Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003

[cf141q5325]

Its especially unfortunate since KB4474419, the sha2 update for Windows Seven, defacto disabled updates for quite a few people with dualboot or encrypted system partitions in mid March.

[gruez]

>encrypted system partitions

Does this include bitlocker? Or is this an issue with third party boot loaders so bitlocker is fine but truecrypt is not?

[cpach]

Disables updates? How?

[rincebrain]

Not even a wormable flaw could convince them to patch Vista, apparently (assuming it's not somehow magically invulnerable when the versions before and after it weren't).

[dfabulich]

"Users of Windows Vista can download the updates (Monthly Rollup or Security Online) of Windows Server 2008 from the Update Catalog and install them manually." https://borncity.com/win/2019/05/15/critical-update-for-wind...

But this is definitely confusing. MS explicitly offers patches for Win 7, Server 2008, Server 2003, and XP, but there's no "Vista" link visible.

https://portal.msrc.microsoft.com/en-US/security-guidance/ad... https://support.microsoft.com/en-us/help/4500705/customer-gu...

[chenzhekl]

Maybe the market share of Vista is so small, that Microsoft doesn't bother releasing a patch for it. There's no patch for Windows 8, either.

[will4274]

From netmarketshare.com:

- XP market share: 3.57%

- Vista market share: 0.23%

- Mac OS 10.10 market share: 0.51%

(10.10 went out of support the same year as Vista)

[NKCSS]

RDP is not on by default, so I don't see how that's a big deal.

[nkrisc]

How could he doxx you just by reading an article on his site?

[Nextgrid]

Care to elaborate?

[MagicPropmaker]

Wow! Good for Microsoft. You don’t see Apple releasing patches for 15+ year old operating systems.

[auiya]

Apple makes all their OS releases free to their users, so there's much lower numbers of 15+ year old Apple OS's existing in the wild to begin with. If you'd said you don't see Apple releasing patches for 15+ year old computers, I'd be more inclined to agree.

[justin66]

Neither did Microsoft, as far as I can tell:

https://portal.msrc.microsoft.com/en-US/security-guidance/ad...

[baroffoos]

I don't understand why they would do this. If I was a microsoft manager I would be glad something like this happened because it would force people off of old OSs without having the bad rep of doing it through nag popups.

Now everyone on XP will feel safe because its still getting updates.

[pjc50]

At this stage, anyone still using XP is doing so because they have no other choice: either it's intrinsically tied to low-end hardware, or to some piece of critical software, and it's too expensive or time-consuming to replace. Often this includes "embedded" PCs in scientific equipment and the like.

[m_mueller]

Microsofts rather friendly attitude to downwards compatibility & longterm support, is IMO one of their strongest competitive advantages for Windows and Office. Not following this philosophy for their mobile platforms has also lead to their downfall there.

[Carpetsmoker]

In the real world, there understaffed IT departments, insufficient budgets, time-consuming logistics, and complex systems which are not easily upgraded. Microsoft's options here are either "to hell with it, not my problem, just let the world burn" or taking responsibility and fixing problems which will affect people.

[jafingi]

Many institutions and hospitals still use XP. And they pay Microsoft a lot to support it.

[sagebird]

I would not be shocked if Windows XP had less vulnerabilities than Windows 10. Also, who cares? How would your behavior change if you learned one was more or less vulnerable than the other?