What About Windows 98
? Theres an interesting sidebar to this problem: Microsofts advisory mentions only Windows NT and descendent products, not Win9x. But others have shown that vulnerable ASN.1 code is present on Windows 9x systems.Microsoft confirmed this claim. According to Matt Pilla, senior product manager in the Windows Client group, the "patch for the ASN.1 vulnerability is available through Microsoft Product Support Services for Windows 98 customers. We continuously evaluate our product update distribution policies in order to best meet the needs of our customers." Now, this approach to the ASN.1 problem is troublesome. Now, I understand that Microsoft doesnt want people to be using Window 98and from a security standpoint, neither do Iand the company doesnt want to encourage these customers with the hint of support. Yet if Microsoft wants to prevent exploits of this particular vulnerability from gaining any traction in the world and stop ASN.1 from becoming a continuous problemlike too many others before itthen the company needs to get patches out quickly to as many vulnerable systems as possible. There are still a lot of Windows 98 systems in operation. As evidence, some 24 percent of the systems used to access Google in January were from Windows 98 machines. No doubt, a very large number of them are vulnerable to a ASN.1 attack. Check out eWEEK.coms Windows Center at http:windows.eweek.com for Microsoft and Windows news, views and analysis. When I first heard of the ASN.1 vulnerability, I worried we would relive Blaster all over again. But now, even with the Windows 98 problems, Im less pessimistic. As Dunham said, corporate administrators know by now that prompt patching, at least at the perimeter of the network, is an urgent matter at times like this. In addition, its likely that there are few unpatched corporate networks to attack. Then again, there will still be many unpatched machines in consumer hands, and an attack will spread there. Still, as each day goes by, the likelihood that ASN.1 will be a serious threat goes down. Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. Be sure to check out eWEEK.coms Security Center at http://security.eweek.com for the latest security news, views and analysis.
More from Larry Seltzer
Reports to the Bugtraq mailing list have indicated that Microsoft has a fix for Windows 98 (and, presumably, for Windows ME, although I havent seen it mentioned). However, its only available if you have a current support contract for Windows 98 and request the patch from Microsoft through official channels.