Slashdot Mirror
Serious Security Flaw in MSIE 5.01, 5.5
Visit an attacker's webpage using Microsoft's browser on Microsoft's operating system, and the attacker can execute arbitrary code on your system with your full privileges. Oh, and thanks to Microsoft innovation - you may remember this from the trial - the browser is integrated with the OS, so reading email from an attacker (opening attachments not necessary) also gives them full access to your machine. MSIE 5.5 is vulnerable, and MSIE 5.01 is vulnerable unless you've installed Internet Explorer 5.01 Service Pack 2. Read the
security bulletin
and download the patches. Discovery props to
Kriptopolis.
This is a good idea, but sadly probably won't catch on because of the hassles involved and the blow-your-leg-off philosophy of Unix.
If you read the MS security advisory, you'd see that MS already has limited version of this implemented in IE for the content you download. If you've set your MS mail reader to "restricted" (recommended), it won't let the messages call local executables or write to the filesystem. Not bulletproof by any means, but something.
* If there's a simple way to do the equivalent of su, it's not widely known.
The NT4 version is on the resource kit CD. It is widely known because it's practically impossible to manage a NT network without the tools on this CD.
The NT5 version is built right into the shell and plastered all over the documentation. I suppose Bill Gates could come to your house and move your mouse for you.
You are living on Planet Microsoft where "rich text" is a thing (a specific format read by a specific COM control) and not an idea. HTML mail exists to provide "rich" (meaning "formatted") text to users. Let me pat that sexy MSCE ass for you for knowing the lingo, but MS doesn't own the term "rich text". Let me also smack upside the head for even mentioning Exchange (which this exploit has nothing to do with).
And that's the problem with the implementation, because nobody asked for Plugins, ActiveX controls, Java applets, frames, external image and sound loading, *arbitrary MIME type loading* and so on in their e-mail. They just wanted a fucking portable way to make things bold or red colored or whatever.
The solution is to sandbox the whole fucking thing to a greater degree, or better yet, define an XML format for mail messages, including standard classes that can be used for user-controlled CSS. All they need to do is knock heads with Netscape for a bit (just like they did with HTML/MIME), and we'd be rid of HTML mail for good.
Microsoft has had about 100 exploits due lack of sandboxing in their HTML mail clients over the years, and I'm just curious when they'll get sick of "Critical Updates" and fix the damn problem.
Almost. Web browsers, or anything else for that matter, should not do things behind your back. MS DESIGNED in Behind your Back capabilities, and even sprinkled in a few remote command shell holes, and other silent, dont display stuff. I am still surprised why it does not report at login - you last logged in at timeand date followed by tripwire like reports if anything changed. The reason browsers not jailed is that plain text email/W3C compliant webpages would become prolific once again - that any old os would do- hurting sales. Read the certificate thing again. Hardcoding them into code means that the loss of .net performance is significant. why?, and is it called more than once. I would like the user to be able to extend this list too. a deny all rule would expose, i guess other matters...
By putting codes in, say, an IMG tag like this
IMG SRC=foo.gif?123458343213
a spammer can know if his email has been received.
Given this newest security problem, I'm glad I'm a PINE nut!
This is exactly how the white hat in question (Juan Carlos Cuartango) operates. MS had plenty of warning.
.01 version bumps with missing release notes. I don't think there's been any major Mozilla holes discovered, but it's not 1.0 yet, so the white hats are probaby sitting on their hands for now.
Cuartango, BTW, is probabaly the number one white hat working on IE and HTML Mail issues, and he's gone public a number of times when MS was unresponsive. Quite a few of his warnings have turned into real exploits.
Microsoft, of course, is just fixing the potholes. They really need to go back and re-evaluate their implementation of Rich Text (HTML) e-mail from the ground up.
And for anyone crowing about Netscape/Mozilla -- Don't forget that Netscape 4 has had numerous mail exploits, just that Netscape doesn't release "Security Bulletins", they release
Just think of the following scheme: (If I understood correctly, it should be possible to create the following worm)
1) Send this worm to everyone in the address book using the randomly taken subject from the your previous emails.
2) Install timebomb into computer, which deletes all the files after few days
3) Send all your previously written emails to random recipients taken from the address book.
Worm would spread like a wildfire as the message does not look suspicious (it comes from a known sender and the subject is reasonamle as it has been used before by the sender). As no questions are asked from the user - all the outlook users reading the message would be affected.
Worm would be totally destructive, as all the files would be deleted.
Probably most damage would be done by sending the previous communication to random recipient. Just look into your sent messages folder and imagine what would happen if you would send the messages to random recipients taken from your address book.
Do you still have the gust to use Windows/IE/Outlook ?
- A.P.
--
* CmdrTaco is an idiot.
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
Well, I don't like the reality behind that, simply because of what has happened to the comments as a result.
Believe it or not, at one time, that wasn't the case.
But it's funny, in a pitiful sort of way, anyhow.
There was a revenue sctream, and netscape did have to adjust to that. I always thought that it was pretty clear that they didn't care about the $30 from end users--they were making their mane money off server software, which needed the brosers out there. However, they *did* get paid by OEM's who included netscape.
I don't know what the deal is with my particular system;
Win2k Pro, SP1, Dell PE1300 P III 600MHz 256meg RAM -
But ever since I loaded IE 5.5, it's actually SLOWER to launch than Netscape 4.73. I don't mind the crashes all that much anymore.
(this problem also affects Word; so much for wonderful "shared libraries")
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
I have to admit one thing about the M$ link provided:
It would seem that someone with a semblance of Clue(tm) wrote it.
The Q&A format is one that I've never seen before. An actual admittance of responsibility for, and meager explanation of, their role in the propagation of these sort of virii.
In Court, this could prove dangerous, liability wise, and doubtlessly was vetted endlessly by their lawyers.
The very fact that it appears at *all* is truly amazing to me.
Brak: What's THAT?
Thundercleese: A light switch.. of TOTAL DEVASTATION!
Why wasn't it on Windows Update? Why didn't the 'ever so clever' Critical Update Notification tell me about this?
Surely if I download an application from MS that claims to tell me about any new patches required for system security, it should do just that? And even if it was missed, why doesn't Windows Update tell me?
At first I thought I might already have it, but Help->About didn't list it as loaded & since it installed I assume it wasn't already present.
Kudos to MS for fixing it so quick. Raspberries that I had to find out from /. (of all places).
And don't get me started on why I had to reboot my PC to 'make the changes take effect'.
--
Keeper of the Wedding Shenanigans Home Page
Liked this comment? Why not buy me something nice
Sniff...
:(
You don't like me.
I feel really hurt.
Boo Hoo.
Boo hoo.
:(
:)]
You don't like me either.
[Obviously your someone who can't appreciate sarcasm
Yeah, I just installed the latest IE security updates on my parents computer. One of them (the so-called "VeriSign fix") was dated April 2. Which is a bit odd, considering today is March 29.
New math?
Mozilla implements (most, all the relevant bits anyway) of the IWebBrowser2 interface, making it a drop in replacement for IE.
However, in order to use Mozilla instead of IE, you have to do a binary patch to every single program that uses the IE control in order to make it use Mozilla instead. (All you need to do is change 16 bytes.)
If Microsoft had created a standard method of defining which CLSID (class ID) to use to create an object that supports the IWebBrowser2 IID (interface ID) (for instance, by storing browser name and CLSID key pairs in the registry and providing a control panel to change which one is the default), it would be trivially easy for the user to choose which web browser they wanted to use and for a program to use that web browser to display content.
Mozilla the comprehensive internet client is huge (24 MB on Linux, last time I checked. Which is tiny compared to IE.). However, if you get rid of the mail/news client, HTML editor and themes, it shrinks in size.
Besides, I would prefer a rendering engine capable of doing all of the relevant standards (HTML4, CSS, CSS2, DOM2, XML, MathML, XSL, etc.) mostly correctly and pretty quickly at that. However, I have no idea how well gtkhtml2 supports the standards or displays content.
The Mozilla ActiveX Project has been around for quite awhile. As to when exactly, I don't know.
Unfortunately, you can't just replace the IE DLLs with a compatible Mozilla implementation. Mozilla is just a web browser/email client/etc. while IE is the whole OS shell, and its DLLs do more than provide web browsing services.
I find it odd that people are bashing MS because so many programs are using IE to render HTML.
Think about it. There is a standard way for any program to render HTML in a window. Instead of everyone reinventing the wheel, all a programmer has to do is create a COM object and display it in a window.
Of course, the average Slashdotter is using this as evidence that Microsoft is the tool of Satan and their buildings shall be razed and their children and their children's children unto the fifth generation shall be cursed and despised, etc.
Modularity is good. Standard ways of doing things is good. Code reuse is good.
Now, the fact that there is absolutely no way to replace IE with your web browser of choice is evil (despite the fact that email clients, HTML editors, conferencing software and whatever else can be easily replaced) and the fact that Microsoft is terminally unable to write a program that doesn't serve as a speedy means of either crashing the OS or inviting in unwanted network guests is also evil. So they are the tool of Satan and their buildings shall be razed and their children and their children's children unto the fifth generation shall be cursed and despised, etc.
On a side note, GNOME is doing the same thing. Any program can use gtkhtml to render HTML in a window. Evolution is using it to display email messages (sound familiar?), Red Carpet uses it for UI, and GNOME Help uses it to render content. IIRC, the plan is to eventually replace gtkhtml with Mozilla (which does a much better job of complying to standards and rendering documents than gtkhtml.
Let's not joke around. Microsoft saw Netscape as a threat. The ability to run applications in a web browser decreased the value of the MS Operating Sytstems. Below are key points:
Microsoft bundled a web browser with it's OS. No, MS didn't just bundle some components. It included a complete software application w/ it's OS.
> KDE would have exactly this flaw if the
> Konquerer component had this flaw and an e-mail
> reader used the component.
What is the point of that statement? A would have this flaw if A had this flaw? Well.. yeah. But the point is it doesn't. And even if it did. You have the source. Even more important, you have choice. GNOME? KDE? WIN32?
This isn't idiotic MS bashing. MS is building us a world where we have no choice but to have security flaws.
Ugh.. I'll stop MS bashing when MS stops taking advantage of me and other consumers.
Josh
Used to be slashdot was where you'd hang out for discussions with people into free software.
/. admins to like m$ by incessantly pointing out how great m$ products are. There are thousands of m$-centric sites on the web. Now /. has to be one, too?
These days it's one long Microsoft love-fest.
I wonder if these folk really think they're going to get
I gave win2K a whirl, when we were given new laptops recently. It's the same old same old. The window manager sucks, and is totally unconfigurable. Re-mapping the keyboard requires building a dll, or paying per-cpu licenses for a program to do it. IE barfs pretty regularly.
I don't want to become a warez dood just so I can use the freaking keyboard.
Although it seems kind of contradictory, it's basically the difference between owning a house and renting an apartment. If you own a house, when something breaks, you feel a sense of pride of ownership when you fix it. If you rent an apartment and something breaks, you only can think about how long the stupid manager is taking to fix the problem. That's one of the main reasons that people (me included) like Linux - the pride in ownership.
Engineering and the Ultimate
It's not disabling active stuff, you also have to disable downloads, that's right, downloads. Not executables, not active crap, just downloads.
Engineering and the Ultimate
I believe I speak for many casual english speakers when I say this: Fuck proper grammer.
What are you trolling for?
1. Redhat isn't linux.
2. You never install OS at work you image.
3. When you rely on signed packages and
autoupdates, then false positives will
screw you. ( Remember MS has yet to
patch the bad verisign certs for users. )
4. You shouldn't manage the computer you
have a qualified IT staff for that. I can
setup debian with wine and sawmill to run
all the apps our win2k install runs with
the same GUI.
