Live data from Hacker News

Microsoft fixes '19-year-old' bug with emergency patch

bbc.com

41–47 of 47 posts

Re: Microsoft fixes '19-year-old' bug with emergency patch

#41

Earlier quoted context omitted.

The pace of change in big orgs mean it takes 2-3 years to implement a change like xp->win 7. When you have 100k employees and regulatory hell and have outsourced every last bit of everything you are pretty fucked.

If you think that's bad, try the NHS in the UK. Its the largest organisation in the world with 1.4M employees (!). They've been rolling windows 7 out for 4 years. It'll be obsolete when they've finished.

Is there a better way?

Maybe they should standardise on a particular UI for specific applications - maybe with desktop icons in specific locations for launching those apps. Then they remove the OS from user view entirely - any OS or version of an OS that will present the particular applications with the required views would then be appropriate.

That way when determining if they can upgrade to Windows 10 they just need to ask "will our current apps run, with largely coterminous views and function? Can the OS login direct to our launch icon layout?".

Most users use applications rather than OS, especially in a work setting I'd warrant.

Re: Microsoft fixes '19-year-old' bug with emergency patch

#43
"Cutting to the chase, VBScript permits in-place resizing of arrays through the command “redim preserve.” This is where the vulnerability is.

redim preserve arrayname( newsizeinelements ) ... For VBScript, exploitation of this bug could have been avoided by invalidating the common “On Error Resume Next” VBScript code when the OleAut32 library returns with an error."

Always thought there was something shady about VB and redimming -- and On Error Resume Next. ;^) But that explains why it's as old as VB itself.

Re: Microsoft fixes '19-year-old' bug with emergency patch

#44
We upgraded to this, only to find it activates some new encryption modes (4 new GCM suites) that don't seem to function properly for us. Anyone else seen that issue?

(Technical details: If the client offer one of the suites, the server is accepting it in the ServerHello, but then RSTing the connection after the client sends their encrypted handshake, and the event log says "none of the cipher suites supported by the client application are supported by the server". Browser and curl don't use that suite, but Amazon ELB does.)

Re: Microsoft fixes '19-year-old' bug with emergency patch

#45

We upgraded to this, only to find it activates some new encryption modes (4 new GCM suites) that don't seem to function properly for us. Anyone else seen that issue? (Technical details: If the client offer one of the suites, the server is accepting it in the ServerHello, but then RSTing the connection after the client sends their encrypted handshake, and the event log says "none of the cipher suites supported by the…

Yes, all of our AWS EC2 Windows instances sitting behind an ELB with the latest AWS Security Protocols will not communicate with the ELB after this update.

I was able to fix this by reconfiguring the available cipher suites within IIS. Downloaded the IIS Crypto tool https://www.nartac.com/Products/IISCrypto/Default.aspx and applied their "Best Practices" which removed a bunch of insecure ciphers. After that the AWS ELB and IIS happily communicated.

Re: Microsoft fixes '19-year-old' bug with emergency patch

#46

We upgraded to this, only to find it activates some new encryption modes (4 new GCM suites) that don't seem to function properly for us. Anyone else seen that issue? (Technical details: If the client offer one of the suites, the server is accepting it in the ServerHello, but then RSTing the connection after the client sends their encrypted handshake, and the event log says "none of the cipher suites supported by the…

Yes, all of our AWS EC2 Windows instances sitting behind an ELB with the latest AWS Security Protocols will not communicate with the ELB after this update. I was able to fix this by reconfiguring the available cipher suites within IIS. Downloaded the IIS Crypto tool https://www.nartac.com/Products/IISCrypto/Default.aspx and applied their "Best Practices" which removed a bunch of insecure ciphers. After that the AWS E…

Thanks, nice to know there's not just something wrong with us! We made exactly the same fix with the same tool funnily enough.

Re: Microsoft fixes '19-year-old' bug with emergency patch

#47
post #8

> Specifically, it related to Microsoft Secure Channel, known as Schannel, Microsoft's software for implementing secure transfer of data. I'm confused... The article says this research relates to the SChannel vulnerability being patched this month and cites IBM Researchers[1] finding it, but the link to the blog post showing the work is towards OLE and not SChannel. Also, Microsoft has mentioned that they found[2] th…

The article was discussing two separate bugs. As it says "one of the other bugs ...."
Post reply on HN