Windows 2000 suffers millennium bug Malicious code execution possible thanks to flaw. Matthew Broersma, Techworld 22 April 2005 Microsoft has confirmed a security flaw in Windows 2000 that could allow attackers to execute malicious code via Windows Explorer and other programs. The flaw, involving a problem in the way the webvw.dll library validates document metadata, was disclosed earlier this week by security firm GreyMagic. The flaw could be exploited by distributing a malicious file which, when selected in Windows Explorer, could execute malicious script commands. More dangerously, an attacker could exploit the bug via a document on a remote SMB share, GreyMagic said. "Script commands that are injected in this manner will execute as soon as the malicious file is selected in Windows Explorer and will be executed in a trusted context, which means they will have the ability to perform any action the currently logged on user can perform," GreyMagic said in its advisory. "This includes reading, deleting and writing files, as well as executing arbitrary commands." Microsoft has confirmed that it is investigating the flaw, and as usual stated that it is not aware that any customers have been affected so far. The company has also criticised GreyMagic for posting proof-of-concept code along with its advisory. Stephen Toulouse of Microsoft's Security Response Center (MSRC), in a message posted on the Microsoft TechNet website, downplayed the danger posed by the flaw. "Significant user interaction would be required for an attacker to exploit this vulnerability," he wrote. Any attack would rely on Server Message Block (SMB) communication, which customers should block at the firewall level as a best practice, Toulouse said. No patch exists, but users can protect themselves by disabling the "Web view" option in Windows Explorer, Microsoft said. The company said it may patch the bug once its investigation is complete. The flaw affects Windows 2000 Professional, Server and Advanced Server versions, GreyMagic said. The affected library, webvw.dll, is used in displaying information in Windows Explorer's preview pane, which is enabled by default in Windows 2000 systems. An input-validation bug means an attacker could inject script commands into the "author" metadata field of a document, which could be executed when the metadata is processed by webvw.dll. Other applications using the library are also affected, GreyMagic said. "The malicious file does not need to be executed in order to activate the exploit, double-clicking is not required," the firm said in its advisory. "The exploitation takes place as soon as the file is selected." GreyMagic said it first notified Microsoft of the flaw on 18 January. (http://www.techworld.com/security/news/index.cfm?NewsID=3543)
No texto, downplayed significa

Justice Monitors New Microsoft Software
By Jonathan Krim Washington Post Staff Writer Tuesday, July 20, 2004
The Justice Department has begun looking closely at the next generation of Microsoft’s Windows operating system to ensure that it meets the terms of an antitrust settlement reached with the company more than two years ago.
Renata Hesse, the Justice Department lawyer in charge of monitoring Microsoft’s compliance with the agreement, told a federal judge yesterday that the government wants to look at the software, code-named Longhorn, early enough in its development so that it is not presented as a “fait accompli” that would be easy to change.
Microsoft, which has delayed Longhorn’s rollout, has not said when it will be released as the successor to Windows XP, the current version of the personal-computer operating system. Several industry analysts have predicted introduction of Longhorn in 2006 or possibly 2007, which is when the antitruste settlement is scheduled to expire.
The new operating system probably will showcase na aggressive push by Microsoft on several fronts, including technology for Internet searching, managing multiple homeentertainment devices, and virus scanning and other security measures. The company also has been expanding its efforts to become an industry standard-setter in ...... digital entertainment is protected from illegal copying.
Some of these moves will pit the company against competitors with similar products and will again shine a spotlight on Microsoft’s well-honed strategy of bundling more and more programs into its operating system.
It was the bundling strategy that led to Microsoft’s antitrust troubles. Bundling its Internet Explorer Web browser into Windows all but squashed competition from Netscape Communications Inc.’s Navigator browser, which was the Market leader but often had to be downloaded separately.
(http://www.washingtonpost.com/wpdyn/articles/A6285 2-2004jul19.html?referrer=email)
No texto, looking closely (1 o parágrafo, 1 a linha) significa