5. Distrobutions of linux are as tight as
default OpenBSD - and you can run scripts
to secure most common distros that aren't.
6. WINE has no effect on linux security as it's
a userland process.
7. There are linux apps that install with clicks
and leave a pretty kde and gnome icon for you.
I beta test them. =)
8. Windows ME shouldn't be compared to linux.
ME isn't in the same class of OS. Me is just
for people that need to run IE and do nothing
else.
9. Using X won't hurt your security on unices.
10. VBAs are the devil.
One thing is network transparent applications, and another is run twice as much software since I can run your apps as well. Also, my SMP isn't locked to a set number of cpus via a marketing team. ^_^
Somehow I just can't bring myself to leave that box checked.
Veteran, Bermuda Triangle Expeditionary Force, 1992-1951
Well, maybe I am a dumbass, but I didn't know that. I always thought I'd have to find the specific download package, which is not that easy to find from their website.
Cool. I can attach the patch to an e-mail, modify the mime headers and send to everyone in my company. That should do it...
what are the offending MIME types, so people can block them at the mail server?
Bzzt! Check your dictionary again: The pronouns are also legal in singular, though that use diminished over the centuries. It has largely been replaced by "he", "him" and "his", probably because women didn't count when the change occured: There was no need for a common pronoun for "male or female" because only the male was of any importance. :-P
Whether you (another pronoun which is the same in singular and plural form) are using singular or plural should be apparent from the sentence's context.
I'd rather download patches and check them md5 checksums. Call me paranoia, but it *DOES* matter.
How do you know that the Microsoft network isn't compromised (they had the odd breakin now and then)? Do you trust them? Why? Because they say so?
Just rememver the microsoft/verisign hassle from last week. No way microsoft will touch my machines. I just don't trust them.
--
Slashdot didn't accept your submission? hackerheaven.org will!
Microsoft already has a fix out. I think this bug was reported today. I'm impressed.
So many people here always scream that Open Source is better because you don't have to "wait for the service pack" in order to get fixes. Granted, the bug probably would've been found sooner if the source were open, but the fact that there is a fix out already is admirable.
I think this is going to be another long thread of unwarranted Microsoft bashing. You can bitch about the bugs in IE and it's security hazards, but if they get fixed this fast then it really detracts from your argument that Microsoft sucks. There have been security flaws found in Linux with a fix issued and instead of posts saying "Linux sucks, here's yet another security patch I have to add!" they're praising the community for getting a fix out so much faster than Microsoft would have.
--
Because Windows 95/98/ME has no concept of security, all code has full access to the machine. Even with Windows NT/2000, many users run under accounts with Administrator privileges, due to the large amount of broken software that doesn't work properly when run under an account with User privileges.
Mea navis aericumbens anguillis abundat
All these "remote root" exploits are all starting to be a blur when it comes to Internet Explorer or Micorosft in general. Who ever gave them the idea to make Internet software? Couldn't they just stick to insecure operating systems?
.NET.
I just don't see how you can knowingly dig your own grave by providing ubiquitous, essential e-mail and web browsing software and then widely propogating its lack of security. Why does an e-mail program have the ability to anything to my system except write a data file with my e-mails?
I can only imagine
Linux is a toy operating system, so it isn't expected to be secure. I'm pretty sure that was his point.
OK. My apologies.
I was somewhat confused as to the exact functionings of BIND at the time of the making of my post, and those initial comments were more than likely plain wrong. -_- However i think if you just delete everything before the words "despite this", or at least the stuff before "the important thing though" from my post, the rest is, umm, fairly important. Or something.
I would go into a long rant here about my personal belief that unweildiness of Mozilla (yes, i've poked the code) and MSIE and such are due to the fact that they are less than excellently thought out and designed attempts to create unreasonably monolithic applications, NOT because the nature of a web browser DEMANDS it be bloated
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
No, i did not mean to imply that Netscape has a perfect track record. Upon re-reading i realize that that was what i SAID, but i did not mean to; i must blame the hour of the morning and the fact that i am a massive tool for this occurance. The general gist of the garbled thought behind my posting was that Netscape bugs i remembered hearing about from time to time ; ie bugs i remembered hearing about *on a regular basis.* I thank you for bringing some objectivity to all this :)
Moderators: as of this writing, Ayende Rahien's informative post here is at score: 1, and my toss-off post he is replying to is at score: 3. WHAT ARE YOU SMOKING.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
W3c, thy art dead.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
I seem to remember that this would happen even if the user was not an administrator, however this detail seems EXTREMELY unlikely and i probably imagined it. It was called monkeybagel.com or something. I can't find it anymore. I did find this:
http://www.zdnet.co.uk/news/1999/35/ns-9701.html
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
You could make that case, very easily. Think: if not for Microsoft, it would still today be realistic to charge money for a web browser. Meaning it would be possible for a web browser to exist on its own terms, with SERIOUS resources devoted to their development, rather than the current situation where the major browsers must squeak by with either hand-outs from a massive corporation who are only developing the browser as a political tool, or beg (unsucessfully) for money and developers from passerby.
I'm don't know if it necessarily follows from this that MS was acting in an immoral fashion by leveraging its huge pool of resources to drive everyone serious out of the browser market, but you can CERTAINLY make a good case that it is "MS' fault that all the other browsers aren't as good"..
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
As far as Wu-ftpd goes.. dude. Seriously. Use Proftpd. It's better anyway.
> If you want to make a constructive criticism, then you should have them rewrite the whole OS.
MS doesn't need to *rewrite* this stuff, not *really*, but initiating a large-scale security-oriented code audit of the entire text of their networking and web browser code is something that they could really stand to do, BEFORE they start thinking about windows xp or whatever. They certainly have the resources. How do you propose to get them the initiative? Cuz it's sure as hell not my problemNot a bad idea. Here's a better one. Two words: CODE AUDITS.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
YESS, it really kind of *is* an MS thing. Except for one vague memory or so of an incident involving a java hole, you just plain don't *SEE* security holes popping up with Netscape or Opera or Omniweb or really ANY browser except MSIE! *Netscape* got security right, and their software was AWFUL! But that there should be THIS many instances of hardware-access-level vulnerabilities in something meant to display web pages.. just. blah. it blows my mind.
--mcc
it is late and i am spastic and bitter
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
The problem with this is that this isn't just a Well, Now It's Over And We Can All Get On With Our Lives type thing. If this were an isolated incident, "Move on" would be good advice indeed; however, Microsoft is developing a literal track record when it comes to security vulnerabilities. Security holes in MSIE, SERIOUS ones, seem to be cropping up on the order of once every couple of months;
i can think of at least four times since MSIE 4 that ways for attackers to affect the contents of an MSIE user's hard drive have been discovered, and i haven't even been watching it closely.
Are you really sure that "forgive and forget" is a good idea?? Do you honestly think that this isn't going to happen again? Do you honestly think if people let this issue rest-- and they will-- that microsoft is going to change its ways on its own? It certainly didn't the LAST couple of times this happened.
Keep in mind these are the people that you're supposed to be buying an attempted NETWORK OS (windows xp) from in a year or so, and they can't pull off security in a passive web browser. XP involves the passing around of remote executable code, doesn't it? Don't you think some SERIOUS pressure needs to be brought to bear on microsoft until they take steps to ensure that the security issues in their browsers are dealt with, COMPLETELY?
I am a Mac OS X user, so i am not *too* worried about this, but i do use MSIE from time to time, and so i for one am extremely alarmed with microsoft's nonchalance with security issues. Microsoft seems to have no interest to bring these "technologies" (activex, for example) that seem to be causing the problems to the macintosh platform, and the Macintosh port of IE shares no codebase with the windows version, so i am not directly threatened; however i still feel somewhat insecure with using MSIE.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
Mozilla crashes within 15 minutes? Are you running release version 0.8? Switch to 0.8.1 immediately! (Most of the versions between 0.8 and 0.8.1 were pretty bad...I went back to 0.7 for awhile, but 0.8.1 was reasonably good again. 2001032804 hasn't given me any trouble yet (I think the scrambled graphics were a problem at the User Friendly site), but the day is young.
... which ever came first. I haven't clicked on one of their agreements since then, and don't intend to. If someone insists on MS, then they have to make the agreement. That's one thing I won't do for them.
And investigate win98Lite. I stopped choosing to upgrade MS products before the first UCITA law was passed, or perhaps it was before the DMCA was passed
Caution: Now approaching the (technological) singularity.
I think we've pushed this "anyone can grow up to be president" thing too far.
Well, he said few rights, not none. Presumably the browser would be able to write to a file in its own (home?) folder. It could save all of it's downloaded files into one folder (allowing the user to create sub-folders as appropriate). Then the users could log in as themselves and move the file to the appropriate location.
Thinking this over, the web browser should have a special folder under each user to which it could write. Starting the web browser should be equivalent to logging in as user WebBrowser, with the current directory set to the web browser folder for whoever you happened to be before starting the web browser. The web browser user shouldn't have the right to open any directories belonging to any other user. Quitting the web browser shell should exit you back to who you were before. And ever web-capable user should be able to read files and execute folders owned by the web browser user.
This might be a bit inconvenient, but not terribly so. Setting it up would be a pain, but could easily be worth it (OTOH, I'm thinking of installing a distribution with the 2.4 kernel, so I probably won't run out and do this right now).
Caution: Now approaching the (technological) singularity.
I think we've pushed this "anyone can grow up to be president" thing too far.
My guess is the reason they don't do that, is that they don't believe IE4 is affected. Admitting that would make them look bad, so they're rather spread FUD about the safety of their older software, to try to encourage upgrades.
That kind of violates the idea idea of having software versioning, now doesn't it?
No, it doesn't. It's perfectly normal to continue to release patches for older products, for just about any software company other than Microsoft. In fact, Microsoft itself has done this in the past: they released a service pack for NT 3.51 after NT 4.0 was out. I don't remember the timing on NT4 SP6a - that may have come out after Win2K, too.
What about Huckster?...
That's the name of the holding corporation that MS will use to sell Hackster.
--
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
Subject for a Slashdot poll: How many people have "administrator" privileges on their NT accounts? The subject of the follow-on poll is left to the reader....
I also want to patent the method and apparatus of infecting the MS-OS side of a multi-booting computer so that the other OS(s) are affected upon subsequent boots, as well as the process of scanning for such damage. Hear that, McAffee? All your profits am belong to me. Hear that, Virus writers? Don't bother doing that -- it's been thought of, and so is no longer 133t.
Well, apparently, you only have to fool the majority of people for a little while.
Love to get some more details on this puppy.
I wonder, given the number of days it will take between now and when they finally get off their tuckuses and add it to the update page, how many people will be affected that otherwise could have been protected.
If it takes more than a week, I could imagine the lawyers would be drooling over the negligence of Microsoft, EULA or no.
Note that few contracts are totally rock solid; it depends on how many lawers you can affort to hammer on it. Look at what happened to poor Toshiba...
-- "I am disrespectful to dirt. Can you not see that I am serious!"
Attacker are entitled to ease of use too, ya' know.
--
Sheesh, evil *and* a jerk. -- Jade
> Combine this new exploit with this old one that lets you read any file off someone's harddrive and I think Microsoft might be able to market these as .NET features.
It's the latest in peer-to-peer file sharing. They're marketing it under the name Hackster.
--
Sheesh, evil *and* a jerk. -- Jade
The interesting part is, last night the page also listed, "Security Update, April 2, 2001" (note the date!), with the description:
Too bad the temporal rift only went a few days into the future and not further -- would've been nice to have downloaded, say SP3 for IE6...
I agree that getting the fix out so fast is indeed cool. The point is that the *next* bug in IE (and outlook!) will grant root^H^H^H^Hadministrator access to l337 hackers. Both open and close source programs have bugs; what's worth bitching about is the MS *philosophy* of running a web browser in kernel space. And this *does* affect *nix users, just as surely as a hole in the sun affects nocturnal animals.
