Microsoft releases "critical" patches for XPe devices

Microsoft has released its monthly batch of security updates for Windows XP Embedded (XPe). Announced on Microsoft's Windows Embedded Standard blog, and available now on its Mobile and Embedded Communications Extranet (ECE), the "November 2008 XP Embedded Security Updates" include two fixes for existing devices, both rated "critical."

As in other months, the "critical" fixes are said to repair vulnerabilities that could potentially allow an attacker to take complete control of a computer. Via remote code execution, an attacker could install programs, view, change, or delete data, and create new accounts with full user rights, according to Microsoft.

The first of the two patches is described, using Microsoft's online knowledge base numbering, as KB 938464, resolving "privately reported" vulnerabilities in the Windows GDI (graphics device interface). The vulnerability may have allowed remote code execution if a user viewed a maliciously crafted image file. But, by modifying GDIPLUS.DLL and other Windows files, the patch prevents this.

The second of the two patches is described as KB 956390, which updates the Internet Explorer web browser to repair "five privately reported vulnerabilities and one publicly disclosed vulnerability." Once again, without the fix, remote code execution might be possible, says Microsoft.

These patches might sound familiar to loyal readers, since they were already released as part of Microsoft's October 2008 XP Embedded Security Updates. The October version of the patches, however, merely entered them into XPe's component database, a part of the Target Designer toolkit that's accessed when new operating system images are being built. In contrast, the newly available November version provides the patches for XPe's Desktop QFE Installer (DQI). That apparently means the fixes can now be applied to existing XPe devices.

Further information

More information on the distinction between component database and DQI patches for XPe may be found on Microsoft's website, here. To obtain the November 2008 XP Embedded Security Updates from Microsoft's ECE, go here (prior registration required). (windowsfordevices.com/news)

Microsoft Xbox 360 Price Cut Up to 30 Percent

Microsoft, on Monday, announced the price cut Xbox 360 video games that are marketed in Japan by 30 percent to penetrate and compete digit sales company, Sony and Nintendo games.

Company software giant the United States will cut the price of Xbox 360 Arcade to be 19,800 yen, or about 182 U.S. dollars from the previous price of 27,800 yen. Beyond Nintendo Wii sold with the price of 25,000 yen, Microsoft officials said at the press conference.

Microsoft is frequently struggle to open the road to become the most attractive games in Japan, where after a long time the market was dominated by local production of Nintendo and Sony.

Currently, the Xbox 360 and Sony's PlayStation 3 is still below the rate of Nintendo Wii, which is still hard behavior in Japan and other countries. (AFP/OL-01)

Tags: Microsoft, Xbox 360, Sony PlayStation 3, Nitendo Wii

Microsoft warns of IE8 lock-in with XP SP3

Also notes other problems, including crashing Windows Live Mail
Microsoft Corp. yesterday warned users of Windows XP Service Pack 3 (SP3) that they won't be able to uninstall either the service pack or Internet Explorer 8 (IE8) under some circumstances.

The warning was reminiscent of one Microsoft made in May, when Windows XP SP3 had just been made available for downloading. At the time, the company told users they wouldn't be able to downgrade from IE7 to the older IE6 browser without uninstalling the service pack.

In a post to the IE blog today, Jane Maliouta, a Microsoft program manager, spelled out the newest situation, which affects users who downloaded and installed IE8 Beta 1 prior to updating Windows XP to SP3. If those users then upgrade IE8 to Beta 2, which Microsoft unveiled today, they will be stuck with both IE8 and Windows XP SP3.

A warning dialog will appear to alert users. "If you chose to continue, Windows XP SP3 and IE8 Beta 2 will become permanent," Maliouta said. "You will still be able to upgrade to later IE8 builds as they become available, but you won't be able to uninstall them."

She recommended that users instead first uninstall Windows XP SP3, then uninstall IE8 Beta 1; they should then reinstall XP SP3 and follow that by installing IE8 Beta 2.

It's unclear how many users the warning is aimed at. Although users running Windows XP and IE8 Beta 1 could manually download and install Service Pack 3 from Microsoft's site, the company set its Windows Update service so that it didn't offer SP3 to systems with IE8 Beta 1.

Windows XP users who do have the first beta already on their machines will be offered the update to Beta 2 via Windows Update if they have Automatic Updates enabled, Maliouta continued. "A prompt in your Windows task bar will alert you when IE8 Beta 2 is ready for installation," she said.

Windows Vista users, however, will not see IE8 Beta 2 in Windows Update because update apparently cannot sniff out instances of IE8 Beta 1 and uninstall them automatically. Instead, users must remove Beta 1 manually, said Maliouta.

Several additional updates are required before installing IE8 Beta 2 on Vista, including one that, if omitted, blocks its installation entirely. That fix, a revised version of a Vista Service Pack 1 (SP1) prerequisite that earlier this year sent machines into an endless series of reboots, is also necessary for IE8 Beta 2; users with SP1 will, of course, already have it in place, but those running pre-SP1 versions of Vista must still install it.

