• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

MP3 bug in Windows XP desktop affects security - critically

Great, so much for not being able to get a virus/etc from non-executible files. Thank you MS!


An attacker could seek to exploit this vulnerability by creating an .MP3 or .WMA file that contained a corrupt custom attribute and then host it on a website, on a network share, or send it via an HTML email. If a user were to hover his or her mouse pointer over the icon for the file (either on a web page or on the local disk), or open the shared folder where the file was stored, the vulnerable code would be invoked. An HTML email could cause the vulnerable code to be invoked when a user opened or previewed the email. A successful attack could have the effect of either causing the Windows Shell to fail, or causing an attacker?s code to run on the user?s computer in the security context of the user.
Click to expand...

ARGH! Anyone know the link to the page where I can download the file directly, I have more than one machine to update, am on dialup, and don't feel like dl'ing it twice. Thanks.
 
How come every single flaw in Windows is littered everyone on the internet, yet Linux flaws are all hidden? It's just stupid MS haters at it again. They make you think that if you use Windows and you don't get all the patches immediately, you will be hacked and your computer will be trashed.
rolleye.gif
If you just be responsible and not open all those emails, and pay attention to what you download, this wouldn't be a problem. I have never been hacked or gotten a virus and my computer is on and connected to the internet 24/7 (No firewall, but I use an Anti-Virus, which has never found a virus). Why would joe schmo and his mother care about being hacked? Do they think some hacker wants to know their secret family recipie for chocolate chip cookies? If they open an email from someone they don't know, download the attachment and attempt to run it, they deserve whatever they get.
 
Originally posted by: XZeroII
How come every single flaw in Windows is littered everyone on the internet, yet Linux flaws are all hidden? It's just stupid MS haters at it again. They make you think that if you use Windows and you don't get all the patches immediately, you will be hacked and your computer will be trashed.
rolleye.gif
If you just be responsible and not open all those emails, and pay attention to what you download, this wouldn't be a problem. I have never been hacked or gotten a virus and my computer is on and connected to the internet 24/7 (No firewall, but I use an Anti-Virus, which has never found a virus). Why would joe schmo and his mother care about being hacked? Do they think some hacker wants to know their secret family recipie for chocolate chip cookies? If they open an email from someone they don't know, download the attachment and attempt to run it, they deserve whatever they get.
Click to expand...

try thinking about it.. all these virii/trojans aren't aimed at individuals. when they're spread, they're usually spread massively and without discrimination.
 
Originally posted by: XZeroII
How come every single flaw in Windows is littered everyone on the internet, yet Linux flaws are all hidden? It's just stupid MS haters at it again. They make you think that if you use Windows and you don't get all the patches immediately, you will be hacked and your computer will be trashed.
rolleye.gif
Click to expand...
Don't download the patch then. I don't care. If it bothers you to read about them, then skip the thread. This has nothing to do with being pro/anti microsoft. It's a bug, and it's a serious one that will potentially impact many folks here. If you use XP and search for MP3's or WMA's from anywhere, it's just a matter of time before this one gets you. Unless you get this patch. OK, so maybe folks shouldn't search for MP3's or WMA's, but, they do. Some MP3's are actually legal. And previously it was a harmless activity (at least to yourself). Now (or soon from now) you can run into problems.

If you just be responsible and not open all those emails, and pay attention to what you download, this wouldn't be a problem.
Click to expand...
Read the bulletin, you don't need to get it via email. Or download the file to your pc.

I have never been hacked or gotten a virus and my computer is on and connected to the internet 24/7 (No firewall, but I use an Anti-Virus, which has never found a virus).
Click to expand...
Good for you. Hopefully you never do. But, if you think you can ignore these warnings forever, well, good luck.

 
There are bugs in every OS ever made. No OS has ever been proven to have significantly less bugs than any of the rest. The fact is that Windows is the most used, and thus the most likely to be exploited, and thus get the most publicity. Microsoft does their job, and gives you patches to fix the bugs. Download them if you need to, or ingnore them if you don't (I have quite a few computers which I've never updated since they don't have internet access, and thus are not vulnerable to things like this).
 
I was reading about this and it says something about a flaw in Winamp as well.
I don't run XP (2000) and I still run version 2.X for Winamp (3 blows chunks)...

Why is it that as software "progresses" in many cases... it gets worse as it becomes more consumer oriented?? 😉
 
Originally posted by: KokomoGST
I was reading about this and it says something about a flaw in Winamp as well.
I don't run XP (2000) and I still run version 2.X for Winamp (3 blows chunks)...

Why is it that as software "progresses" in many cases... it gets worse as it becomes more consumer oriented?? 😉
Click to expand...

To give you a technical reason behind it: failed regression tests, lack of daily builds, lack of lucid unit tests, poor functional testers, law of leaky abstractions, ad nauseum...

 
Originally posted by: KokomoGST
I was reading about this and it says something about a flaw in Winamp as well.
I don't run XP (2000) and I still run version 2.X for Winamp (3 blows chunks)...

Why is it that as software "progresses" in many cases... it gets worse as it becomes more consumer oriented?? 😉
Click to expand...

I am using Win2K and Winamp 2.xx as well.. WinXP and Winamp 3.xx suck alot. 🙂
 
Originally posted by: pulse8
Has anyone's computer ever been compromised by one of these security flaws?
Click to expand...
This particular one? Probably not. But nimbda took out thousands of servers and klez worm emails have infected many millions of desktop PCs, many of which are still infected and still spreding the worm.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top