Slashdot 's editors are dickheads
Hello? Email has something to do with text entry, therefore my email client doesn't integrate a web browser with an insecure scripting system but is integrated in Emacs. That's reuse, too. If I get an HTML email (it does happen sometimes), it's automatically piped though lynx -dump and displayed. That's reuse, too. And a great feature is that I could use W3m if I would find out that lynx could be instructed to wipe out my disk^Whome directory with the right HTML input. That is real modularity. You don't need object orientation for that. And having these features is no excuse for security holes.
Oh, and thanks to Microsoft innovation - you may remember this from the trial - the browser is integrated with the OS, so reading email from an attacker
I fail to see how that makes sense... What does the fact that IE is part of the OS have to do with email?
If this security flaw existed in, say, mozilla, then any program that used it's HTML rendering engine would be just as vulnerable.
ReadThe ReflectionEngine, a cyberpunk style n
I knew there was a good reason that I didn't put IE5.5 on my box. Now it comes to fruition.
_______
Scott Jones
Newscast Director / ABC19 WKPT
FC Closer
Well, i guess they really do withhold updates... Who would have guessed =:-)
---
Play Six Pack Man. I
Yesterday when I was on a tech support call with Microsoft (our Exchange server was glowing red and hovering), they simply told us to start up Internet Explorer and they'd fix the problem from their end. Just like magic, the server floated back into the rack and stopped glowing!
Hats off to M$ for writing such an amazing tech support tool!
-brain
just a quick note. I checked the MS update page after I saw this story. It did NOT list this as a "critical update", at least not for 5.01. Upgrading to SP2 was an option under "Recommended Updates". I don't know if this bug set off their "critical updates" program since I don't use it. It is a tough situation for them, tons of clueless users who will get abused, but it should be their responsibility on some level for damages associated with abuses for their software. Yes, I know their EULA tries to head off that argument, but the whole monopoly thing seems to be a decent counteragument.
--
+&x
Well. now that MS has released a patch for this bug... should be easy enough to use the bug to fix itself.... create a webpage, that uses this flaw to cause the pc to download and install a copy of the fix ;)
"Nyquil - The stuffy, sneezy, why-the-hell-is-the-room-spinning medicine."
It helped me. I appreciate /. for carrying the story.
I use a w2k box at my desk. I use w2k because I have to view the Internet world through the eyes of IE like our clients. I keep about 20 SecureCRT sessions open to our Linux servers and IE up all day.
Thanks for the info!
load "linux",8,1
Or maybe it was an Internet poll which tend to be rather biased because only certain people vote. In that case, the 95% might even be correct since (I assume) there are a lot more IQ>100-ppl than there are IQ100 on the Internet.
0x or or snor perron?!
Maybe it's supposed to be part of the joke - I can't tell if the poster has a history of trolling from his past posts alone. Either way, there's a goatse.cx link - that's not cool.
If anybody's grateful for the warning, I wouldn't mind you expressing your generosity with a few mods up =)
-- Imagine how much more advanced our technology would be if we had eight fingers per hand.
Well I guess Microsoft has finally realized that we males are too stupid to be "attackers," since everyone knows that the vast majority of 5r1pt k1dd13s are women. I was going to try to be an 3133t hax0r, but apparently the women have beaten us to that, too. I suppose the only quick and dirty way to rake up some cash now is to audition for Survivor.
-- Imagine how much more advanced our technology would be if we had eight fingers per hand.
-- Imagine how much more advanced our technology would be if we had eight fingers per hand.
oh wait its probably just IE5.5 re-branded.. :(
The early bird gets the worm, but the second mouse gets the cheese!
But when the 2.2.x kernels have a _BIG_ security hole that allows users to exploit it against _ANY_ SUID binary, well that must not be news worthy...
Go not unto/. for advice, for you will be told both yea and nay (but have nothing to do with the question)
That is inaccurate.
What you quoted is not inaccurate. It was established in the FoF that it is virtually impossible to remove IE from Winduhs98, and thus simply removing the vulnerable software is not an option. If KDE had such a flaw, you could rm it entirely, or simply stop running it.
What's perhaps worse, is that a lot of Winduhs users I know would think they could avoid the problem by using a browser like NeoPlanet, not realising it's just an IE wrapper. They'll plunk themselves into the worse situation of thinking they're safe when they aren't.
That is what M$ innovation gave us.
Ever heard of the term "reuse"?
Yes, it's called linking a library and it wasn't invented with OO. And from the way DLLs get sprinkled all over the system I don't think a lot of SW authors accomplish/bother with "reuse" on Winduhs anyway.
"Oh, and thanks to Microsoft innovation - you may remember this from the trial - the browser is integrated with the OS, so reading email from an attacker (opening attachments not necessary) also gives them full access to your machine."
Why does integration with the OS automatically give an attacker full access to your machine? Just because IE comes with the system and because it shares DLL's that the system uses doesn't mean that you would be running your email app or your browser as root / administrator or anything like that. What's the ingress here refering to?
Technical description:
Because HTML e-mails are simply web pages, IE can render them and open binary attachments in a way that is appropriate to their MIME types. However, a flaw exists in the type of processing that is specified for certain unusual MIME types. If an attacker created an HTML e-mail containing an executable attachment, then modified the MIME header information to specify that the attachment was one of the unusual MIME types that IE handles incorrectly, IE would launch the attachment automatically when it rendered the e-mail. An attacker could use this vulnerability in either of two scenarios. She could host an affected HTML e-mail on a web site and try to persuade another user to visit it, at which point script on a web page could open the mail and initiate the executable. Alternatively, she could send the HTML mail directly to the user. In either case, the executable attachment, if it ran, would be limited only by user's permissions on the system.
This is scary... I bet we will see more and more viriis that spread using Outlook.
hmm.. let's do some virii coding =)
> Netscape, Mozilla, Opera
Don't you mean:
Netscape & IE, Mozille & IE, or Opera & IE
IE is integrated into the operating system, you can't just uninstall it (without causing problems).
but you redeemed yourself at the end, good show! :-)
-------------------------------------------
I like nonsense, it wakes up the brain cells.
-------------------------------------------
I like nonsense, it wakes up the brain cells.
-- Dr. Seuss
I would guess that most slashdot users probably don't run wu-ftpd. Even if they do they probably subscribe the listserve which let's them know immediately when something is cracked. Unfortunately most lusers who use IE will never even know that this security hole exists and will never upgrade their IE thereby unleashing all kinds of meyhem on the internet which we will have deal with.
I know of no Linux user who runs server software like bind or proftpd who does not monitor their logs, subcribe to security listserves and is generally paranoid about being hacked. Recently when a vulnerability was anounced in proftpd (first one in a long time) I got email both from the proftpd folks and debian. I upgraded via apt withing minutes after I got the email (I sshed in from work) and I was safe.
Too bad less then 5% of IE users will ever take that kind of action.
War is necrophilia.
I highly doubt that even the most idiotic luser would accidently press the "SERVER" button instead of the "WORKSTATION" button. Even so more and distros are installing safer defaults. In fact I was recently at bust buy and noticed thad SUSE was actually selling two boxes one for workstation and one for server (the server costing a bit more).
War is necrophilia.
Come on now BIND, wu-ftpd, and even sendmail get bashed regularly on slashdot (and rightfully so especially BIND). It's because of all the bashing that BIND9 was re-written from scratch.
Don't you remember the recent thread about BIND? Whenever a major security breach is discovered it gets covered on slashdot why should MS be immune?
War is necrophilia.
Well that's not what they testified to in court. Are you suggesting that the top brass on MS committed perjury?
War is necrophilia.
Foot-And-Mouth Believed To Be First Virus Unable To Spread Through Microsoft Outlook
Atlanta, Ga. (SatireWire.com)
Scientists at the Centers for Disease Control and Symantec's AntiVirus Research Center today confirmed that foot-and-mouth disease cannot be spread by Microsoft's Outlook email application, believed to be the first time the program has ever failed to propagate a major virus.
"Frankly, we've never heard of a virus that couldn't spread through Microsoft Outlook, so our findings were, to say the least, unexpected," said Clive Sarnow, director of the CDC's infectious disease unit.
The study was immediately hailed by British officials, who said it will save millions of pounds and thousands of man hours. "Up until now we have, quite naturally, assumed that both foot-and-mouth and mad cow were spread by Microsoft Outlook," said Nick Brown, Britain's Agriculture Minister. "By eliminating it, we can focus our resources elsewhere."
However, researchers in the Netherlands, where foot-and-mouth has recently appeared, said they are not yet prepared to disqualify Outlook, which has been the progenitor of viruses such as "I Love You," "Bubbleboy," "Anna Kournikova," and "Naked Wife," to name but a few.
Said Nils Overmars, director of the Molecular Virology Lab at Leiden University: "It's not that we don't trust the research, it's just that as scientists, we are trained to be skeptical of any finding that flies in the face of established truth. And this one flies in the face like a blind drunk sparrow."
Executives at Microsoft, meanwhile, were equally skeptical, insisting that Outlook's patented Virus Transfer Protocol (VTP) has proven virtually pervious to any virus. The company, however, will issue a free VTP patch if it turns out the application is not vulnerable to foot-and-mouth.
Such an admission would be embarrassing for the software giant, but Symantec virologist Ariel Kologne insisted that no one is more humiliated by the study than she is. "Only last week, I had a reporter ask if the foot-and-mouth virus spreads through Microsoft Outlook, and I told him, 'Doesn't everything?'" she recalled. "Who would've thought?"
Copyright © 2001, SatireWire
--
$ find
Now this here is a textbook-quality example of why it is so hard to tell from written messages whether someone is trying to be funny or not. Taken seriously, this person seems to be suggesting that normal people, or at least normal slashdot people, should be willing to evaluate the relative advantages of 0.7, 0.8, 0.8.0.x, and 0.8.1 builds of a web browser over the course of a month or so. Taken as a joke, HiThere is pointing out how some of us have jobs or go to school.
Somebody want to help me out here?
If you say, "now I'll be modded down because of X", I'll happily oblige.
Which is a royal pain in the ass when you're supporting other users. All I want is an executable patch that I can either point users to or put in their login script.....
Sad but (more or less) true. Konqueror, on the other hand, is now pretty stable, does 95% of things right, and is very close to being a thoroughly satisfactory browser.
I'm old enough to remember when discussions on Slashdot were well informed.
Dude, that is so fucking funny. Sounds like you're saying. "that is NOT a cube; THAT is a physical object with six squares of the same size for physical boundaries. ha ha ha he ROTFL
It has little to do with "object orientation" also. It has to do with the security system. Whether code is reused or not does not matter...if vulnerable applications are run with powerful privelages, bad things will happen.
It's 10 PM. Do you know if you're un-American?
Short answer:
s/All/Most/
[Too ]Long answer:
Not really. I've seen some code written by disciplined programmers that I would say is perfect. So I think software had bugs because of a lack of programmer discipline. I think most people will agree that it's possible to make a perfect function (i.e. it does exactly what it's supposed to do, handling all possible errors, etc). It's also possible to make every function perfect. Therefore, it is possible to make an entire program perfect. I've done it with smaller programs (nothing I've released yet) and I intend to do it again with a larger one I'm beginning to write (it's an XMMS replacement).
Anyway, I agree with everything else you said. That's just a pet-peeve of mine.
--------
Genius dies of the same blow that destroys liberty.
Buckling in pain. Please refrain from comparing dpkg to Windows Update as if they're almost the same thing. It just hurts.
--------
Genius dies of the same blow that destroys liberty.
It goes the other way, too. I've seen crappy programmers who are so proud of their code they think it's worth millions of dollars, and they don't want to let anyone see it.