Microsoft also spelled out a long list of IE8 Beta 2 known issues and compatibility problems in release notes it posted on its support site Wednesday.

Ironically, of the nine applications called out as incompatible with the new IE8, the only two that will lock up and crash are Microsoft's.

Visual Studio .Net Version 7, said Microsoft, will crash on a PC that also contains IE8 Beta 2. "No workaround is currently available," Microsoft said in the release notes.

The other Microsoft incompatible application is Windows Live Mail, formerly called Windows Live Desktop, and the desktop mail client meant to replace Outlook Express and Windows Mail. "If you install Internet Explorer 8 Beta 2, Windows Live Mail will crash when you create or reply to an e-mail message," Microsoft warned.

Microsoft's Silverlight to support streaming HD Flash video

Silverlight 3 will be able to play high-definition Flash video and music in iTunes' AAC format

Microsoft Corp. said today that the next version of its Silverlight media player, due early next year, will be able to play live high-definition video encoded for rival Adobe Systems Inc.'s Flash player.

Users of Silverlight 3 will also be able to listen to streaming music encoded in the same format used by Apple Inc.'s iTunes player.

Adding support for the H.264 video compression formats based on the increasingly popular MPEG-4 standard won't necessarily make Silverlight-viewed video look better.

Nor will supporting the Advanced Audio Coding (AAC) codec allow Silverlight to play music stored locally by iTunes, partly because of Apple Inc.'s restrictions, said Steven Sklepowich, group product manager for Silverlight Media.

But it will prepare Silverlight 3, which will ship in the first quarter of next year, to play a much wider variety of the streamed HD video and high-fidelity music that broadcasters are expected to bring online.

"We are becoming more of an open runtime environment," Sklepowich said.

Silverlight is a Web browser plug-in that allows users to watch or listen to streaming multimedia. It differs from Microsoft's Windows Media Player, which is mostly used to play back media already downloaded off the Internet.

When Microsoft first released Silverlight last fall, to compete with Flash, it required broadcasters to encode video in the VC-1 codec, a now-open standard for HD DVDs and Blu-ray Discs based on Windows Media formats.

VC-1 enabled true DVD-quality streaming video that is much higher quality than the Flash video on sites such as YouTube, where most of the videos are still encoded in the H.263 codec. Such files are streamed to Web browsers, which cache them as .flv files.

Adobe has since updated its Flash 9 player to play HD H.264 video files, which are stored temporarily as .f4v files. Both .f4v and .flv are different than .swf files, which can be downloaded and played by Flash offline. (Silverlight today plays streamed video in the .asf file container format.)

Silverlight 3 won't be able to play .flv or .swf content, said Sklepowich. But it will be able to play H.264-based .f4v content.

Microsoft had long resisted calls to make its Silverlight player more compatible with Adobe's. Adobe says that last year 70% of Web video was streamed via Flash's .flv format.
Microsoft was motivated to support H.264 because it is becoming "the next-generation standard," said Sklepowich, with HD digital broadcasters such as DirecTV and Dish Network using H.264.

Adding H.264 support will cut work for broadcasters who previously would have had to do the time-consuming work of re-encoding their video in VC-1 to support Silverlight, he said.

And that should encourage more of them to stream video using Silverlight, as well as build special Silverlight-based players such as the ones specially created for NBCOlympics.com and the Democratic National Convention. The players, in addition to showing HD video, also offer features such as picture-in-picture, multiple views, and ticking data, Sklepowich said.

Microsoft plans to show off an early preview of Silverlight 3 at the International Broadcasting Conference (IBC) 2008 in Amsterdam later this week, according to Scott Guthrie, corporate vice president of Microsoft's Developer Division.

A beta of Silverlight 3 is expected soon after Silverlight 2 ships this fall, Sklepowich said.

The other caveat on video is that Silverlight will only be able to view .f4v streamed video if it is delivered from Web servers using the standard HTTP protocol, Sklepowich said. Video delivered from Adobe's Flash Media Server software using its proprietary RTMP protocol won't play, he said.

In addition to supporting MP3 and Windows Media Audio (WMA) streaming, Silverlight 3 will enable users to listen to streamed music in AAC formats. WMA is the most popular format for streaming today.

AAC is best known as the default audio format used by Apple Inc.'s iTunes, iPod and iPhone to store music files on devices and PCs.

Silverlight 3 will not be able to play those stored songs, Sklepowich said, partly because Apple adds its own digital rights management technology called Fairplay to prevent non-iTunes programs from playing them, and partly because Silverlight is meant only for streaming content.

However, an increasing number of broadcasters are using AAC to stream music through the Web, which Silverlight will be able to play.