*HUGE* Win XP SECURITY HOLE : uplddrvinfo.htm

[tuknuh]

In case people didn't find out about this security hole--may be the biggest in computer security history...

DELETE or rename this file:

C:\WINDOWS\PCHEALTH\HELPCTR\System\DFS\
uplddrvinfo.htm


SP1 fixes this... but for those who haven't applied it.... delete this file or rename it now...

The security flaw is unbelievable because a simple link on a webpage can delete the contents of your entire hard drive....

This isn't a joke... It's been featured on TechTV Screen Savers... plus I've did the test myself....

It's f*cked up... i'm not going to show you how it's done, because it's so simple to do....

This only affects Windows XP machines... but it's obsurd how bad the security hole is....

peace out...

 

[Jager]

heh, I just posted that same thing in a different thread and I just watched that episode The ScreenSavers too.

 

[tuknuh]

yeah... wtf? isn't this sh*t f'd up?!

The best part is, they claimed that Microsoft knew about this for 6 MONTHS!!!

But since deleting/ranaming that file would screw up of their 'support' features, they kept the security hole hush hush until now?

I may have misheard that, but if they did know about it, and the fix was so simple, that would be completely f*cked up if they didn't post a fix for it earlier...

that's embarassing for Microsoft no matter how you look at it...

just makes MS look even worse then it already does... and proves all of its critics right....... tisk tisk... MS b*llsh*t...

 

[tuknuh]

That's a silly scam, dudes...
the real bugs are HERE

I don't understand... how's that a scam?

I tested the security hole on one of our machines (which we were getting ready to slipstream)...

it *is* for real.. the contents (except for hidden files) are all deleted within a folder if you click on a link.... no matter if you close the window that pops up or not... i.e. there's no confirmation, since it happens instantly when you click the modified link.....

 

[Jager]

tuknuh,

just give him the link so he can test it out

 

[tuknuh]

I would post a link if i wanted my ass kicked off the forum... but seriously... techtv dedicated an entire 1/2 hour to this expoit, and mentioned how their producers didn't want them to show the fix due to MS legal actions (since MS wants you to dl the sp1).....
Nevertheless... most people with WindowsXP have the default setups... so the security hole is, in the least sense, bad...

 

[tuknuh]

plus the techtv screen savers hosts stated that many people with "questionable" windows XP keys, can't use SP1 and should do the above fix... Plus they mentioned how the SP1 is huge, and most people with regular modem connection wouldn't be able to dl as easily as with those with a high speed connection...

So all in all... how would one consider this a MS "scam" when all the instruction on the fix is against MS protocol...?

Bottom line... it's not a scam... it's for real... delete the file... it's real simple... be happy....

peace out...

 

[tuknuh]

I just came back from drinking with a newly divorced friend... and I love you pokopiko...

 

[Laz]

I just came back from drinking with a newly divorced friend... and I love you pokopiko...

LMAO

Ah, the power of alcohol.

J/K poko.

I'm hacked off with all this XP cr@p, it just ain't worth the trouble right now IMO. I went back to Win2K on the weekend and that's where I'm staying for now.

 

[Strahlen]

Laz -->I'm hacked off with all this XP cr@p, it just ain't worth the trouble right now IMO. I went back to Win2K on the weekend and that's where I'm staying for now.

I agree totally, I have gone ' backwards ' from a legit install of XP Home to Win2k and I'm happy to stay like this for a while too..

I miss Quake 3 (the framerates with a Radeon are dodgy and affect gameplay..), but that's about it..

How long before people say, ' ..Enough is enough. ', it will be interesting to see how the next 3 or 4 years play out.. Keep those old motherboards and CPU's!

>>X<<

 

[tuknuh]

ahhh what a nice hangover i got...

yeah... MS is so full of it...... they feed the public media hype about how 'great' all their products are.... and how postive they are about all the "unmatched" features... and as usual someone finds a way to exploit each and every one.....

and it looks like the security of the next windows version is going to be even worse... just so MS can 'track' you some more...


btw has anyone seen the review on TechTV on the new MS keyboard? what a piece of "AOL" looking crap... one of the useless features it has is a "calender" key... plus all the F1-F12 keys have their own MS OS labels of their attributed functions....

"Oh neat, Wilbert! the F5 key now say's "Refresh", so we won't forget what it does.... and look at this cute "calender" button, now we won't ever miss our favorite show Dawson Creek"

 

[newby]

So it may be such a problem, but the URL that you're called to delete is used just as a medium to a SCRIPT which you must d/l and execute. The REAL problem with the active components will stay, and may be exploited via other ways! (this one deleted is not the only active setup page, and besides that even a downloaded page can cause such a problem.
Yup, I'd like to see the link... anyway my online updates are disabled...

hcp://system/DFS/uplddrvinfo.htm?file://c:WinNT//temp*

This link supposely erases ALL contents from c:/WinNT/temp.