Vista

Buffer underflow in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary code via a Server Message Block (SMB) request that contains a filename with a crafted length, aka "SMB Buffer Underflow Vulnerability."

It is unusual to see the amount of attention given to this update and the speed at which it was released, especially out-of-band.

Thankfully for Server 2008 and Vista, the attacker has to be an authenticated user, but Server 2003 and XP users are not so lucky.

Most firewalls already block RPC traffic from external sources, so that attack vector is somewhat mitigated, but what I am worried about is the possibility of a 0-day worm getting inside an organization and worming around the entire network due to internal/client firewall rules.

It is particularly interesting that they released an update for Windows 7 pre-beta, build 6801, which I believe is going to be the build version given out at the PDC.

If you are running the beta builds of the Forefront Stirling TMG that have the GAPA protection enabled, you are already protected at the firewall level from the exploit due to the updated definitions already released by Microsoft. You can sort of think of it like Snort signatures.

I haven't seen Active-eXploits out in the wild yet, but it is only a matter of time.

You can read the Homeland Security National Vulnerability Database report on it here.

You can read a more in-depth report from the Microsoft Security Vulnerability Research and Defense team on the update here.

Direct download links to the patch, per OS:
Win 2K SP4
Win XP x86 SP2/SP3 / x64 RTM/SP2
Win 2003 x86 SP1/SP2 / x64 RTM/SP2
Win Vista RTM/SP1 x86/x64
Win Server 2008 x86/x64

Other sites with additional information on the exploit:
SecurityFocus
FRSIRT
SecurityTracker
Secunia
XForce (1 of 2)
XForce (2 of 2)

Kicking and screaming (not really), I've been adding Media Center-esque devices to our household over time - mostly from Woot auctions because I don't want to put a lot of money into stuff like this, for now. I can say though, is that I'm very impressed with how the newer firmware on the Hava interfaces with Windows Media Center and how the well the Pinnacle PCTV 800e works, on a Thinkpad T60.

When I'm at home, I "drive it like I stole it" on my Dell 2707WFP monitor, and the ATI X1400 really shouldn't be able to keep up with the amount of HD scaling it has to do, but it does it surprisingly well. I'm curious to see how well it will behave on the newer models like the Thinkpad T500.

Long story short, there is a new cumulative update for Media Center that came out in October 2008:

Fixes an issue in which you cannot seek through recorded TV shows on Windows Media Center systems that have digital cable tuners. Additionally, the recorded TV shows display the incorrect length.

Fixes an issue in which Windows Media Center Extenders cannot reconnect to a host computer after the host computer resumes from the suspend mode or the sleep mode.

Fixes an issue which is introduced by in Microsoft Knowledge Base article 950126. In this issue, a video that is paused may resume if you minimize or maximize the Windows Media Center window or if a screen saver starts.

Implements support for Digital Rights Management (DRM)-free copy for digital cable tuners that have the latest digital cable tuner BIOS versions that support DRM-free copy.

Expands the solution that was introduced in Microsoft Knowledge Base article 950126 to improve the experience of recording analog TV broadcasts to include set-top box scenarios. Previously, some analog TV broadcasts were blocked with the "protected content" message.

Note: This solution does not apply to configurations that use analog TV over digital cable tuners because the BIOS of the digital cable tuners provide content protection.

KB 955519 - you can read about it here and download the binaries here (x86/x64).

This might improve behavior of the Cisco VPN client under Vista/Server 2008. It is too bad they are not providing a 64-bit client for their IPSec VPN.

SYMPTOMS
You use a Windows Vista-based or Windows Server 2008-based computer that is behind a Network Address Translation (NAT) device. When you use this computer to try to communicate with another computer through an Internet Protocol security (IPsec) tunnel-mode connection, the connection fails.

CAUSE
This issue may occur if more than one computer shares the same source port. Windows Vista and Windows Server 2008 do not support tunnel-mode connections when the computer is behind an NAT device. Therefore, a conflict may occur.

RESOLUTION
A hotfix is available to resolve this issue. This hotfix adds the support for IPsec when the computer is behind a NAT device.

You can read more about it here and request the binaries here.

As mentioned here, they are not trying to come up with a clever name for the version after Vista. Some people are complaining already about naming an OS around a version number but... OS X? Hello? OS 10.

I've also seen complaints that the kernel is reporting 6.1. This is by design, and it is due to the amount of programs that will downright break if a major version number incremented.

I'm glad they are moving away from year based names, too.

Transcript from the 9/24/2008 Springboard Series Virtual Roundtable, "Under the Hood: Windows Vista Performance...Need Answers?" hosted by Mark Russinovich. From boot times and applets to common "misconfigurations" and how to fix them. Mark and a panel of customer IT pros and subject matter experts discuss how to optimize Windows Vista and what IT pros can do to improve overall system performance.

I helped out on this webcast in Redmond and answered many questions behind the scenes during the actual event. Transcripts are now available for download of the RoundTable.

If you want to see a replay of the video/event, go to this Technet page here, or enter this address into your Windows Media Player or any other player than can handle mms:// links with streaming .WMV content.

Your one stop for MMC 3.0 updates can be found in KB 940848. It is especially important for SCCM deployments because earlier versions had a knack for crashing your console without warning.

It is available for XP, Server 2003 and Vista.

You can download the update here.

There is nothing noteworthy in the KB article just yet, but keep it bookmarked to stay informed on the upcoming releases. Because Server 2008 and Vista SP1 are "built from the same tree" (for the most part), it makes sense that they will have a combined release.

Check out the article here.

I bumped into this by accident while reading up on the upcoming Paint 3.5 release, which will have .NET 3.5 SP1 support and a bunch of performance optimizations for low end machines.

Unfortunately, my main desktop machine at home, which now performs a dual role as an Active Directory domain controller for the house, is what is now considered low end for newer applications. I plan on fixing that problem later this year or early next year. My single core Prescott P4 has served me well for many years, but I keep holding out for Nehalem, and other bills paid off first. Of course, my heating bills will probably go up in cost, unrelated to oil prices, because the Prescott is notorious for producing more heat than speed.

Back to my original reason for this post though - why on Earth would someone recommend disabling the Windows Installer service as a performance tweak? I could potentially understand if they never plan on installing any additional programs or updates and really need the couple MBs of RAM and context switches from the process for a starved machine, but it just causes more harm than good. It also has caused the Paint.NET developer grief and bug reports due to strange application errors.

The Windows Installer process only runs when it needs to - any other time, it shuts down gracefully.

Unrelated tangent about my Prescott P4: I have an oddball Prescott - a 3.2Ghz that can be switched in the ASUS P4C800-E BIOS between a 14X and 16X multiplier due to a "bug" in the core - Stepping 3, Revision C0. This means you can crank the CPU up to 3.6Ghz without much trouble, but 99.9% of the time, I run the system at stock speed. At 14X, it will boot up at 2.8Ghz, but you can then send the front side bus sky high, assuming your RAM and Northbridge can keep up. I used to slap together a lot of systems in the past and old habits die hard it seems.