Meltdown and Spectre Exploits

[VFN]

Are Vista machines going to receive a security update?

Thanks

 

[z3r010]

Nope, it's dead, you need to upgrade to a more modern OS.

 

[VFN]

Thanks

 

[Cave_Johnson]

well, it could be like what Microsoft did with Windows Xp during Wannacry, they gave it a security update since a lot of machines still ran it and some too this day still run XP just like vista users.

 

[johngalt]

This is not an exploit that will help create a lot of bots on the net to make one big botnet, nor will it allow ransomware onto your machine or anything like that.

This is a proof of concept that the way our modern processors work in conjunction with the way modern kernels interact with them, can be sabotaged to give up information that was previously considered secured because of the use of various technologies built into the processors.

Because of that, the major targets for this are not going ot be end users - yeah, malware devs will ahve to target hundreds of thousands of end users machines ot get lucky enough for a modest windfall, or they can target cloud-based and web-based server, where they can target hundreds of thousainds of users' info on a single server - and Vista is not a server class OS.

 

[wither 3]

I wonder what VFN had in mind when he asked about the updates. Something missing or a problem? I run Vista all day, everyday with Norton Security and haven't had any problems. I think Norton has stopped maybe 4 or 5 web attacks since last April.

 

[VFN]

I wonder what VFN had in mind when he asked about the updates.

I read Microsoft will be sending updates to protect against these exploits. Apparently, browsers are taking measures as well.

 

[Cave_Johnson]

Yeah, like i said they'll be doing this cause systems don't have time to upgrade to newer equipment and software. So microsoft will probably send an update to Xp (this doesn't seem likely ) but they might send an update for windows vista since its brother Windows Server 2008 is still being used and vista can install some of The Server 2008 updates so we might be able to download the Server update and install it on vista. But idk i'm just a new member.

 

[Jody Thornton]

Yeah, like i said they'll be doing this cause systems don't have time to upgrade to newer equipment and software. So microsoft will probably send an update to Xp (this doesn't seem likely ) but they might send an update for windows vista since its brother Windows Server 2008 is still being used and vista can install some of The Server 2008 updates so we might be able to download the Server update and install it on vista. But idk i'm just a new member.

There were originally no plans to release Spectre and Meltdown packages for Server 2008 (initial release) - however (read below) ......

 

[Jody Thornton]

MAJOR NEWS - there are new Spectre and Meltdown patches for March 2018 (for Server 2008). There ARE installable on to Vista. I have avoided installing them because I'm not sure that I want to endure the performance degradation that likely accompanies these updates. But they are available.

KB4090450 - Description of the security update for the speculative execution side-channel vulnerabilities in Windows Server 2008 (SPECTRE)
https://support.microsoft.com/en-us/help/4090450
http://catalog.update.microsoft.com/v7/site/search.aspx?q=4090450

KB4089229 - Description of the security update for the Windows Kernel vulnerabilities in Windows Server 2008 (MELTDOWN)
https://support.microsoft.com/en-us/help/4089229
http://catalog.update.microsoft.com/v7/site/search.aspx?q=4089229

 

[johngalt]

It would be interesting if you could make a full image of your Vista install and then perform some benchmarks to see if there is an actual determinable performance degradation.

I wish I still had an older machine lying around onto which I could install Vista (I suppose I could try in a VM, but I'd have to set up a comprehensive testing routine as well, including limiting any potential outside interference from the host machine running tasks in the background, so that would take a lot longer than it sounds. And I'd have to find a Vista install disc

 

[Vistaar]

...there are new Spectre and Meltdown patches for March 2018 (for Server 2008). There ARE installable on to Vista. I have avoided installing them because I'm not sure that I want to endure the performance degradation that likely accompanies these updates. But they are available...

Those patches may break Sandboxie (not that it officially supports Vista anymore: see Vista with latest Server 2008 updates break SB - Sandboxie Support), and who knows how many other old programs that can no longer be updated on Vista?

 

[erpster4]

MAJOR NEWS - there are new Spectre and Meltdown patches for March 2018 (for Server 2008). There ARE installable on to Vista. I have avoided installing them because I'm not sure that I want to endure the performance degradation that likely accompanies these updates. But they are available.

KB4090450 - Description of the security update for the speculative execution side-channel vulnerabilities in Windows Server 2008 (SPECTRE)
https://support.microsoft.com/en-us/help/4090450
http://catalog.update.microsoft.com/v7/site/search.aspx?q=4090450

KB4089229 - Description of the security update for the Windows Kernel vulnerabilities in Windows Server 2008 (MELTDOWN)
https://support.microsoft.com/en-us/help/4089229
http://catalog.update.microsoft.com/v7/site/search.aspx?q=4089229

URL links to KB4089229 are incorrect, Jody. they actually point to KB4034044 (fix your mistake and edit the links, man)
also KB4089229 lists a bunch of "known issues" (problems) in that article when installing that update.

And running GRC's InSpectre tool on Vista/Server 2008 with those updates installed will still think the OS is not Meltdown aware or protected.

 

[wither 3]

Just a comment but will probably stir things up a little-

The Meltdown and Spectre problems only occur for certain CPUs. Not sure anyone would be running Vista on such a system.

 

[Vistaar]

Ironically enough, this is definitely not the right forum to discuss installing security updates on a PC running Windows Vista.

The issue with Sandboxie that I mentioned in post #12 has since been resolved: Last versions of software for Windows Vista and Windows Server 2008.

 

[Jody Thornton]

URL links to KB4089229 are incorrect, Jody. they actually point to KB4034044 (fix your mistake and edit the links, man)

Calm yourself buddy - I posted this almost a year ago. Vista isn't even on my radar any more. Besides, Windows Update Catalog may have changed something too.

You can go to MSFN and view a thread on Server 2008 Updates on Vista. Go find it.

 

[erpster4]

well mister Jody Thornton it seems that Imacri wrote this in the Bleepingcomputer.com forum in early 2018:

Just an FYI that Microsoft updated their support article Protect your Windows Devices Against Spectre and Meltdown on 29-Jan-2018 and have confirmed that they are not planning to release a security patch for Windows XP3 or Vista SP2 for these vulnerabilities.

no guarantees as to those so-called meltdown/spectre patches for server 2008 released in spring 2018 actually work on Vista since Vista users should not be really concerned about those security vulnerabilities [like what are the odds of those security vulnerabilities actually occur on there, huh?]. plus the Spectre flaws require both windows os AND firmware/bios updates with updated cpu microcodes to fix.

fortunately for most old Intel CPUs, there's the Intel Microcode Bootloader tool that can load updated intel microcodes to patch the Spectre security flaw, regardless of OS used.

 

[johngalt]

Unless you have a CPU that was not patched. Like the Bloomfield series.

 

[Jody Thornton]

well mister Jody Thornton it seems that Imacri wrote this in the Bleepingcomputer.com forum in early 2018:



no guarantees as to those so-called meltdown/spectre patches for server 2008 released in spring 2018 actually work on Vista since Vista users should not be really concerned about those security vulnerabilities [like what are the odds of those security vulnerabilities actually occur on there, huh?]. plus the Spectre flaws require both windows os AND firmware/bios updates with updated cpu microcodes to fix.

fortunately for most old Intel CPUs, there's the Intel Microcode Bootloader tool that can load updated intel microcodes to patch the Spectre security flaw, regardless of OS used.

Again, Vista is not used by yours truly anymore. At the time I originally posted it, there seemed to be a possibility of extending Vista's usefulness, but I fear that time had passed. Anyway, I only ended up patching Vista up to March 2018 when I used it last. After that, I found incompatibilities arose.