The company has activated its security response process to deal with the zero-day attacks has issued a pre-patch advisory with workarounds and a one-click “fix it” feature to enable the mitigations.

From the advisory:

Microsoft is aware of limited, active attacks that use this exploit code. While our investigation is ongoing, our investigation so far has shown that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are vulnerable; all versions of Windows Vista and Windows Server 2008 are not vulnerable.

An entry on the MSRC blog provides more details:

The vulnerability is in the QuickTime parser in Microsoft DirectShow. An attacker would try and exploit the vulnerability by crafting a specially formed video file and then posting it on a website or sending it as an attachment in e-mail. While this isn’t a browser vulnerability, because the vulnerability is in DirectShow, a browser-based vector is potentially accessible through any browser using media plug-ins that use DirectShow. Also, we’ve verified that it is possible to direct calls to DirectShow specifically, even if Apple’s QuickTime (which is not vulnerable) is installed.

Interestingly, the vulnerable component was removed from Windows Vista and later operating systems but is still available for use in the Microsoft Windows 2000, Windows XP, and Windows Server 2003 operating systems.

Vulnerable Windows users should immediately consider disabling QuickTime parsing to thwart attackers. This KB article provides fix-it button that automatically enables the workaround.

Windows Server 2003 felt like a refresh of Windows Server 2000. There were few radical changes, and most of the improvements were fairly under the surface. Windows Server 2008, on the other hand, is a full-size helping of “new and improved.” While the overall package is quite good, there are a few surprises, “gotchas,” and hidden delights you will want to know about before deciding if you will be moving to Windows Server 2008 any time soon.

#1: The 64-bit revolution is not complete

There have been 64-bit editions of Windows Server for years now, and Microsoft has made it quite clear that it wants all of its customers to move to 64-bit operating systems. That does not mean that you can throw away your 32-bit Windows Server 2008 CD, though! Over the last few months, I have been shocked on more than one occasion by the pieces of Microsoft software that not only do not have 64-bit versions, but will not run under a 64-bit OS at all. This list includes Team Foundation Server and ISA Server. If you are planning on moving to 64-bit Windows Server 2008, be prepared to have a 32-bit server or two around, whether it be on physical hardware or in a VM.

#2: Who moved my cheese?

While the UI changes in Windows Server 2008 are not nearly as sweeping as the Aero interface in Vista, it has undergone a dramatic rearrangement and renaming of the various applets around the system. In retrospect, the organization of these items is much more sensible, but that hardly matters when you have years of experience going to a particular area to find something, only to have it suddenly change. Expect to be a bit frustrated in the Control Panel until you get used to it.

#3: Windows Workstation 2008 might catch on

In an odd turn of events, Microsoft has provided the ability to bring the “Vista Desktop Experience” into Windows Server 2008. I doubt that many server administrators were asking for this, but the unusual result is that a number of people are modifying Windows Server 2008 to be as close to a desktop OS as possible. There have always been a few people who use the server edition of Windows as a desktop, but this makes it much easier and friendlier. These home-brewed efforts are generally called “Windows Workstation 2008,” in case you’re interested in trying it out on your own.

#4: Hyper-V is good, but…

Hyper-V was one of the most anticipated features of Windows Server 2008, and it’s surprisingly good, particularly for a version 1 release from Microsoft. It is stable, easy to install and configure, and does not seem to have any major problems. For those of us who have been beaten into the “wait until the third version” or “don’t install until SP1″ mentality, this is a refreshing surprise.

#5: …Hyper-V is limited

Hyper-V, while of high quality, is sorely lacking features. Considering that it was billed as a real alternative to VMWare and other existing solutions, it is a disappointment (to say the least) that it does not seem to include any utilities for importing VMs from products other than Virtual PC and Virtual Server. Even those imports are not workaround-free. Another real surprise here is the lack of a physical-to-virtual conversion utility. Hyper-V may be a good system, but make sure that you fully try it out before you commit to using it.

#6: NT 4 domain migration — it’s not happening

If you have been putting off the painful migration from your NT 4 domain until Windows Server 2008 was released, don’t keep waiting. The older version (3.0) Active Directory Migration Tool (ADMT) supports migrations from NT 4, but not to Windows Server 2008. The latest version (3.1) support migrations to Windows Server 2008, but not from NT 4. Either migrate from NT 4 before changing your domain to be a Windows 2008 domain or get your NT 4 domain upgraded first.

#7: The ashtrays are now optional

In prior versions of Windows Server, a lot of applications came installed by default. No one ever uninstalled them because they did not cause any harm, even if you didn’t use them or installed an alternative. Now, even the “throwaway” applications, like Windows Backup, are not installed by default. After installation, you need to add “features” to get the full Windows Server suite of applications. This can be frustrating if you are in a hurry, but the reduced clutter and resource overhead are worth it.

#8: Licensing is bewildering

Continuing a hallowed Microsoft tradition, trying to understand the licensing terms of Windows Server 2008 feels like hammering nails with your forehead. So maybe this isn’t so much a surprise as a gotcha. The Standard Edition makes sense, but when you get into the issues around virtualization in Enterprise and Datacenter Editions, things can be a bit confusing. Depending upon your need for virtual machines and the number of physical CPUs (not CPU cores, thankfully) in your server, Enterprise Edition may be cheaper — or it may be more expensive than Datacenter Edition. One thing to keep in mind is that once you start using virtual machines, you start to like them a lot more that you thought you would. It’s easy to find yourself using a lot more of them than originally expected.

