>dtl commented on 9 March 2005:
>
> * " Many vulnerabilities for Linux systems are fixed >the same day that they are disclosed."
>
> I'm sure that patch was thoroughly tested, it >compiled, ship it, yehaaa let em buck...

Heh. As opposed to Microsoft's stance: "I'm sure our software isn't vulnerable, and anyway we have to test, test, and re-test and even then the patch will have unintended consequences, better wait to release it, yehaaa let those customers get their systems hacked..."

" Many vulnerabilities for Linux systems are fixed the same day that they are disclosed."

I'm sure that patch was thoroughly tested, it compiled, ship it, yehaaa let em buck...

You can quickly disable the firewall from command via a netsh command.
Disable:
netsh firewall set opmode disable

Enable:
netsh firewall set opmode enable

Didn't SP2 make it impossible in Windows for an application to fill in an invalid source IP address? If this is the case, I wonder if this problem cropped up because Microsoft cannot generate the LAND attack with an up to date version of their OS.

Also, I wonder what sort of vulnerabilities exist in Windows for IPv6?

-Aaron

Even Garner analyst Neil MacDonald has finally realized: "Microsoft's
overriding goal should be to eliminate the need for (antivirus) and
(anti-spyware) products, not simply to enter the market with look-alike products
at lower prices,..."http://news.com.com/Gartner+takes+Microsoft+to+task/2100-7355_3-5582742.html
Microsoft's desktop security issues stem from its continued reliance on the
Antivirus industries "Infect-Scan-Remove" approach. In comparison, right from
the outset, open source desktop platforms and applications have relied almost
wholly on closing the infectable vectors, the exploited vulnerabilities used by
malware, as quickly as possible.
The result is that both the KDE and GNOME desktop environments are a lot more
secure and even more secureABLE.http://slashdot.org/comments.pl?sid=137937&cid=11539203
Follow this Usenet thread from September 2000http://www.google.com/groups?threadm=slrn8sj1ac.6m4.heretic@heretic.ihug.co.nz
The thread covers the argument over securing applications Vs scan and repair
in detail. David Harley and Robert Moir are two Anitvirus industry leaders. It
also includes the prediction that Microsoft would eventually get into the
antivirus/antimalware industry. With XP SP2, Microsoft have only just begun to
adopt some of the "new" defence strategies outlined by myself in the above
thread. However, in my opinion, Microsoft still has yet to secure the actual
applications exploited, and five years after the release of Windows 2000, has
yet to provide a safe desktop environment for business.
To quote Dr. Blaine Burnham, the former director of the Georgia Tech
Information Security Center (GTISC) and previously with the National Security
Agency (NSA), "Security is a system wide property". That requires applications,
middleware, libraries and the operating system itself to be secured before the
whole system can be declared secure.( If you have a spare hour, listen to Dr.
Blaine's USENIX 2000 keynotehttp://technetcast.ddj.com/tnc_play_stream.html?stream_id=411)
The Linux, Mozilla, KDE and GNOME based projects provide a more secure
desktop environment because the developers and distributions secure the
applications themselves where the application's vulnerabilities can be
exploited. In most cases an updated package is available within days of the
discovery. After years of double digit vulnerabilities discovered in Microsoft's
Internet Explorer, Microsoft has reluctantly changed its mind again and offered
yet another upgrade to IE7, but only for users of XP and the mythical Longhorn.
Meanwhile 21 out of 87 Secunia advisories are marked as "Unpatched" in XP
professional.http://secunia.com/product/22/For
a company with the financial resources of Microsoft, that is not even close to
being a good enough passing grade. It the result of longterm neglect of the
securty issues and the result will not be secured by any magic bullet based scan
or behavour constraint system.http://woct-blog.blogspot.com/2005/01/smoke-and-mirrors-awareness-day.html
Shop around and compare other vendors current ( number of serous issues
unpatched ) security status.http://secunia.com/product/
In late 1998 a number of securty experts wrote to  Microsoft in an open
letter; a number of anti-virus companies signed it saying "hey, here at the
things you can actually do to Microsoft Word to dramatically reduce the chances
of virus infection" http://news.bbc.co.uk/hi/english/static/audio_video/programmes/panorama/transcripts/transcript_03_07_00.txt
It took over four years of the worst publicity and intense pressure from the
security community before Microsoft finally began to react. http://www.theregister.co.uk/2002/01/17/ms_highest_priority_must/
Its time to raise the level of expected security in application and desktop
design.http://groups.google.com/groups?selm=slrnaghlie.1h4.heretic@heretic.ihug.co.nz
http://groups

and in other news...Microsoft's Security Response Center has given advance notice to customers not to expect any security patches for this month!!

Every company that does computer work has to be a security company now. Many companies are completely dependent on computers and most of their crown jewels are stored on them. Many home users have sensitive banking information stored on their computers. Building broken software that allows system disruption or data to be stolen will loose customers. Part of my job is to migrate systems from Windows to Linux, specifically because of security and stability issues.

There is NO legitimate reason whatsoever for a modern, patched operating system to be vulnerable to a simple, 8-year-old DOS attack. What's next, reintroduction of the Ping Of Death vulnerability? This is sloppy quality control, pure and simple.
This incident is just another example which demonstrates the importance (or more accurately, the lack thereof) that Microsoft's corporate culture places on security. Hasn't anyone at Microsoft ever heard about regression testing?

Microsoft has consistantly demonstrated that, regardless of what their press releases say, security is NOT one of their priorities. People need to start waking up and realizing this before they entrust their critical infrastructure to Microsoft products.