[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
|
I think you will find, that the following will be at the core of the current day's problems, which of course will doubt be exacerbated by the fact that XP and 2000-Server and 2003 Server did not have patches issued for them, plus of course the previously mentioned all-but non-existent security practices. https://technet.microsoft.com/en-us/library/security/ms17-010.aspx?f=255&MSPPError=-2147217396 Overview of risk A vulnerability in Microsoft Server Message Block 1.0 (SMBv1) server. This service (SMB) is utilised to present shares, printers and more on a Microsoft Domain network. This vulnerability exposes core Active directory components to Remote Code Execution from unauthenticated attackers. They would be able to execute any code they wished to potentially gain access to the entire network. The patches Microsoft have provided should be tested installed as a matter of urgency. Specific Security reports of the Common Vulnerabilities and Exposures (CVEs) are below - Vulnerability title -ÂCVE number Windows SMB Remote Code Execution Vulnerability - CVE-2017-0143 Windows SMB Remote Code Execution Vulnerability - CVE-2017-0144 Windows SMB Remote Code Execution Vulnerability - CVE-2017-0145 Windows SMB Remote Code Execution Vulnerability - CVE-2017-0146 Windows SMB Remote Code Execution Vulnerability - CVE-2017-0148 The released patches target the SMBv1 service and the way it handles the particular requests that can be used to exploit it. On 12/05/17 18:57, Joseph Bennie wrote:
On 12 May 2017, at 18:49, daniel Phillips <danielphillips50@xxxxxxxxx> wrote: Forgive me for not knowing the current IT circumstances within government and the NHS. But wouldn't switching to an OSS alternative in fact save them millions and still be a little more secure then the systems they have in place at present? I have read other countries are leading the way and switching to OSS and standards. Do you think our government should have got on this band wagon a long time ago?no The $ cost per os licence is trivial compared with the over head of installs, patching and app compatibility. and thats why enterprises choose MS ... the release cycle is 5-10 years, which means the test and redow cycle is 5-10 years. With opens source is't 6-12 months. Can you imagine the cost of having to do full environment testing for custom apps every 6 months? ... I don't think the NHS even knows what continuous integration is. I'd put money on some critical apps are still COBOL. |
-- The Mailing List for the Devon & Cornwall LUG https://mailman.dclug.org.uk/listinfo/list FAQ: http://www.dcglug.org.uk/listfaq