Still Seeing Microsoft Windows XP In Banks!

So I’ve been into the bank a few times this week and have noticed they are still running XP on their workstations.

The ‘SecuriTeam‘ guys have put together a tally of most critical vulnerabilities associated with Microsoft Windows XP, it totals in at 358 vulnerabilities! I am intrigued as to how they are protecting themselves and their customers. Here’s a list of the top 100, but check out their site for a full list;

1. Microsoft Internet Explorer Property Change Memory Corruption Vulnerability
2. Microsoft Internet Explorer mshtml.dll Dangling Pointer Vulnerability
3. Microsoft Windows Shell Graphics BMP height Integer Overflow Vulnerability
4. Microsoft Windows Shell Graphics BMP width Integer Overflow Vulnerability
5. Microsoft Windows Shell Graphics biCompression Buffer Overflow Vulnerability
6. Microsoft Internet Explorer Animation Use-after-free Vulnerability
7. Microsoft Windows WmiTraceMessageVa Kernel Vulnerability
8. Microsoft Windows OpenType CFF Parsing Vulnerability
9. Wireshark 1.4.0 Malformed SNMP V1 Packet Denial of Service Vulnerability
10. Microsoft Word 2003 MSO Null Pointer Dereference Vulnerability
11. Microsoft Windows CreateWindow function callback vulnerability
12. Microsoft Windows MPEG Layer-3 Audio Decoder Code Execution Vulnerability
13. Microsoft Windows Help and Support Center Code Execution Vulnerability
14. Apple WebKit innerHTML element Substitution Remote Code Execution Vulnerability
15. Google Chrome and Safari WebKit HTML Caption Use After Free Vulnerability
16. Microsoft Windows Kernel GetDCEx() Memory Corruption Vulnerability
17. Windows SMTP Service DNS Query ID Vulnerabilities
18. Microsoft Windows Outlook Express and Windows Mail Integer Overflow Vulnerability
19. Oracle Java Runtime Environment Image File Buffer Overflow Vulnerability
20. Microsoft Windows Movie Maker and Microsoft Producer IsValidWMToolsStream() Heap Overflow
21. Microsoft Windows URL Handling Vulnerability
22. Microsoft Windows SMB NTLM Authentication Weak Nonce Vulnerability
23. Microsoft SMB Client Pool Overflow Vulnerability
24. Microsoft Windows RLE Video Decompressor Remote Code Execution Vulnerability
25. Microsoft Windows ShellExecute Improper Sanitization Code Execution Vulnerability
26. Microsoft Internet Explorer Dynamic OBJECT Tag and URLMON Sniffing Vulnerabilities
27. Microsoft Indeo Codec Memory Corruption Vulnerability
28. Microsoft Windows Local Security Authority Integer Overflow Vulnerability
29. Windows Kernel Multiple Vulnerabilities
30. Microsoft Windows ActiveX Indexing Service Memory Corruption Vulnerability
31. Windows CryptoAPI Null Truncation and Integer Overflow Vulnerabilities
32. Microsoft .NET Common Language Runtime Multiple Vulnereabilities
33. ActiveX Active Template Library Initialization Vulnerability
34. Windows Media Runtime Remote Code Execution
35. Microsoft Windows XP/Vista TCP/IP Orphaned Connections Vulnerability
36. Microsoft Windows MSMQ Privilege Escalation Vulnerability
37. Microsoft Workstation Service Heap Corruption Vulnerability
38. Microsoft Embedded OpenType Font Engine Heap Buffer Overflow (MS09-029)
39. Microsoft DirectShow QuickTime Atom Parsing Memory Corruption Vulnerability (MS09-028)
40. LogRover SQL Injection Authentication Bypass
41. Microsoft Internet Explorer Security Zone Restrictions Bypass
42. Microsoft Windows Graphics Device Interface Integer Overflow Vulnerability (MS08-071)
43. Vulnerability in SMB Allows Code Execution (MS08-068)
44. Vulnerability in Server Service Allows Code Execution (MS08-067)
45. Vulnerability in Windows Media Encoder 9 Allows Code Execution (MS08-053)
46. Vulnerabilities in GDI+ Allow Code Execution (MS08-052)
47. Vulnerability in Windows Media Player Allows Code Execution (MS08-054)