--------
Genius dies of the same blow that destroys liberty.
The problem with Linux guys is that they use Linux because of its robustness, and an OS that *ever* *needs* a reboot because of memory leaks simply isn't robust.
I'll probably get flamed for this, but I think a large portion of Linux advocates are just like a large portion of <anything> advocates: they are people who blindly try to follow what the intelligent people are doing, so they can look and feel intelligent too. Of course, they often miss the REASONS why intelligent people act a certain way and do regally stupid things that make the real intelligent people look bad. (I know I've done that, though I tend to notice it later.)
Get used to most people being stupid in one way or another.
--------
Genius dies of the same blow that destroys liberty.
Pine sucks. Use mutt.
--------
Genius dies of the same blow that destroys liberty.
fp
props to all dead homiez
what mime types does IE handle incorrectly that would cause a file to be executed? and is only with exe's that are incorrectly identified, or would it, say, open up a movie file if the mime type was changed to the same incorrect thing?
CNN's report includes a response from the "innovators" in Redbud that they were pissed that the security flaw was reported..."irresponsible" was the word. Clearly, using M$ software is irresponsible... it's the price they pay for making product "lock-in" job #1.
I want to be alone with the sandwich
You REALLY don't want me to post the uptime of my OpenVMS and OS/2 boxen, do you?
Gamingmuseum.com: Give your 3D accelerator a rest.
This is the first time it has happened though, so I have to wonder how throughly Microsoft "tested" it. Since their websites and network are real secure and we can all trust their digital cetificate I kinda feel I bought this upon myself.
Basically, when you open the html page, behind the scenes, it saves two text files to your computer, one is a debug script, and the other is the actual virus/trojan. How can a text file contain a virus? Well the first one is basically a hex dump of some executable. The offending web page then runs debug.exe, which is found on every windows computer, and reconstructs it into a .com executable. What it is is a UUdecoder. The actual virus/trojan is UUencoded. So the web page then runs uudecode.com or whatever, and reconstructs the trojan.. It is then ran.
So why not have debug.exe do the whole thing? well, debug only works with the .com format from the old DOS days, which is limited to 64kb in size. There are a few more things going on, but this is basically how it works.
Could this have been prevented in the first place? YES. Is it all Microsoft's fault? YES. Did microsoft have security in mind when creating Windows? NO!.
Ok, I did a fresh install of windows on a computer at work. Windows 98 first edition. I popped in the cd, the install ran, and in 30 minutes the computer booted and I went to the Windows Update site. Four downloads and two reboots later, I have a reasonably secure system with no known exploits. Full install, all fixes applied - less than an hour and a half.
This is a pretty useless argument. Atfer spending this amount of time with an install of Windows 98, adding the updates and rebooting a couple of times you have an OS installed. If I spent the same amount of time with a Red Hat 7 install and updates I have everything I need to get my work done. I have Emacs and and gcc andPERL and Apache and MySQL and OpenSSH and Abiword and Gnumeric and Netscape and Mutt, etc.
You have Windows, IE, Outlook Express and WordPad. Joy, just what the hell are you going to do with that?
You're comment about Windows being secure is true. On the other hand its' not like it does anything either. As soon as you install an FTP server, a web server, an RDBMS and a remote acces program you have the potential to get just as "owned" as any other OS.
What people are trying to say here is that making my email program execute code because I've got something showing in the preview pane is pretty damn dangerous. Yesterday, for the first time in my life, I recived an email that makes use of these fancy scripting features. Its' a piece of spam (which I signed up for) from the Ministry of sound with a link to their new TV ad and a little flash animation. Its' pretty cool but I'll live without it if that's the cost of not getting email that causes some trojan to be executed.
To all guys complaining about MS security: Try installing their products in Spanish, French German or whatever you like. Then you will learn what untimely and sometimes even forgotten bug and security fixes are :-(((
If you ever want to make a computer really insecure
Install Windows NT Server German. And then IIS on top. Forget about security forever. Or you'll never sleep calm again.
Bye egghat.
-- "As a human being I claim the right to be widely inconsistent", John Peel
> So basically, this lets someone malicious tell your computer what to do.
Especially since Micro$oft's crypto certificate has been leaked. So you cannot even be sure that the patch is from the real Micro$oft either!
Say no to software patents.
Netscape: One arbitrary code execution bug, one hard drive access bug. MSIE: At LEAST two arbitrary code execution bugs (that i can remember), and at least two hard drive access bugs (that i can remember).
If two arbitrary-code holes are present in the same version of some software, how much worse is that than having a single hole?
The shareholder is always right.
Done this way, it doesn't matter if the browser code has security holes because the browser code is not trusted. The mandatory security protections of the OS prevent it from doing anything. This is the right way to do it, and the only one that will work.
That works if you only use the web for fun and/or reference, but if you type your credit card number into any website, you should hope that other sites aren't able to read your cookie file or hijack your browser to send everything you type into other sites to the malicious site. I guess you could tell the user to restart their browser after visiting any questionable site and throw out the cookies file between each session, but I doubt it would be worth the effort and loss of functionality.
By the way, preventing the browser from mucking with your files wouldn't solve privacy problems such as bug 57351 (present in both IE and Mozilla).
The shareholder is always right.
http://www.redhat.com/support/errata/rh7-errata-se curity.html
u gfixes.html
p dates.html
http://www.redhat.com/support/errata/rh7-errata-b
http://www.redhat.com/support/errata/rh7-errata-u
Ok, I did a fresh install of windows on a computer at work. Windows 98 first edition. I popped in the cd, the install ran, and in 30 minutes the computer booted and I went to the Windows Update site. Four downloads and two reboots later, I have a reasonably secure system with no known exploits. Full install, all fixes applied - less than an hour and a half.
Compare this with Redhat 7. Of course, everyone will complain that either these are for other apps (not the beloved linux kernel) or that RH 7 is just chock full o bugs. These are not excuses - and it's not an excuse that a knowledgeable person can plug up all the security holes in their GNU/Linux distro. Windows is a rather secure OS. OpenBSD it is not, but I garuantee that if you replaced every Windows user's desktop with KDE running on RH or SuSe, in absolutely no time at all 1337 4ax0rs will be having field days.
And on top of it, my copy of Windows ME that I use on my main desktop is the most stable full GUI system I've ever run. After turning off stupid things like system restore and PCHealth, it's quick, unobtrusive, and NEVER CRASHES. I haven't had a crash on this machine not caused by RealPlayer or Mozilla since I installed it. My current uptime is around 29 days, and that was only to change the ethernet card. Same goes with my Thinkpad.
I run an OpenBSD server, and I'm impressed with its default install security, and the fact that everything is turned off. I like OpenBSD, and I like Linux. However, putting X on Linux and running windows-equivalent apps, in my experience, makes it just as buggy and not much, if at all, more secure.
No one cares how fucking wonderful, stable, bug-free, and brilliant the Linux kernel is when common Linux apps aren't. I don't give a shit if Linux has better memory management when I can just click "open from location" and have apps install right there and give me a nice icon. Users won't care about the source code to the gnu c++ compiler when I can click TWICE and have ALL of the latest bug fixes and security updates install THEMSELVES WITH NO EXTRA INTERVENTION.
I don't care if Linux is more powerful when Windows is just so much easier to manage. I do WORK with my time, not bug downloads and system management.
Sorry about that, I just had a bone to pick.
This whole "integration" label is kind of wrong-headed to begin with. Technically calculator is integrated into the OS (bundled, whatever you want to call it).
.NET the embraced and extended internet of the future (as they would have it). It's too bad that if people dont want IE it's tough shit for them. Mozilla would be a /much/ better alternative if they were allowed the hooks into the OS that loads it on startup into memory, and makes it persistent, and makes it so it loads the mozilla widget when you type in a url in the explorer application.. Too bad those API's aren't documented. Maybe MS considers them "application specific" and not part of the OS. What nebulous nit picking.
Browser "integration" into the os isn't risky if it's done intelligently. A Browser now-a-days is an external browser interface, a core html rendering widget, and plugins. It's not ludicrous to put the rendering widget into a system library (like microsoft does) because this doesn't preclude security in any way. (although it is ludicrous to make it non-removable *cough*).
Imo, the correct way to look at this is in the legalistic manner. Monopolies can be found guilty of a method called "Tying" which basicly what MS did. They bolted IE onto the side of windows and made it catastrophic to remove IE functionality (not for very good reasons). Should MS make it possible to remove the browser? Of course. I'm sure there would be many sys admins out there drooling at the chance to do just that. Of course MS would never do that. IE is now their forced-onto-everyone interface to
I'll see you in splittsville, MS.
SEE, this is why we need nice cross platform non proprietary standards like SVG and SMIL. I oly use windows because there's no good flash program for linux. I wish there was, it's not like flash for windows is bug-free.
:)
Maybe they'll make an osX version soon.
http://www.hyperpoem.net
hyperpoem.net
Haven't you guys ever heard of Windows Update? I assume (I don't know, because I run IE6 preview) that everyone has a critical update notification about right now (assuming you run it). Windows update even works for older OS'es where it wasn't built in (like nt4). Again, before I get flamed I'm assuming this patch is on Windows update, but I don't know, because I don't run ie 5.5. I'm sure it will be shortly.
---
DO NOT DISTURB THE SE
Look. I don't want to render my e-mail. I don't want clickable links. I just want plain fucking text. Is that so much to ask for?
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
What's that?
I forgot how rock-solid Netscape's LiveScript was.
Also, ha ha.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
Because the exploit's half a year old.
Also, because this is a different exploit. Checking a page out should necessarily entail reading its contents. Is a cross-frame scripting vulnerability that easy to mistake for a MIME fuckup?
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
Please mod this moron down to -10, his link is to GOATSE.CX
--
--
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
It is cool that the fix is available quickly. I hate MS business practices, but at least they were prompt on this.
--
--
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
Just for clarification, I (Fanatic) didn't have to follow the link this time - thank god - once was more than enough. No one with a weak stomach should follow that link.
Quick tip - if you mouse-over the link, it's href shows up in the status line.
--
--
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
It doesn't matter that it is really part of the OS, you don't have to use it.
Not quite true. As the bulletin makes clear, the same code gets used to render HTML in the MS email clients. Additionally, MSIE components get used in other places, such as the MS "help" system. And maybe you don't have to use it explicitly, but have you tried installing or upgrading ANY MS software lately? Every time I've done it lately, I was forced to install IE. It's very dificult to get away from.
--
--
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
Everyone in my family except me uses AOL. (They're OK otherwise, and actually rather intellignet, believe it or not.) Anyhow, I'm trying to figure out if AOL's browser at v6.0 is MSIE or what. Any help much appreciated. (Using 'help->about' just says it's AOL v6.0, unfortunately, I'm told.)
--
--
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
That is inaccurate. It's thanks to an object oriented operating system that we have this problem.
Not sure what OO has to do with it; the problem is a program that executes code recieved from the net without even asking. That's the problem. Let's hope KDE never does anything that silly.
--
--
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
Yeah, but 5.01 is nice and stable and doesn't hog RAM so why not upgrade? It don't cost nuthin'.
...the funniest thing I've EVER read on slashdot. My sides hurt.
TomatoMan
-- http://frobnosticate.com
When the patches are downloaded there does seem to be some sort of authenticity and integrity checks made against the dl'd files, so I wouldn't think that the Windows Update system would just willingly install any ol' fake patch that you might try to send it. Still...
---
In IE you go to Tools -> Internet Options, and uncheck "Play Animations." Bingo, no more animated gifs.
---
Exactly. The technical knowledge and skill necessary to position the mouse over the IE icon, right click, and select "Delete" is beyond the average user's ability. It needs to be made simpler. I think the desktop should have the IE icon, and the rest of the desktop should be devoted to a 600x600 button saying "Click here to remove IE icon from desktop." Would that please you and the hapless idiot users you seem to be speaking on behalf of? Cheers!
