7. Hey Hi (AI) is Just a Trojan Horse for Illegal Software Patents, According to EPO Management and Litigation Firms It's in Bed With

    The longtime pushers or the lobby of patent profiteers just carry on pushing for software patents, nowadays latching onto the inane and unwarranted media hype around Hey Hi (AI) — a hype wave that was co-opted by EPO management to grant unlawful patents



  8. The Central Staff Representatives (CSC) of the EPO Are Petitioning to End the Assault on EPO Staff

    The EPO, just one month after the staff went on strike, is about to receive a compelling petition to stop the assault on EPO staff



  9. InteLeaks – Part XXIV: Love for Microsoft, Not for Free Software or Whatever Replaces Microsoft

    Intel is basing its big decisions on buzzwords and firms that master buzzwords; it's sad that instead of listening to Intel's own (in-house) engineers it's relying on a bunch of clowns who push 'Clown Computing' and 'apps' and 'UX'...



  10. IRC Proceedings: Wednesday, January 20, 2021

    IRC logs for Wednesday, January 20, 2021



  11. Links 21/1/2021: Google Tightens the Screws on Chromium, VideoLAN VLC 3.0.12

    Links for the day



  12. IBM Panics and Resorts to 'Customer Retention' Tactics With Red Hat Enterprise Linux (RHEL)

    IBM 'frees' RHEL but with limitations that can restrict growth of small companies (or subject them to financial barriers, originally unforeseen)



  13. Recent Techrights Articles About President Joe Biden

    Instead of writing yet more stuff about the latest US president, let's look back at what we wrote in recent weeks/months



  14. Links 20/1/2021: LibreOffice 7.1 RC2 and the RHEL Contingency

    Links for the day



  15. InteLeaks – Part XXIII: Intel Paying for Bogus 'Research' 'Insights' Which Merely Seek to Justify Outsourcing to Microsoft and Imposing Microsoft's Proprietary Software on Free Software Developers

    Intel's preference for Microsoft monopoly (an imposed/top-down decision) was seemingly certified by so-called 'consultants' and 'analysts' from the outside rather than the inside, basically manufacturing a false perception of consent after managers had already made up their minds



  16. Suppressed Facts of the Free Software Movement and Its Community of Volunteers – Part V: How FSF Secrecy Ended Up Insulting People, Alienating Trans Developers

    Having just uploaded this introductory video, we delve into the backstory or the real reason the FSF sank into somewhat of a crisis with the trans community almost half a decade ago



  17. InteLeaks – Part XXII: Bubbles and Buzzwords, No Substance at Intel's Internet of Things (IoT) Group (IOTG)

    The video above is continuation of the previous part about a document full of superficial buzzwords (not technical jargon anywhere), in effect recommending to managers that they blindly follow trends and cargo cults (such as Clown Computing) and not what’s most suitable for technical excellence



  18. IRC Proceedings: Tuesday, January 19, 2021

    IRC logs for Tuesday, January 19, 2021



  19. Links 20/1/2021: WireGuard for pfSense and New US President

    Links for the day



  20. Links 19/1/2021: Krita 4.4.2 Released and JingOS Hype

    Links for the day



  21. Team UPC Keeps Pretending That UPCA Can Still be Resurrected (Even Without the UK, Which is Strictly a Requirement)

    The latest distortion of facts regarding the Unified Patent Court (UPC) Agreement (UPCA) as seen from the lens of people who seek to profit from such distortion



  22. 'Ethical Source' is Not Ethical and Not a Movement But a Misguided Self-Serving PR Stunt

    Something which is neither enforceable nor ethical is being promoted by profoundly unethical media in the pockets of large corporations



  23. InteLeaks – Part XXI: Intel Seeking Advice From a Bunch of Clowns (Harbor 'Research')

    A firm called Harbor 'Research' is making dubious recommendations to Intel; as shown in the above video, there's also an obsession with buzzwords (typically suggestive of a lack of technical grasp/understanding)



  24. IRC Proceedings: Monday, January 18, 2021

    IRC logs for Monday, January 18, 2021



  25. The US Election Was Not Rigged, But the Nomination Process Was (Undermined to Maintain Control by Oligarchy)

    Cheating/driving the left out of the Democratic Party seems like a longstanding tradition and we know who stands to gain from it; moreover, problems remain in the voting process because it's controlled by secret code of companies like Microsoft (in spite of the openwashing)



  26. InteLeaks – Part XX: Redacted (for Names Only) Release of Intel File About Developer eXperience (DX) Meddling in GNU/Linux

    Today (or tonight) we release the first 'phase' of InteLeaks in a sensibly redacted form; coming up next is a surprise from Team Microsoft



  27. Sites in Bed With the EPO and UPC 'Covering' the 'News' Without Mentioning Any of the Overt Abuses

    It is rather sad that blogs like IP Kat have turned into proponents of abusive EPO management and Team UPC increasingly resorts to lying using pseudonyms (to avert criticism and accountability); much of the rebuttal or response that’s hinged on reality/facts can only be found in comments, which are still subjected to a face-saving moderation process (conducted by Team UPC)



  28. Suppressed Facts of the Free Software Movement and Its Community of Volunteers – Part IV: Stories From the Depths of the Free Software Foundation (FSF)

    To reduce or alleviate suspicions and a potential of mistrust the FSF needs to become more transparent and liberate information (such as the real reason Bradley Kuhn left, as noted in the previous part)



  29. Links 18/1/2021: GNU Radio 3.9, Wikipedia at 20

    Links for the day



  30. InteLeaks – Part XIX: Intel's Web 'Experts' Seen as Microsoft Champions Dealing With the Platform Microsoft is Looking to Destroy

    Things aren't rosy at Intel because the hires aren't suitable for the job of documenting and/or presenting GNU/Linux-centric products (whose target audience is Free software developers)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts