From another group

On Wed, 11 Feb 2004 10:53:23 -0600, fairplay <fairplay@hiwaay.net>
wrote:

Microsoft warns of major Windows security flaws

WASHINGTON -- Microsoft warned customers on Tuesday about unusually
serious security problems with its Windows software that could let
hackers quietly break into their computers to steal files, delete data
or eavesdrop on sensitive information.


Microsoft, which learnt about the flaws more than six months ago from
researchers, said the only protective solution was to apply a repairing
patch it offered on its website. It assessed the threat to computer
users as 'critical', its highest rating.


Microsoft urged consumers to apply the repairing patch immediately if
they were using Windows NT, Windows 2000 or Windows XP versions of its
software, or its Windows NT Server, Server 2000 and Server 2003 software
commonly found in corporations.


A Microsoft security executive, Mr Stephen Toulouse, said the flawed
software was 'an extremely deep and pervasive technology in Windows',
and urged customers to apply the patch immediately.


Mr Marc Maiffret of eEye Digital Security, which discovered the new
Windows flaws, said they allowed hackers into Internet servers and
internal networks.


He said some computer systems that control critically important power
or water utilities were vulnerable.


Researchers at eEye discovered the problems last July and agreed to
keep quiet about them until Microsoft could fix them. Mr Maiffret
complained that the delay between eEye's discovery and Tuesday's public
disclosure by Microsoft was 'just totally unacceptable' because Windows
users were broadly vulnerable during the period.


Mr Toulouse said Microsoft took months because it wanted to ensure
that a single repairing patch solved any related problems.


Mr Maiffret and Microsoft said they were unaware anyone had yet
attacked Windows computers using the technique, although eEye had
successfully tested the method to break into its own computers.


The problems affected a technology in the newest versions of Windows
known as 'abstract syntax notation', a way to share data across
different computers. Some of Microsoft's built-in security features --
such as its Kerberos cryptography system -- rely on the flawed software.
-- AP