#9: There’s no bloat

Maybe it’s because Vista set expectations of pain, or because hardware has gotten so much cheaper, but Windows Server 2008 does not feel bloated or slow at all. Microsoft has done a pretty good job at minimizing the installed feature set to the bare minimum, and Server Core can take that even further. Depending upon your needs, it can be quite possible to upgrade even older equipment to Windows Server 2008 without needing to beef up the hardware.

#10: Quality beats expectations

Microsoft customers have developed low expectations of quality over the years, unfortunately, with good reason. While its track record for initial releases, in terms of security holes and bug counts, seems to be improving customers are still howling about Vista. As a result, it has come as a real surprise that the overall reaction to Windows Server 2008 has been muted, to say the least. The horror stories just are not flying around like they were with Vista. Maybe it’s the extra year they spent working on it, or different expectations of the people who work with servers, but Windows Server 2008 has had a pretty warm reception so far. And that speaks a lot to its quality. There is nothing particularly flashy or standout about it. But at the same time, it is a solid, high quality product. And that is exactly what system administrators need.

Calling the situation “untenable” and describing Windows as “collapsing,” a pair of Gartner analysts this week said Microsoft must make radical changes to the operating system or risk becoming a has-been.

In a presentation at a Gartner-sponsored conference in Las Vegas, analysts Michael Silver and Neil MacDonald said Microsoft has not responded to the market, is overburdened by nearly two decades of legacy code and decisions and faces serious competition on a whole host of fronts that will make Windows moot unless the Redmond, Washington developer acts.

“For Microsoft, its ecosystem and its customers, the situation is untenable,” said Silver and MacDonald in their prepared presentation, titled “Windows Is Collapsing: How What Comes Next Will Improve.”

Among Microsoft’s problems, the pair said, is Windows’ rapidly-expanding code base, which makes it virtually impossible to quickly craft a new version with meaningful changes. That was proved by Vista, they said, when Microsoft — frustrated by lack of progress during the five-year development effort on the new OS — hit the “reset” button and dropped back to the more stable code of Windows Server 2003 as the foundation of Vista.

“This is a large part of the reason [why] Windows Vista delivered primarily incremental improvements,” they said. In turn, that became one of the reasons why businesses pushed back Vista deployment plans. “Most users do not understand the benefits of Windows Vista or do not see Vista as being better enough than Windows XP to make incurring the cost and pain of migration worthwhile.”

Other analysts, including those at rival Forrester Research, have pointed out the slow move toward Vista. Last month, Forrester said that by the end of 2007 only 6.3 percent of the 50,000 enterprise computer users it surveyed were working with Vista. What gains Vista made during its first year, added Forrester, appeared to be at the expense of Windows 2000; Windows XP’s share hardly budged.

The monolithic nature of Windows — although Microsoft talks about Vista’s modularity, Silver and MacDonald said it doesn’t go nearly far enough — not only makes it tough to deliver a worthwhile upgrade, but threatens Microsoft in the mid- and long-term.

Users want a smaller Windows that can run on low-priced — and low-powered — hardware, and increasingly, users work with “OS-agnostic applications,” the two analysts said in their presentation. It takes too long for Microsoft to build the next version, the company’s being beaten by others in the innovation arena and in the future — perhaps as soon as the next three years — it’s going to have trouble competing with Web applications and small, specialized devices.

“Apple introduced its iPhone running OS X, but Microsoft requires a different product on handhelds because Windows Vista is too large, which makes application development, support and the user experience all more difficult,” said Silver and MacDonald.

“Windows as we know it must be replaced,” they said in their presentation.

Their advice to Microsoft took several forms, but one road they urged the software giant to take was virtualization. “We envision a very modular and virtualized world,” said the researchers, who spelled out a future where virtualization — specifically a hypervisor — is standard on client as well as server versions of Windows.

“An OS, in this case Windows, will ride atop the hypervisor, but it will be much thinner, smaller and modular than it is today. Even the Win32 API set should be a module that can be deployed to maintain support for traditional Windows applications on some devices, but other[s] may not have that module installed.”

Backward compatibility with older, so-called “legacy” applications, should also be supported via virtualization. “Backward compatibility is a losing proposition for Microsoft; while it keeps people locked into Windows, it also often keeps them from upgrading,” said the analysts. “[But] using built-in virtualization, compatibility modules could be layered atop Win32, or not, as needed.”

Silver and MacDonald also called on Microsoft to make it easier to move to newer versions of Windows, re-think how the company licenses Windows and come up with a truly modular operating system that can grow or shrink as needed.

Microsoft has taken some new steps with Windows, although they don’t necessarily match what the Gartner analysts recommended. For instance, the company recently granted Windows XP Home a reprieve from its June 30 OEM cut-off, saying it would let computer makers install the older, smaller operating system on ultra-cheap laptops through the middle of 2010.

It will also add a hypervisor to Windows — albeit the server version — in August, and there are signs that it will launch Windows 7, the follow-on to Vista, late next year rather than early 2010.

Original Article taken from ComputerWorld