48. Cumulative Security Update for Internet Explorer (MS08-045)
49. Microsoft Windows Color Management Module Heap Buffer Overflow Vulnerability (MS08-046)
50. Vulnerabilities in DNS Allows Spoofing (MS08-037)
51. Vulnerabilities in Pragmatic General Multicast (PGM) Allows Denial of Service (MS08-036)
52. Vulnerability in Active Directory Allows Denial of Service (MS08-035)
53. Cumulative Security Update of ActiveX Kill Bits (MS08-032)
54. Vulnerability in Bluetooth Stack Allows Code Execution (MS08-030)
55. Vulnerability in Microsoft Jet Database Engine Allows Code Execution (MS08-028)
56. Microsoft Windows I2O Filter Utility Driver (i2omgmt.sys) Local Privilege Escalation Vulnerability
57. Microsoft Windows Graphics Rendering Engine Multiple Vulnerabilities (MS08-021)
58. Microsoft GDI WMF Parsing Heap Overflow Vulnerability (MS08-021)
59. Vulnerability in Windows Kernel Allows Elevation of Privilege (MS08-025)
60. Security Update of ActiveX Kill Bits (MS08-023)
61. Vulnerability in VBScript and JScript Scripting Engines Allows Code Execution (MS08-022)
62. Vulnerabilities in GDI Allows Code Execution (MS08-021)
63. Vulnerability in DNS Client Allows Spoofing (MS08-020)
64. Microsoft Outlook mailto Command Line Switch Injection
65. Adobe Reader and Acrobat JavaScript Insecure Method Exposure Vulnerability
66. Adobe Reader Security Provider Unsafe Libary Path Vulnerability
67. Adobe Reader and Acrobat Multiple Stack-based Buffer Overflow Vulnerabilities
68. Vulnerabilities in Windows TCP/IP Allows Code Execution (MS08-001)
69. Vulnerability in Message Queuing Allows Code Execution (MS07-065)
70. Vulnerability in Macrovision Driver Allows Local Elevation of Privilege (MS07-067)
71. Cumulative Security Update for Internet Explorer (MS07-069)
72. Vulnerability in Windows URI Handling Could Allow Remote Code Execution (MS07-061)
73. Security Update for Outlook Express and Windows Mail (MS07-056)
74. Cumulative Security Update for Internet Explorer (MS07-057)
75. Vulnerability in RPC Allows Denial of Service (MS07-058)
76. Vulnerability in Kodak Image Viewer Allows Code Execution (MS07-055)
77. Vulnerability in Windows Services for UNIX Allows Elevation of Privilege (MS07-053)
78. Vulnerability in MSN Messenger and Windows Live Messenger Allows Code Execution (MS07-054)
79. Vulnerabilities in Windows Media Player Allows Code Execution (MS07-047)
80. Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (MS07-042)
81. Vulnerability in OLE Automation Allows Code Execution (MS07-043)
82. Vulnerability in GDI Allows Code Execution (MS07-046)
83. Microsoft XML Core Services XMLDOM Memory Corruption Vulnerability
84. LinkedIn Toolbar (Exploit)
85. Vulnerability in Microsoft Internet Information Services Allows Code Execution (MS07-041)
86. Vulnerability in Win 32 API Allows Code Execution (MS07-035)
87. Cumulative Security Update for Outlook Express and Windows Mail (MS07-034)
88. Vulnerability in the Windows Schannel Security Package Allows Code Execution (MS07-031)
89. Microsoft GDI+ Integer Division by Zero Flaw Handling .ICO Files
90. Cumulative Security Update for Internet Explorer (MS07-027)
91. McAfee Security Center IsOldAppInstalled ActiveX Buffer Overflow Vulnerability
92. Windows Kernel Elevation of Privilege (MS07-022)
93. Universal Plug and Play Remote Code Execution (MS07-019)
94. Microsoft Agent Remote Code Execution (MS07-020)
95. CSRSS Remote Code Execution (MS07-021)
96. Universal Plug and Play Remote Code Execution (MS07-019)
97. Enterasys Networks Multiple NetSight Products Multiple Vulnerabilities
98. AOL Nullsoft Winamp IT Module Heap Memory Corruption (IN_MOD.DLL)
99. Vulnerabilities in GDI Allows Code Execution (MS07-017)
100. Windows Animated Cursor Stack Overflow Vulnerability (0-Day)

http://www.securiteam.com/products/W/Windows_XP.html