---
yeah, and i'll give you one guess whether they "are" or "are not" so affected, too... --renard
>> It's thanks to an object oriented operating system that we have this problem. Ever heard of the term "reuse"? <<
Procedural can also "re-use" code, it is just not usually via class hierarchies. (Smalltalk-type message handling is sort of limbo-land between both approaches.)
-The official anti-OO troll-
Table-ized A.I.
An attacker could use this vulnerability in either of two scenarios. She could host an affected HTML e-mail on a web site and try to persuade another user to visit it, at which point script on a web page could open the mail and initiate the executable. Alternatively, she could send the HTML mail directly to the user. In either case, the executable attachment, if it ran, would be limited only by user's permissions on the system.
Guess it only affects girls....we're safe guys!
Because it feels like something I've done before, yeah I could fake it but I'd still want more...
I find that quite understandable. People who don't deal with Windows on a regular basis generally don't have very strong feelings about it. This makes it easy (and fun) to maintain an attitude of casual scorn and contempt toward that particular festering pile. When one is forced to use Windows, however, one's attitude unfortunately degenerates into pulsating screaming hatred.
That's what 'Microsoft Corporation' Verisign certificates are for: authenicating the source of the updates. :)
=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=
If only everyone read their mail with pine, and browsed with lynx....
Oh well.. I can dream, can't I??
--Chemguru
Here's the translation for your average slashdotter
Originally posted: March 29, 2001
We would have told you earlier, but we were sharpening our throwing knives and trying to install "Unix" on our computers...
Summary
Who should read this bulletin: Customers using Microsoft® Internet Explorer.
Let's see... IF I were running IE, then the Attackers^tm would be fiercely attacking me now and I wouldn't be reading this right now... but the translation is:
Who should read this bulletin: any of the sheeple that we have convinced to use our (superior) product.
Impact of vulnerability: Run code of attacker's choice.
So basically, this lets someone malicious tell your computer what to do.
Recommendation: Customers using IE should install the patch immediately.
So basically, this lets someone malicious tell your computer what to do.
El Karma: excelente(principalmente la suma de moderación hecha a los comentarios de los usuarios)
...you can get it here.
Microsoft: Who Do j00 want to 0wn today?
Trolls make great pets. Adopt one today!
That's very true. OpenBSD is incredibly hard. But you really can't use it as a desktop OS like you can Linux or Windows.
To be secure, use Linux. If you're really, really paranoid, use OpenBSD. If you're all about easy to use interfaces, use MacOS. If you just don't care, use Windows. Take your pick. Given the fact that OpenBSD is too hard for the average Joe, MacOS crashes too much (sans OS X), and Windows is, well, Windows, I choose Linux. If you take the time to learn RedHat Linux, you can effectively secure your system while using it as a very effective desktop OS. But, damn, OpenBSD is so tight. It's nice to see that someone shuts stuff off by default, rather than keep everything on by default *coughs IRIX, IRIX*.
Trolls make great pets. Adopt one today!
"They", "them", and "their" are grammatically plural, and are therefore technically incorrect. I've been told this is the fault of 18th century grammarians; apparently in olden times, English speakers recognized the need for singular androgynous pronouns. Microsoft taking the tried-and-true track rather than risking their reputation by forwarding progress is rather a common theme to the criticisms here.
I hear you. I have w2k and linux boxes at my desk, because there's just something about using vi on a physical *nix machine :) I use ie to surf; but for programming I love having multiple consoles organized by desktop on my linux box.
Not quite as idiomatic as the French "on".
or in chinese, you might just leave out a subject altogether
I find it amusing that the worst purveyer of unprompted MS-bashing, Malda, is also the only editor who regularly admits to using Windows. (Unless I just missed Loki's ports of The Sims and Diablo II.)
--
--
I like to watch.
The second reason is the complete lack of commercial software. (Even FreeBSD does better in this area!) GNU/Linux may have more reported bugs, but it also runs fucking Oracle 8i. (And, yes, anyone who suggests that I replace my Oracle installations with MySQL gets beaten with the clue stick.)
OpenBSD only has a future as a firewall for the 386 in the corner, and frankly, most admins with a clue would rather run GNU/Linux on that firewall because encrypted swap doesn't mean shit if the machine is just looking at packets all day.
Not to mention the fact that the future of the product rests in the hands of a single Canadian cryto-nut with a well-deserved reputation as a whiny, bitchy, moody control freak. The project has other developers but it is no secret that Theo 0wns OpenBSD. Before you mod this as flamebait, think: maybe there's a reason why everyone who has heard of DeRaadt has heard of DeRaadt's emotional instability. Even if OpenBSD ran Oracle on my company's SMP RS/6000s, I'd be hesitant to use it because of this sticking point.
--
--
I like to watch.
Their operating systems boast a superior UI, an extensive object-oriented architecture complete with distributed RMI, and run on a greater variety of hardware than any other system, including GNU/Linux.
NT has only taken market share from UNIX. (Which, as most of you are too ignorant to know, was a Big Bad Corporate OS in the 80s. Just like IBM was evil in the 80s. How things change... a few open-source UNIX-ripoffs later, and UNIX is considered "grassroots" by many people here, just like IBM is now seen in a similar light for their "heartfelt" support of Linux.)
They've also completely taken over the desktop market. Of course the roots of this monopoly are 20 years old, but they've only had a truly desirable product for about five.
I like NT. I wouldn't let it in my server room, but it makes a damn good workstation OS. I like its interface best of all I've tried. It has excellent hardware and application support. In addition to being a great development environment, it plays games and DVDs. And my UNIX boxes are never farther away than a telnet session.
MSFT has perhaps produced a greater volume of useful code in five years than anyone else ever has, and NT is still four times younger than UNIX. So I'm willing to forgive some bugs.
--
--
I like to watch.
--
--
I like to watch.
Where in the HELL is the real info on this bug? Microsoft's release is just a bunch of fluff, spelling everything out so that even an MCSE could understand it. What MIME types? How am I supposed to filter this out for my users without any information.
Anyone have a link? I have a feeling if I don't have this procmailed tonight, there are going to be lots of support calls tomarrow.
You have no idea how computer programs work, do you? buffer overflows are by far not the only way in which particular input can crash a program.
The illegal we do immediately. The unconstitutional takes a little longer.
--Henry Kissinger
So THIS is why my system starts going apeshit every time I visit slashdot...
You're using her as bait, Master!
Remember to use our patch, signed by us and Verisign.
I can't say that I don't give a fuck. I've just run out of fuck to give.
It's not an unreasonable demand if you take it in the context that he's beta-testing various versions. You upgrade, if it happens to be worse, report the bugs and downgrade. If you're running Mozilla, you're a beta-tester. There's a reason there is no Mozilla 1.0 (and don't get me started on AOL's decision to release a beta as a full version...)
I finally got my system up and running today again (shipped with a fried stick of SDRAM, not sure how that one got out the door) decidied that it was time to do the windows equivalent of using dkpg, hit windows update. Fresh JVM, DirectX8a, IE 5.5sp1 build, the whole nine yards, just completed ~1.5 hrs ago. No warnings there at Win Update, I have to go to an "alternative focus" web site to get word that I have a huge security leak on my system. I wonder why the apache team even bothers making a win32 port if the system gets wiped out by a newbie admin who checked his mail from the web server.
Read my plan to save the Bengals
Curmudgeon Gamer: Not happy
All I can say is, "Great Oogly Moogly". Thanks a lot Microsoft.
What kind of bone-headed thought processes allow a web-browser to have full control over an operating system. Is it just me, or is that REALLY STUPID? I'm no programming Einstein, but doesn't someone at Microsoft have a clue that this is cross-the-streams bad? This isn't the first time that IE has had this sort of problem: What about the infamous "IE 5.5 Cross Frame security vulnerability" from a few months ago which essentially lets someone read any files on your computer. There's been at least a half-dozen more, I'm sure.
Mark my words, the virus writers are acting right now to take advantage of this vulnerability. In two months, when they release their virus, it will spread like wildfire. If you thought LoveLetter and Melissa were bad, this one will be much worse!
What gets me is MS's nonchalance towards the issue. After all, it's just same-old, same-old to them. Another month, another *serious* vulnerability.
Thanks for letting me get this off my chest. :-)
Ceci n'est pas une pipe.
So now a cracker can hit an exploit a hole in a Microsoft IIS site (Running on Microsoft Windows 2000) and replace the front page with an identical copy, with the malicious code added, then let the people idly browse up to it with their security-compromised Microsoft Internet Explorer browsers.
*Sigh*
It is true, Microsoft do provide complete solutions.
404 Not Found: No such file or resource as '.sig'
thing is IE isn't a browser
.oO0Oo.
it's an appliaction platform almost akin to a little OS.
And I'll gladly bet ya $5 there are thousands of Linux machines running vulnerable Bind in small web shops and on hosted machines in ISPs.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
To let a file out of the jail, it has to be shown to be harmless. This is the job of a "downgrader", (actually, we're talking about an "upgrader" here, but the terminology comes from DoD security and is traditional) a trusted application which examines files to determine if it safe to change their security level. A reasonable automatic downgrader for web content would strip all executable content and anything else it didn't understand, leaving only plain HTML and images. A manual downgrader for other stuff may also be available, depending on site policy. Its use might be restricted; in a DoD environment, only the security officer could run it. The point, though, is that this sort of thing is a rare event and requires special attention. The browser does not need enough privileges to do it independent of the user.
Letting the browser run player-type apps is OK, but they have to run in their own jails. This handles things like PDF, MP3, Flash, etc. But it prevents players from snooping around the local system and secretly sending info out to somewhere else.
Within a session, the browser can reply to cookies. Whether it's allowed to save them permanently is a separate issue. It's quite possible to have a browser that has no memory at all from session to session. You'd want this in a kiosk system, but not in other places. The right way to do this is to have a browser state downgrader that runs at browser exit or on user request. It examines new cookies and bookmarks and asks whether it's OK to save them. This is a trusted program, but a small one.
Note that none of the enforcement of these rules is in the browser. It's all in the mandatory security system that restricts what a process can do. The browser has to be modified to work under the restrictions. Again, the code in the browser isn't trusted. Only small, dumb programs with the absolute minimum functionality to do their job are ever trusted.
The trick is doing this without annoying the user too much. From this discussion, it looks like that's possible.
A good exercise would be to take NSA Linux and Mozilla and make them work under such restrictions. This might include managing the cache in a separate process with slightly different privileges. The cache manager needs to read and write the cache, but should never interpret the content. (Think of the cache as being managed by a built-in proxy server, while the main browser does no cacheing.) Configuration also needs to be done by a separate program and process, one that gets its input from the user, can't get input from the net, and can write the preferences files. This gets all the code that can write permanent files out of the main part of the browser.
Done this way, it doesn't matter if the browser code has security holes because the browser code is not trusted. The mandatory security protections of the OS prevent it from doing anything. This is the right way to do it, and the only one that will work.
Combine this new exploit with this old one that lets you read any file off someone's harddrive and I think Microsoft might be able to market these as .NET features.
-gerbik
I guess this is why I'm using Netscape, Mozilla, lynx and a few other non-M$ browsers. Umm... No, wait... It's because M$IE won't run on Linux.
Seriously though, I really don't remember any such exploits for Netscape, or the other browsers. I mean sure, there were (and are) web pages that would crash Netscape hard, but the worst case scenario was "killall -9 netscape" (or Ctrl+Alt+Del in Winblows) and that was it. It was only when the M$ crap took over the market that such things started happening...
I'm not even going to go into that subject, since the rant that would follow would take maybe... 2-3 years? I mean between MSIE, Outlook and all the other M$ Internet software, we've had pretty much an attack a day...
