Do I have to install Windows XP Service Pack 2 now?

September 25, 2004 5:27 AM

I was going to hold off installing XP Service Pack 2 for a few months. Whilst I use Firefox rather than IE6, the jpeg vulnerability is listed as affecting XP itself. Do I really need to installing it as soon as possible? Is everyone else installing SP2 now?
posted by Blue Stone to (6 comments total)

The vulnerability affects Windows itself, which means Office apps, Windows Media Player, MSPaint and even the image preview function in Windows Explorer are affected. This is due to the way Windows reads the format tags of a file. Regardless of weither a trojan is embedded in a jpeg, or if "*.foo" is renamed "*.jpg" and tucked into the page source of a website, Windows and its subsequent line of MS-branded apps will take it for what it claims to be at face value.

Though Firefox can shield the problem while browsing, any downloaded images or software containing an exlpoit of the vulnerability could kickstart Internet Explorer and open your ports.
posted by Smart Dalek at 5:50 AM on September 25, 2004

I'm in no rush to do SP2 either. There's patches for the exploit

They're available through WinUpdate as well.

I've installed them and checked against this proof-of-concept jpeg (it's a zip download) and all seems fine.
posted by nikzhowz at 5:58 AM on September 25, 2004

That's what I was worried about Smart Dalek.

This patch looks like it'll do the trick and stave off SP2; cheers, nikzhowz.
posted by Blue Stone at 6:42 AM on September 25, 2004

I'd suggest a fair amount of caution before installing SP2. I tried it last week on my laptop only to have it refuse to load Windows on reboot. The only option was to use my restore disks and wipe out all my hard drive data. I later found from message boards that my eMachines laptop appears to have a very specific fatal problem with SP2 in its present form. So I guess the moral would be to do a little homework before installing. See if others with your computer model have had any problems, and back up everything before installing SP2.
posted by TBoneMcCool at 10:11 AM on September 25, 2004

Laptop users should be especially wary of upgrading. I had no problems with mine (and it did indeed make managing my wifi network easier), however others have had decidedly mixed results. I was just troubleshooting someone's problem over the phone, and it turns out (after spending a LOT of time) that SP2 detects his laptop's networking drivers as a foreign program and blocks them without telling you.
posted by TungstenChef at 4:42 PM on September 25, 2004

I have a freind who installed XP SP2 on his desktop. It caused the machine to get in an endless boot-crash-reboot cycle from which MS support and all our own best ideas could not rescue it. In fact, it seems that he actually *lost* data to this.

I've heard of other people having problems, too. If I were upgrading XP, I'd be wary.
posted by jdroth at 9:07 PM on September 26, 2004