Microsoft Can't Patch Flaw in Windows 98, ME. Last Patch Tuesday dead ahead.

Microsoft Can't Patch Flaw in Windows 98, ME

Robert McMillan, IDG News Service
2 hours, 47 minutes ago

With support for its Windows 98 and Windows Millennium Edition operating
systems about to expire, Microsoft has given up on the idea of patching a
critical security vulnerability in the products, the company announced this
week.

The flaw has to do with the way Windows Explorer handles the Component Object
Model objects used by Windows programs. Attackers could take over a system by
tricking users into visiting a Web site that would then connect them to a remote
file server.

"This remote file server could then cause Windows Explorer to fail in a way that
could allow code execution," Microsoft said.

Microsoft had fixed the problem in the majority of its Windows products on April
11. At the time, it had promised to deliver a patch for Windows 98 and ME "as
soon as possible."


Change of Plans

However, the company this week updated its bulletin on the issue, saying that
this fix would require a lot of work and would possibly break applications being
used on these platforms.

"After extensive investigation, Microsoft has found that it is not feasible to
make the extensive changes necessary...to eliminate the vulnerability,"
Microsoft's bulletin states. "We have found that these architectures will not
support a fix for this issue now or in the future."

Microsoft is about to stop providing security fixes for Windows 98 and ME
altogether. The company's next monthly patch release next Tuesday is the last
scheduled security fix for the two operating systems.

Microsoft executives could not be reached to comment for this story.

Oh no! I'm shakin in my boots! What will we ever do now? :-)

Cymbal Man Freq. wrote:
Microsoft Can't Patch Flaw in Windows 98, ME

Robert McMillan, IDG News Service
2 hours, 47 minutes ago

With support for its Windows 98 and Windows Millennium Edition operating
systems about to expire, Microsoft has given up on the idea of patching a
critical security vulnerability in the products, the company announced
this
week.

The flaw has to do with the way Windows Explorer handles the Component
Object
Model objects used by Windows programs. Attackers could take over a system
by tricking users into visiting a Web site that would then connect them to
a
remote file server.

"This remote file server could then cause Windows Explorer to fail in a
way
that could allow code execution," Microsoft said.

Microsoft had fixed the problem in the majority of its Windows products on
April
11. At the time, it had promised to deliver a patch for Windows 98 and ME
"as
soon as possible."


Change of Plans

However, the company this week updated its bulletin on the issue, saying
that
this fix would require a lot of work and would possibly break applications
being used on these platforms.

"After extensive investigation, Microsoft has found that it is not
feasible to
make the extensive changes necessary...to eliminate the vulnerability,"
Microsoft's bulletin states. "We have found that these architectures will
not
support a fix for this issue now or in the future."

Microsoft is about to stop providing security fixes for Windows 98 and ME
altogether. The company's next monthly patch release next Tuesday is the
last
scheduled security fix for the two operating systems.

Microsoft executives could not be reached to comment for this story.

"Cymbal Man Freq." wrote:

Microsoft Can't Patch Flaw in Windows 98, ME

As I said in another thread on this topic, this COMM-object thing does
not apply to Win-98, but it's funny (and predictable) the lengths that
Micro$haft and it's lackeys are going to foster FUD about Win-98.

Robert McMillan, IDG News Service

Robert McMillen is a Macro$loth lackey.

Microsoft had fixed the problem in the majority of its Windows
products on April 11.

Because it had to, because those versions of Windows were poorly
crafted and their vulnerability to this issue was real.

Microsoft is about to stop providing security fixes for
Windows 98 and ME altogether.

Actually, Milkro$oft stopped providing security fixes for Win-98
months (years?) ago - because it hasn't needed any.

The company's next monthly patch release next Tuesday is
the last scheduled security fix for the two operating
systems.

Yes - I can't wait for the next "genuine advantage" update for Win-98.

Microsoft executives could not be reached to comment for
this story.

It's not the Micro$lack executives you want to talk to. It's their
spin-masters.

"Bill in Co." wrote in message
...

Oh no! I'm shakin in my boots! What will we ever do now? :-)

Join the mass migration to OS X, once Busta, aka Vista,
falls flat on its keister.........

"98 Guy" wrote in message ...
he majority of its Windows
The company's next monthly patch release next Tuesday is
the last scheduled security fix for the two operating
systems.

Yes - I can't wait for the next "genuine advantage" update for Win-98.


Actually, my understanding is that the July 11th date is precisely to allow
the patching of machines on *that date* - so this part of the article
(assuming this is a direct quote) is total BS, and WU for 9x systems will
not disappear on the 11th, but is, I believe schedule to continue for some
time yet, although no new updates will be posted after that date.
The final Win9x updates are due down the line (assuming there are any) on
July 11th


--
Noel Paton (MS-MVP 2002-2006, Windows)

Nil Carborundum Illegitemi
http://www.crashfixpc.com/millsrpch.htm

http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"Noel Paton" wrote in message
...

"98 Guy" wrote in message ...
he majority of its Windows
The company's next monthly patch release next Tuesday is
the last scheduled security fix for the two operating
systems.

Yes - I can't wait for the next "genuine advantage" update for Win-98.


Actually, my understanding is that the July 11th date is precisely to
allow
the patching of machines on *that date* - so this part of the article
(assuming this is a direct quote) is total BS, and WU for 9x systems will
not disappear on the 11th, but is, I believe schedule to continue for some
time yet, although no new updates will be posted after that date.
The final Win9x updates are due down the line (assuming there are any) on
July 11th
--
Noel Paton (MS-MVP 2002-2006, Windows)

Nil Carborundum Illegitemi
http://www.crashfixpc.com/millsrpch.htm


Tick-tock_tick-tock, time to get that paper work ready...

Are you sure WU will continue to function for Win98 users (w/o new updates)? This is very important to me as I sometimes reinstall everything from scratch (CDs + WU). Does anyone have any idea how long WU will continue to function.

"Noel Paton" wrote in message ...

"98 Guy" wrote in message ...
he majority of its Windows
The company's next monthly patch release next Tuesday is
the last scheduled security fix for the two operating
systems.

Yes - I can't wait for the next "genuine advantage" update for Win-98.


Actually, my understanding is that the July 11th date is precisely to allow
the patching of machines on *that date* - so this part of the article
(assuming this is a direct quote) is total BS, and WU for 9x systems will
not disappear on the 11th, but is, I believe schedule to continue for some
time yet, although no new updates will be posted after that date.
The final Win9x updates are due down the line (assuming there are any) on
July 11th


--
Noel Paton (MS-MVP 2002-2006, Windows)

Nil Carborundum Illegitemi
http://www.crashfixpc.com/millsrpch.htm

http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

AFAIK, the idea is that WU for Win9x will be there for a year or more, but
I've seen nothing 'official' that gives dates.
Bearing in mind that patches are still available on the MS site for Win95
and even for Win3.1, then the patches themselves should be around for a
while yet, whatever the status of WU.
I would recommend that you download all the patches you use for a machine
build to CD and archive it properly - it's not as easy as WU to install
manually, but at least it's not subject to connections!

--
Noel Paton (MS-MVP 2002-2006, Windows)

Nil Carborundum Illegitemi
http://www.crashfixpc.com/millsrpch.htm

http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
"Ron C." wrote in message
...
Are you sure WU will continue to function for Win98 users (w/o new updates)?
This is very important to me as I sometimes reinstall everything from
scratch (CDs + WU). Does anyone have any idea how long WU will continue to
function.