So this is hardly any news.
Better to use an operating system that has not had a remote hole in three years: OpenBSD. (That is, if you can tolerate it's slow-ass filesystem implementation.)
Will I retire or break 10K?
Shouldn't that read... (I.E., never!)?
People shape laws. Not the other way around.
The problem is that we cannot move on. There is no alternative. We have to use whatever Microsoft gives us and smile while they shaft us. IMHO that's what the anti-trust trial is really all about and not whether or not someone's ability to "innovate" is being stifled by goverment regulations. If their product was just so good that everyone chose it out of their free will, people would move on to competitors when something like this happens.
Netscape? Don't make me laugh. Mozilla? I like it, but it still crashes within 15 minutes.
I kinda figured this would at least warrent a critical update instead of some patches hidden away where my parrents will never find them.
I'd really like to moderate this up, as it's the nicest rant-counterrant exchange I've ever seen on /. Kudos to both of you. It's too bad that more posters don't act like this.
--
Never underestimate the relief of true separation of Religion and State.
Microsoft is developing a literal track record when it comes to security vulnerabilities
So does every one else. Go to securityfocus.com and you'll see that every Linux distro, SUN, HPUX, *BSD etc has a bad track record when it comes to security. This is not just a MS thing.
The security brief seems a little unclear... it seems like the vulnerability is e-mail related, but you can get it browsing websites? Is it IE using outlook, or outlook using ie that's the source of the problem?
--
SO YOU'RE GOING TO DIE: The Comic for Dealing with Death
The URL is http://www.microsoft.com/windows/ie/download/criti cal/q293818/default.asp and the page starts
Security Update, April 2, 2001
This update resolves the "Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard" security vulnerability,
Pardon me, but nobody is paying large amounts of money for Linux unless they want to. Microsoft demands large hunks of cash, so they should be held to a standard. Linux is free. It makes a difference
"I object to doing things that computers can do." -- Olin Shivers, lispers.org
Enlightened and Netscape are not two words I would associate with each other. Spectaclar crash and Netscape.... well there we are on more agreeable ground.
It's a worry, aint it? On one hand you have fairly common security holes, on the other you have usability issues. Browsers suck, no doubts about that.
"Old Rallydrivers never die - they just fail to book in on time"
But to be honest, a system is only as secure as the user or the admin sitting at it. Uneducated users are the most dangerous security hole there is. You can have the best security, the lest buggy code, but if you have a tool using the system you may as well go flush your hard worked over secuirty systems down the drain. Okay, that is expanding on the truth, but it's a frustration I feel every day.
I know we will see dozens of anti M$ bites, but really, who are we kidding? Security is not an easy thing and everyone gets it wrong at some point. I had a supposably secure Sun OS 0wnd by a script kiddie all because the damn admin wanted telnet open. What can you do if people wont take security seriously? I run a IIS webserver due to an app needing it and it has been attacked - it has stood up because I keep up with the lastest problems. You just have to do it.
You also have to realise security is tradeoff. I can guarenttee I could build you a Linux server so tight only the true elite would root it.... but how usuble will it be? Not very. The problem demonstrated here is that very tradeoff, MS wants usabliity, so do the unwashed masses. Makes it easy to exploit. Tighten it up and the unwashed wonder why they cant download their porn without some popup telling them that this download or link could be malicious and to proceed after the seven other warning they would get.
What's the solution in the end? Geeks like us educate the Great Unwashed maybe, I dont know. Certainly a different security paradigm than what Microsoft has.
"Old Rallydrivers never die - they just fail to book in on time"
Oh my god! How many more bugs do you think people will find in M$ software? I'm actually getting very tired of hearing about it!
Glen
Track your fuel economy
> OK. My apologies. :)
:-)
:-)
OK. Let's say I remove this comment about the placement of your head.
You know, I just commented on your first sentence, and I must admit nor having read the rest of your post. So much of intellectual honesty. You were such an easy target...
> I would go into a long rant here about my personal belief that unweildiness of Mozilla
That would be interesting. I find mozilla code awful, and beleive that the original sin was to make 'dynamic' code with C++. When I look at the code, I pity them, as they took great amount of pain to code in C++ things that would have been natural with Objective-C. Of course, I am biased on this
Cheers,
--fred
1 reply beneath your current threshold.
> first off, Creating something like BIND is infinitely more difficult than something like MSIE--
Gently put your head out of your ass. You obviously don't know what you are talking about. Bind is a two-banana hack compared to MSIE. MSIE have about the same complexity as Mozilla. Ever looked at mozilla source code ? Ever tried to build it ? Now take a look at BIND source code. Build it. Draw you conclusion in term of complexity.
A BIND bug is very serious because it can compromise huge segments of the network. But people that run BIND know what they are doing (or should know). And there are alternatives.
A MSIE bug is very serious because it can compromise a huge number of individual hosts. Furthermore, people don't choose to run MSIE, they have to, or they just don't know that they are running it. And you can't remove MSIE from a windows machine.
So, IMNSHO, a MSIE bug is more serious than a BIND bug.
Cheers,
--fred
1 reply beneath your current threshold.
Then again, it wasn't CmdrTaco who posted this, but we're making strides.
I'm impressed with the comments I've seen moderated up so far. Usually stories like this are flooded with comments like "Microsoft sux0rz, this is why Open Source is better!"
Isn't it funny that when a bug is discovered in Microsoft software, it's a victory for Open Source, and when a bug is discovered in Open Source software, it's a victory for Open Source?
NO CARRIER
Mitigating factors:
The vulnerability could not be exploited if File Downloads have been disabled in the Security Zone in which the e-mail is rendered. This is not a default setting in any zone, however.
[snip]
Would IE always execute the attachment?
No. IE would only execute the attachment if File Downloads were enabled in the Security Zone that the e-mail was opened in. However, File Downloads are enabled in all zones by default.
(email addr is at acm, not mca)
We are Number One. All others are Number Two, or lower.
(email addr is at acm, not mca)
We are Number One. All others are Number Two, or lower.
--The Sphinx
Or Kmeleon or Galeon.
Yes, yes, blame Microsoft, they are the reason that my friends from other countries are profiled on campus, they are the reason it rained today...
If anyone ever stopped to actually look into their "Internet options"(under Security, wow!) they woyuld realize that they can be as paranoid as they want and get every security message known to mankind if they wish, to only run signed scripts etc.
I am actually getting quite tired of the Slashdot mentality of blame the [big] company first, then look into the facts after. (How come no one bashes Sun? They don't take the time to invest in young developers... How come no one bashes IBM, well they are cool and all but don't you think that if Linux moves no where between now and the XP release that they'll not push it as hard?). This is what I do not understand, sorry I don't buy into group mentality.
Microsoft, like every other software company, Red Hat, blah, blah cannot find every bug in a release, heck, no software works exactly the way you want it to.
Come people, the found the bug and made a fix, lets start being a little more mature about this stuff.
It seems that the "patch" is just an install program, because it downloads a bunch of additional files from MS site (~8 MB depending on what you choose).
I work for a cost analysis company. We receive some of our data to be analysed by email. And we also need to keep copies of past email for legal purposes (disputes). We can't have Mozilla eating our mail because someone installed a theme it didn't like. Or destroying the whole .mozilla directory when I upgrade to a less buggy version. I just can't put my butt on the line and have Mozilla barf. I can handle having IE installed and blaming Microsoft for the problems. I assume this situation will swing when Mozilla stabalises...
________
Does anyone actually have a Java program designed to control air traffic, or for the operation of a nuclear facility?
...a user code execute arbitrary code...
This Im not worried about. Its when they start executing specific code that I become scared.
Netscape? Don't make me laugh. Mozilla? I like it, but it still crashes within 15 minutes.
Drop the FUD, I've been using Mozilla exclusively for months, if you grab a good nightly build off of mozillazine.org Mozilla almost never crashes. Actually, i can remember only twice in two weeks, and i run mozilla on My Linux box, my '98 box, my roomates '98 box, my girlfriends 2000 box, and my nt4 box at work.
got drum'n'bass?
http://mp3.com/vitriolix
Unfortunately, as linux use by the great unwashed masses grows, there will be more instances where the user presses the "server" button on the installation gui, thus exposing bind, ftpd, and everything else with a potential vulnerability.
-bluebomber
The Daily Build
I can work on it without having it crash on me over every damn thing. WINDOWS BLOWS any person who knows what there talking about knows that and linux works well while sun os's and unix blow everything away so stfu about windows being great you people dont know jack go change the screen saver i got work to do in my SECURE and STABLE os
Big Shocker!
This page left intentionally blank.
You could use a sandbox that allow the browser to access all web-browsing related data (e.g. SSL certificates etc.). You could also use some interfaces that allow the browser to escape the sandbox for certain operations like saving etc.
For example, the browser could only read its SSL certificates in its sandbox but another programme not running in the sandbox and does not trust the browser could accept SSL certificates or other data for saving only after the user chose to do so.
Claus
"Serious Security Flaw in MSIE 5.01, 5.5"
Flaw? Singular?
I, for one, am glad I'm aware of issues like this and can avoid it (Mozilla :) - it's frustrating to think of millions of others without so much as a clue the vunerability exists...
I wonder how long it will take the 5 squillion users running IE5.x to install that patch(let alone the 50 squillion running IE4.x) How quickly will coporate IT departments roll it out? Combined with Verisign accidently issuing Class 3 certs to some bloke with the common name "Microsoft Corporation" Microsoft must be just waiting for the class action suits to roll in.
I can't wait until .net comes. Think about it, I can just forget my windows passwords I keep in my head because they will be redundant
IT admins, go to brown alert...
if you run Windows you have no such choice. It is installed and it is running
So explain how come I read my email and browse the web from Windows without using OE and IE?
Hint: Lotus Notes and Opera.
--
Yeah but you are just making everything up. You are grasing at straws. Got any actual references?
Yours Sincerely, Michael.
In light of this feeble response to "Computer!", I'd like to take this opportunity to advise other readers not to post at 3AM after a night of substance (ab)use.
Understand I stand by what I originally wrote, but right now I can't motivate myself to defend my position.
Yours Sincerely, Michael.
You are delusional.
Windows has existed in its present forms for about five years.
I presume you are judging the OS by the GUI. Windows NT version 3.1 was released on July 17, 1993. The GUI was different, but the architecure was there, care of David Cutler.
That was the release date. Microsoft recruited David Cutler in 1988, well before Linus started.
Superior UI? Look at the quality of window managers. I'm sorry, but Sawfish, Window Maker and Enlightenment all kick Windows' butt when it comes to utility and control. And themability makes them look good too.
OO Architecture? Um, I think you'll find Gnome and KDE are riddled with OO.
Greater variety of hardware? NT had x86, Alpha, MIPS, even PowerPC, but they're all unsupported now. The free OS's easily wipe microsoft's peachy behind with their portability and the number of actual ports. All of those above plus loads more.
They've had the desktop market since the PC clone became popular. There wasn't a real desktop market before this. They didn't take that from anyone.
Yes, NT is taking share from Unix. But the free OS's, chiefly Linux, along with the rise of the Internet, is challenging this.
MSFT has perhaps produced a greater volume of useful code in five years than anyone else ever has
No, they just keep re-releasing the same code with new bells and whistles. The bulk of the code has been made by other companies, later bought up by MS.
Perhaps you can tell I do not like MS. I grew up with MS and I used to love their products. I still like the style of their early manuals (when you got them). But maturity and familiarity have given me perspective. I think you need some too.
Yours Sincerely, Michael.
The browser code isn't "integrated" into the system. It consists of a bunch of libraries that can be used by other applications. See Norton Systemworks, NeoPlanet and the like for apps that use the IE libraries.
- I don't care if they globalize against free speech. All my best free thoughts are done in my head.
