NWA-PCUG Newsletter Article, November 2010
End of an era arrives for XP, Service Pack 2
By Bob de Violini, Member of the Channel Islands PCUG,
California August 2010 issue, The Outer Edge

Rjddev (at) gmail.com (click to email author)

The end of an era has come for Windows XP, Service Pack 2, and it bears noting. One survey found that over one-third of the PCs in the firms surveyed were running Windows XP SP2. I’m sure that quite a few of you reading this are also running XP SP2 as well, and this warning is for you. As of July 14, the day after Microsoft’s Patch Tuesday, there will be no more security updates offered to anyone running XP SP2. However Microsoft will still offer phone, chat and e-mail support for those running obsolete Service Packs, but for a fee of $49 for chat and e-mail or $59 for phone support. These fees are on a per incident basis, unless you’ve already purchased another type of support contract. The latest Service Pack can be downloaded from the following Microsoft site for free: http://tinyurl.com/4qvth5. I shortened the actual URL to save space. You will want a broadband connection, and a higher speed one at that. The file is the complete installation (over 300 Megs in size), and by Microsoft’s estimation it would still take nearly an hour to download on a 768k DSL connection. As an alternative, you can go to the Windows Update site, which will download a much smaller file initially. That file will then scan your system and download and install only the updates you actually need in order to bring your installation up to the full XP SP3. Support for XP SP3 will go until April 2014. As a reminder to those running Windows Vista, if you don’t have any Service Pack installed, your support ran out back on April 13 of this year, so you need to grab a copy of SP1 for Vista and install it. There are a few updates (2 or 3 depending on your individual situation) that you must install before you can successfully install SP1 on Vista. Send me an e-mail at the address at the top of this article for more info and a link to a page Microsoft has especially for those trying to get Vista SP1.

Lots of patches in June
Although I haven’t seen it labeled as such anywhere yet, June could be informally called “Patch Month,” with Microsoft releasing myriad patches (I counted 21 on each of my XP SP3 machines with MS Office 2003 on one and 2007 on the other, and a number well into the teens for my laptop, which has Vista SP2 and Office 2007) as well as Adobe and Mozilla releasing their own patches.

Adobe patched its Flash plug-in, bringing the version number up to, and Acrobat and Acrobat Reader versions 8 and 9, bringing them up to versions 8.2.3 and 9.3.3 respectively. The bugs in Flash, Acrobat and Acrobat Reader have been well publicized, so an update is in order. The update for Flash was released June 10, and the update for Acrobat and Acrobat Reader was released June 29. They are available here for Flash: http://get.adobe.com/flashplayer/; for those who can’t run version 10 of the Flash player, Adobe developed a patch for version 9, bringing it up to version, and it can be found here: http://www.adobe.com/go/kb406791. The update for Acrobat and Acrobat Reader can be found here: http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows.

The updates are available by scrolling down just below the “Full Download” listing to the appropriate area of the “Updates/Programs” listing. Once there, select the version from under its heading and click on the link. These patches for Flash, Adobe Acrobat and Acrobat Reader take the place of the normally scheduled July patches.

Mozilla finally released updates to versions 3.5 and 3.6 of Firefox, and it updated Thunderbird as well, but in early June as opposed to nearly the end of the month for Firefox. The latest Firefox versions are 3.5.11 and 3.6.8 and Thunderbird now sits at 3.1.1. However, Firefox went from 3.6.3 to 3.6.6 in a matter of four days, skipping version number 3.6.5 entirely. The thing that made folks most anticipate version 3.6.4 of Firefox is a new feature it has that allows a plug-in to crash but not take the browser down with it. This applies only to the Flash Player, QuickTime (from Apple) and Silverlight (from Microsoft) plug-ins for now, but it might involve others in future versions of the browser. Mozilla has no plans to incorporate this feature into the 3.5 series of Firefox, however. As for the security updates, they plugged a variety of holes found in late May and early June in the browser. One in particular involved its JavaScript engine in both versions 3.5 and 3.6. The only significant difference I could find between 3.6.4 and 3.6.6 of Firefox was a statement on the Release Notes page for Firefox 3.6.6 stating that 3.6.6 waits a longer period of time before ending a plug-in that has crashed. Firefox version 3.6.6 was released June 26, but at the end of July, Firefox was quickly updated twice in one week with the release of version 3.6.7 on July 20 and the release of version 3.6.8 on July 23. Version 3.6.7 was regularly scheduled and patched many privately reported bugs, but introduced another critical bug that garnered quite a bit of attention in the security community because the recent hackers’ convention during the last week of July. That bug was squashed in version 3.6.8, the current version.

On the Thunderbird side of things, the release at the beginning of June, 3.0.5, had some usability improvements and four security bug fixes in it. Some of those bug fixes were in versions 3.5.10, 3.6.3 and 3.6.4 of Firefox. Thunderbird version 3.1 is focused on new features and usability improvements. It has a new toolbar that lets you sort your messages by search terms, tags, message age, by whether or not it has an attachment, and more. It also boasts faster searching and better handling of passwords, as well as having many preconfigured settings for the most popular e-mail providers, making setup that much easier. The latest version, 3.1.1, fixed the same variety of vulnerabilities that were patched in versions 3.6.7 and 3.5.11 of Firefox.

Microsoft emergency patch On a final note, on Aug. 2, Microsoft was scheduled to release an out-of-band or emergency patch for a widely publicized vulnerability in the way Windows processes the little files that make up the shortcuts to programs and files that show up on your desktop and in the Start Menu in all versions of Windows currently in use, from Windows 2000 to Windows 7. A variety of attacks have already successfully been carried out, some aimed at computers that control industrial systems in the manufacturing sector.

Many infections have been against systems at small businesses and home users, simply carried out with the use of USB thumb drives left out in the open for folks to pick up and take home or back to their businesses. All that’s needed to get infected is to view the USB drive’s contents with Windows Explorer, the default for Windows. Microsoft developed a workaround, or temporary fix, but it left your desktop with a bunch of white spots where your icons were. Because of the number of folks affected by this bug, including high-profile clients, Microsoft decided to release this patch earlier than the regularly scheduled date for the month of August.

If you have Automatic Updating enabled for Windows, you should have gotten it shortly after 10 a.m. on Monday, Aug. 2.

However, this patch is not available to those running Windows 2000 nor to those running Windows XP Service Pack 2, both of which were retired from any and all support for security patches on July 14.

That’s all for this time. Until next time, Safe and Happy Computing to all!

Click here to return to top