I checked out
http://lists.nat.bg/~joro/webctrl2.html
and the date on the page was september 4th, 2000. why is this only getting publicity now?
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
Oh, and thanks to Microsoft innovation - you may remember this from the trial - the browser is integrated with the OS, [etc, etc]
That is inaccurate. It's thanks to an object oriented operating system that we have this problem. Ever heard of the term "reuse"? It's a feature, not a bug, that you can reuse components in various applications without having to rewrite them.
KDE would have exactly this flaw if the Konquerer component had this flaw and an e-mail reader used the component.
In short, I wish people would stop with the idiotic Microsoft bashing. All software has bugs. Let's fix it and move on.
--
Sometimes it's best to just let stupid people be stupid.
Special note of warning, the website has been more messed up than usual over the past few days, especially in trying to download the 5.01 sp2. I'm still trying to find the full package in one compressed file so that some folks can save the bandwidth.
My opinion: reports and pr to the contrary, the bit and piece auto install over the net is not more convenient. Especially when you have poeple mobbing sites for an update.
But if you are here reading this, you probably know this already.
Check out the Vinny the Vampire comic strip
"It is a greater offense to steal men's labor, than their clothes"
Nothing to see here, folks, move along ....
--
C'mon, baby, kiss The King.
I can't tell you how many people I've talked with, technical people mind you, who don't know that there's any browser besides IE.
You've talked to lots of technical people that aren't aware of Netscape?! Are these the "technical people" who clean the fry vats at McDonalds?
Now, I'm not saying that Netscape is a good browser, mind you... (I just can't believe a technical person hasn't heard of it)
I really really dig Opera, and you're right -- way more people need to give it a try. The bug reporting on their site is fine, but they would really be top-notch in my books if they'd let us browse their bug database.
I don't know what the big deal is here. This has happened to many other browsers before, including older versions of IE. With new standards, scripting and virtual machine technologies being implemented in browsers continually, it is expected. It is a simple browser vulnerability, and that is all.
This is not new, if you read Bugtraq, or even Georgi Guninski's page, you will see this and many other exploits are a common occurance in many browsers. Even browsers that handle only plain html like Lynx have been proven vulnerable at times.
Since IE3, many vulnerabilities like this have popped up in MS's browser. IE3 was far worse, as both the Windows and Macintosh platform could both be explotited in terrible ways. Also, we can't forget the famous Netscape Brown Orifice exploit, which Netscape admittedly couldn't even fix in their 4.x series of browsers. I'm sure there are some fine exploits waiting to be found in the lesser used browsers too, but they are just far less reviewed by the security community.
Now I don't think its right that such vulnerabilities exist, but bugs will always be present in software. Internet Explorer just happens to use a lot of mixed technologies and therefore there are more ways for it to be exploited. This is nothing more than someone exploiting a vulnerable version of BIND or RPC. The only difference I find here is that Microsoft is involved, and thus makes a good sensationalist Slashdot target.
The clash of honour calls, to stand when others fall.
so reading email from an attacker (opening attachments not necessary) also gives them full access to your machine.
... > set to "Restricted Sites" then click "custom level..." ... disable all scripting and active X shtuff.
Not everyone uses Outlook to read their email. If you do. Tools > Options.... > Security > Zone Settings
Poof, done. Now you should be safe.
Micrsoft made the Public Preview of IE6 available a few days ago. Does anyone know if it's affected by this bug? How is security shaping up for it so far? And speaking of new browser releases, Mozilla 0.8.1 has been out since Monday. New history, gopher support, theme uninstall (if only there were more themes to uninstall...)- works for me.
Sometimes I wish there was a moderation option -1 : Makes everyone read fixed width text but stupid enough to try HTML tags anyway
no sig.
Very very very true. When I used to work 8+ hours a day DirectX stuff on Win98, it was very uncommon for me to have to press the ol' reset button less than 2 or 3 times a day. It did not influence my demeanour in a very positive manner. But when bitching about how crap it is to some other people I'd often get replies along the lines of "jeez you must be doing something wrong because my PC doesn't crash nearly so much". Upon thinking about it, I realised that these people used their PC's only a few hours a day, and also did not run very intensive applications (e.g. a bit of word processing here and there, maybe some web browsing + email, some game playing etc). I've thankfully now shifted my development over to (almost) primarily Win2K. And what a pleasure it is. Win9X is dogshit, no doubt about it. "Pulsating screaming hatred" pretty much hits the nail on the head.
Well it seems if you are running Win2k with ie 5.55 you don't need this patch, at least thats what it tells me when i try to install it :)
If I can execute any code that I want, perhaps my windows applications will run? Correct?
Why can't Microsoft have signed this with a cert from its own CA, like it did with the patch for the the root store that fixed the compromised Verisign cert?
Really careful users should make sure to install the Verisign patch before installing the IE patch.
It's also funny that they tell you to run the IE patch by clicking it and choosing "run from current location", which can run code without checking signatures at all (though for this particular download, it lets you check the sig). That's probably how a lot of viruses and malicious code get spread in the first place.
I'm running IE 5.5 under w2000. I installed the patch and I can no longer download PDF files from my SSL-secured server. I can still download them through the non-SSL port. Can someone else try this?
On the other hand, running the browser in a jail does nothing to stop MITM attacks against web sites (do you really look at the SSL certificate every time you fill in a form?),
I'll believe it when I see it... I am joking...
What I find pathetic is that it's not listed (as of this reply) in the Windows Update "feature".... shouldn't it be in there? That's supposed to be the one stop location for my bug fixes and patches.... Grrrr.
text/html? 345% more seriously, does anyone have any idea what these "unusual" mime-types are? I have to see this for myself to believe it.
Thanks, but that's not the vulnerability the slashdot article was talking about. I meant the mime types one... what are the "unusual" mime types that cause IE so much grief?
I know I'm probably preaching to the converted considering that I'm posting these remarks on /. but so be it.
These security holes are just more proof that we, as informed users, need to not only use non-MS solutions (use Eudora for email; use Opera for browsing; etc. etc.) but we also need to let others know that there are alternatives to the security-hole-ridden stuff that Microsoft puts out. I can't tell you how many people I've talked with, technical people mind you, who don't know that there's any browser besides IE.
--
Onorio Catenacci
--
"And that's the world in a nutshell -- an appropriate receptacle."
--
"And that's the world in a nutshell -- an appropriate receptacle."
-- Stan Dunn
--
A feeling of having made the same mistake before: Deja Foobar
The current paradigm is, you must go out and see if there are security holes and procure the patches yourself. This is progress. Can't just blame M$, even IBM does this (I learned of the rlogin -froot bug by catching the culprit in the act, not by a bulletin from IBM, whee.)
Want to see which of the Linux are most popular?
--
A feeling of having made the same mistake before: Deja Foobar
--
A feeling of having made the same mistake before: Deja Foobar
The correct quote is "Great googly moogly". Watch out where the huskies go And don't you eat that yellow snow!
yeah, well i am 31337!!! i'm using IE 6!!!
no, wait...
end communication
This one belongs in the hall of fame!!
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
yeah baby, l33t uk h4x0r5 always say 0n3
comeontheni'lltakeyouallon
cos ther're all cunts innit
comeontheni'lltakeyouallon
I went to the MS webpage using my IE 5.01, since I need to get the patch... and suddenly a message popped up saying "BillG 0wNz Yu0!" and Windows Update started up. As I post this, it's upgrading my system into I know not what...
-Kasreyn
Kasreyn: Cheerfully playing the part of Devil's Advocate to hairtrigger
Well, I've already taken care of Javascript. But defeating HTML? I'm using an http proxy called the The Proxomitron, and it's a very useful tool... an http filtering proxy. I've noticed when Outlook is reading emails, this http proxy registers open connections. Does this mean it's filtering html emails?
Just curious to see if I'm already "safe" from this (ie., as safe as you can be running Windows), or whether I need work. IE 5.0, too - probably vulnerable to this, though MS just couldn't be *bothered* to mention on their page.
-Kasreyn
Kasreyn: Cheerfully playing the part of Devil's Advocate to hairtrigger
That's why they provide the upgrade to Service Pack 2 for FREE. Unfortunately, they can't go back to change earlier releases to implement this fix. That kind of violates the idea idea of having software versioning, now doesn't it? I guess the other alternative is for them to AUTOMAGICALLY update everyone's copy of IE. Would you prefer that? I think that them telling everybody that there IS a problem, and offering a fix for it is abot the best that they can do under this circumstance.
All your hard disk are belong to us.
Let's get drunk and delete production data!
server side authentication is used on many corporate networks which requires that users use MS IE or they won't be allowed to view content on the companies intranet.(IIS Server anyone?)
It's MORONIC of people to provide a web based information resource, tied into being viewed by one brand of browser only. BUT, because of the special MSF Microsoft Framework that's sold to many corporations, FEATURES exclude the use of Netscape.because it doesn't support the same type of security verification needed by the MS server used to turn Word Docs into Web Sites.
a few months back I saw an ad in a computer magazine touting the way to make your business run smooth using Microsofts Digital Nervous System.....
well it must be working because it makes me nervous.
what are these 'unusual MIME types' anyhow?
All I need to do is edit the MIME type of a malicious file and I have an exploit?
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
Oh youknow teh rest .. seriously though there appears to be no "critical update" on the Small'n'Squishy site. Have they done away with their fix?
--
Jon - TheSpork
Most /.ers are too smart for such a thing and their computer is the weak link but not so for the corporate user. I work in a high0tech company and you would be amazed at how many of our management would probably fall for something like that.
I do agree that user education should come first, including a brief introduction to social engineering threats. Otherwise a network will never be secure. Without education, OS is irrelevent because it is not at all the weak link...
That being said, Linux firewalls are some that I have always been very happy with.
LedgerSMB: Open source Accounting/ERP
http://www.kriptopolis.com/cua/eml.html You would think you people could surf in foreign languages.. but I guess not.
Fifty quatloos to the first person to set up a web site that people can go to that will use this "feature" to automatically run the patch install on their machines.
I object to that article, and to the next reply.
Heres a link to some demos of the exploit. (Just check out the source to see how they work)
http://www.kriptopolis.com/cua/eml.html
I couldnt actually get any of them to run on my machine, but they are by the guy who was given credit for finding the hole.
This exploit seems quite similar to the IE5.0 one a few years back. When viewing multipart HTML docs (.mhtml) IE would use the windows temp directory (not the temp internet files dir) to store any parts of the doc that were uuencoded. It was then trivial to access the files in this dir. So you could uuencode your nastyprog.exe and attach it to the end of a HTML doc, then use some activeX scripting or sunnit to run it.
That stuff was all patch a while back, but this new stuff seems to be able to run the code/script without it having to be stored on the disk.
The previous post was in error... I was reading this, and posted it as an answer to a different question. Sorry about that...
Black and grey are both shades of white.
Below is the link to the explaination of said hack, that includes 'source' et al.
m l
http://lists.nat.bg/~joro/webctrl2.html
and the URL from ZDNet that linked to it.
http://www.zdnet.co.uk/news/2000/35/ns-17763.ht
Demonstration is available at: http://www.nat.bg/~joro/webctrl1.html
Workaround: Disable Active Scripting
Black and grey are both shades of white.
So - is it just me, or did Microsoft, in its infinite wisdom, just make it possible for the "Good Times" virus to work as advertised -- in all of it's myriad variations!
Help find a cure for Gidget.
I opened up this story not because it affects me but because I wanted to read some good microsoft bashing by those who do it best. But rescently I'm finding more and more articles that are defending microsoft that I have to filter out. Ofcourse there are more than one point of view on microsoft but 1 or 2 pro microsoft comments per article is enough... not 5 or 6.
I went to the Windows Update page and though I am running MSIE5.01 SP1, it doesn't present me with the option to DL the SP2. I don't want MSIE5.5.
this is racist, sexist etc. language: dutch Does not compute with subject
I guess they aren't supporting the 6.0 beta. I see no patches for it. It'd be nice if they told us if it was affected or not...
Thanks for leaving your beta-ers out in the cold, MS.
Do you like German cars?
... a real Good Times Outlook Express-based virus. And it would spread fairly fast now that everyone thinks it's a hoax... :/
Do you like German cars?
There's a sufficient pattern of corrupt practices - and the purveying of endless patches and lucrative OS "upgrades" should be construed as an ongoing protection racket.
Let's close down the Redmond mob.
Whenever IE or Outlook or other Microsoft programs have this type of full security breach, they should exploit the problem to apply a patch :-).
csh: explorer: command not found
oops... I'm not on Windows...
April Fools is coming!@!
Macroshaft Security Bulletin (MS01-069)
Patch Available to Improve Packet Pigeon Performance
Originally Posted: October 22, 1999
Summary
MacroShaft has released a patch to ensure delivery of packets via Packet Pigeon birds. This is long overdue and is a must secure vulnerability on all MacroTrash products.
Frequently asked questions regarding this vulnerability will always be laughed at MacroShaft and AntiOffline
Issue
The Packet Pigeons used in large cities were sometimes affected by those in the geriatric stages of their lives, as these 60+ year olds fed Packet Pigeons en route to their destinations causing a denial of service.
Affected Software Versions
- MacroShaft Windoze NV 4.0 Crashstation
- MacroShaft Windoze NV 4.0 Server
- MacroShaft Windoze NV 4.0 Server, Enterprise Crash Edition
- MacroShaft Windoze NV 4.0 Server, Terminally Ill Edition
Patch Availabilityhttp://download.some.0-day.warez.com/at/some/othe
http://download.some.0-day.exe.files.com/else/whe
(NOTE: MacroShaft really cares about it luzers.)
More Information
Please see the following references for more information related to this issue.
http://www.MacroShaft.org/cgi-bin/display?=%2edev
http://www.antioffline.com/scriptkiddiesoup.html
Microsoft Insecurity Advisor web site, http://www.wiretrip.net
Obtaining Support on this Issue
This is a fully supported patch. Information on contacting MacroShaft Technical Support is available at http://support.macroshaft.and.all.of-its-h0es.com
Acknowledgments
MacroShaft acknowledges deran9ed/sil of AntiOffline for bringing this issue to our attention and we will up his p0rn quota to 2 gigs.
Revisions
THE INFORMATION PROVIDED IN THE MACROSHAFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MACROSHAFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, OR EVEN EXORTED INTO THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MACROSHAFT CORPORATION OR ITS WHORES BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES TO YOUR PORN DIRECTORIES NOR PACKET PIGEONS, AND POKEMON, EVEN IF MACROSHAFT CORPORATION OR ITS H0ES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. PEOPLE OF GERIATRIC AGE SHOULD HAVE THEIR LICENSES REVOKE AND THROWN INTO LABS TO SERVE AS LAB MICE. AND IF YOU ACTUALLY READ ALL OF THIS THEN YOU MUST BE AS BORED AS WE WERE. ANTIOFFLINE RESERVES THE EXCLUSIVE RIGHT TO POKE FUN AT YOU, WITHOUT INDEMNIFICATION, OR GRIEVANCE TO YOUR PATHETIC COMPLAINTS. SOMEONE SHOW ME WHERE THE CAPS LOCK KEY IS!@!
(c) 2001 AntiOffline Corporation. All rights stolen. Terms of Use.
You have received this e-mail bulletin as a result of your moronic use of our Products. You may unsubscribe from this e-mail notification service at any time by sending an e-mail to WE-PAY-NO-ATTENTION-TO-YOUR-MAIL@MACROSHAFT.ORG The subject line and message body are not used in processing the request, and can be anything you like.
For more information on the MacroShaft Security Notification Service please visit http://www.packetstorm.securify.com For security-related information. For MacroShaft products, please visit the MacroShaft web site at http://www.macroshaft.org/ more advisories like this can be found here
360 degrees of Karma
"Microsoft tested IE 5.01 and IE 5.5 to assess whether they are affected by this vulnerability. Previous versions are no longer supported and may or may not be affected by this vulnerability." You are on your own.
How about "it"? That would be grammatically correct, and some would argue gives the hacker the proper respect "it" deserves.
I'm haveing a deja-vu. Wasn't there a security flaw last week and the week before?
Microsoft is just one big security flaw. Or one big flaw for that matter...
well that means I have 20 computers to upgrade tomorrow, thank aplath thats only 20..
I'm a big retard who forgot to log out of Slashdot on Mike's computer! LOOK AT ME.
When will Microsoft finally realise that integrating their browser into their OSes is not a good idea until it can guarantee security (ie, never)?
The biggest threat to 99.99% of PCs isn't fire, theft or a badly written application but malicious code. And the number one method of delivery of malicious code is now the Internet. Email worms like the ILOVEYOU and Melissa attack via your email and vulnerabilities like this one attack via your browser. Giving applications like Outlook Express and Internet Explorer access other elements of the operating system is like posting the combination to your safe on your open front door.
Microsoft's browser/OS integration strategy was designed to protect it from accusations that it killed off Netscape unfairly - "gee, IE isn't an application, it's a core part of the OS" - but this has always been a poor defence for the company's actions. I mean, can you name any part of any OS that is available on a rival platform like IE is for the MacOS?
Given that Microsoft has all but lost its legal battles with the US government et al isn't it time it abandoned this browser/OS integration policy that only serves to make Windows more vulnerable to attack? Wouldn't such a move be in the best interests of its customers? Or would such a move be a bitter blow for "innovation"?
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
I don't think so.
MS always gave the code to OEM, and recently to anyone who buys 1500 2K licenses.
I don't think that giving the code for the NSA to review would be such a big problem.
Unless you suggest that the NSA wanted to use 9x, in which case, I can understand their big electrical bill, they have to keep three computers for each person, because two of them are always rebooting.
--
Two witches watched two watches.
Which witch watched which watch?
Netscape will execute arbitry code if you are viewing a picture!
e _a dvisory-590.html
http://www.linuxsecurity.com/advisories/mandrak
And more people are running IE5 than IE4.
--
Two witches watched two watches.
Which witch watched which watch?
What? You want to tell me that you don't know?
Didn't you know that MS make such fine products that whenever there is a (rarely) discovered bug, we must all raid Redmond and find out who did this?
After all, who will keep MS' high quality but us?
Imagine, for a second, a world where buggy OS are the norm, they are found on any desktop, and computers crashes are not something to stop you dead.
Do you think you could bear living in such a world?
--
Two witches watched two watches.
Which witch watched which watch?
Not really.
For an early beta, however, this is a good uptime.
--
Two witches watched two watches.
Which witch watched which watch?
It's somehow MS obligation to inform every user?
Okay, how do you suggest they would do this?
Oh, I know, how about posting a warning in their website.
You don't purpose that MS should phone or email every windows user, right?
If so, the first thing you should do is to give MS your phone or email adress.
They did what they should do, what more do you expect from them?
BTW, ordinary corporate user shouldn't, the IT stuff would.
--
Two witches watched two watches.
Which witch watched which watch?
But I think my MSIE4.0 in Russian doesn't run javascript anyway - the implimentation is so bad, I shouldn't have to worry about this, right?
Anyway, you get the idea. There SHOULD be a law, but until there is, no one should be using Microsoft for anything other than playing Counter-Strike, which thank God(tm) runs under NT.
I would think businesses would save more money by using Unix or Linux and simply training people to use WordStar...
Cheers!
Little White Mouse
-- Ctrl-e in Netscape for Windows does not move the cursor to the end of the line
-- Fun facts for Windows
The problem is in the way Microsoft renders HTML code, so if you have HTML-enabled e-mail (i.e., outlook express) you are exposed to the problem.
I loove the word "Hacktivismo" on their menu panel. Not exactly sure what it means, but it sure is fun to say ;-)
Maybe the bulletin was written by a woman. The advice my English teacher always used to give us whenever we needed to refer to some person in the singular was to use our own gender.
I'm doing my incompetent best.
Out of curiosity... It seems to me that most of the news I hear has to do with the discovery and nature of these holes, not present-time exploitation of them. If so, is it because of the quick release of patches, or are these flaws (however serious) largely ignored by the unscrupulous, or is coverage of actual attacks slim, or is it something else? And actually, this seems to apply for most computer security issues I hear about, viruses excepted (again, just an impression). (Yeah, this was sent with IE 5.5; tell it to the University of Iowa physics department IT staff.)
The coolest voice ever.
Yeah, but "they," "them" and "their" when referring to a single hax0r is grammatically |nc0rr3c7.
A second decade of excellence
It's a wonder *anyone* continues to use MSIE X.Anything. As a by-my-bootstraps network administrator, I have been very fortunate in avoiding MSIE (and Outlook, for that matter). Not the most enlightening post, but I gotta wonder.
Mmmmmm... Bold, yet refreshing!
The real problem with MSIE isn't a lack of open source, the browser/OS integration, or a weak security model ... ... it's that malicious executable code doesn't have its own MIME type!
application/x-trojan baby!
... it would make it that much easier for almost ANYONE to exploit this flaw on unsecured computers.
As it is, all you have to do is experiment with different types until you find one that works, and voila!
mod to -1;Tragic
I am not a lawyer but my sister is, so don't mess with me
Seems there was a lion stalking the net just last week :->
- sarcasm is just one more service we offer -
It actually surprises me that Linux advocates are often so narrow-minded that they cant even conceive of the possibility that some people (most home users, in fact) have very different priorities when it comes to choosing an OS. Its like the driver of a lorry deriding all those `stupid car drivers because their cars cant each carry a years supply of tomatoes.
I don't see what the big deal is. Ever notice that when linux has a hole exposed, or netscape has a problem, everyone says "yeah, well it's software, what do you expect?" but when Microsoft has a security hole found everyone is so quick to bash them? Yeah so what, so there's a security hole found... IE6.0 already has this problem fixed, and it's not that big a deal. I don't even use IE/outlook for my email anyways, so I don't care. I never have to worry about any problems, and anything I do use always has any sort of auto-execute options disabled. Simple precaution = no problems. I know that people seem to think that there is a daily quota for MS bashing, but I'm really getting tired of seeing this all the time. Maybe I should start to bash Linux whenever a problem is found there? Don't get me wrong, I use linux as well and have a great deal of respect for it and how far it's come since it began, but can we please stop the immature MS bashing at every opportunity that we get?
If God gave us curiosity
"yeah, you know I asked him about it last monday and he mumbled something about goat sex. I can't see any goats in that pic.."
"goats?! why can't he just use sheep like everybody else? some kinda pervert?"
"well anyway there wasn't any goats in that pic, that's for sure. let's tell admin to block any sites with the word 'goat'."
I dare you to use that pic as desktop wallpaper on your computer.
Preserve old classics: copy your collection onto all hard drives.
lawyers and non-warranty.
I sort of see your point, but I don't really agree. It doesn't matter that it is really part of the OS, you don't have to use it. Nothing is stopping you from using Netscape to browse the web. All Linux systems I've set up have sendmail installed, and sendmail is known for security issues. It doesn't matter that it's not part of the OS, it's still part of the distribution, which is very much like the same thing. You could with enough tweaking replace sendmail with qmail on your average Red Hat install and that would very much be the analog to using Netscape in place of IE.
But you also don't have to use MS email clients.
If you install Netwscape, you can use Netscape mail. Eudora might be inflicted with the problem though since I beleive that it hosts IE.
As far as the MS help system goes, it doesn't really matter if IE is used there. The help system isn't public and therefor it couldn't be used to expose a security flaw on the system.