Another Gaping Microsoft Security Hole Goes Unpatched

Newsbytes has a story about a critical vulnerability in all recent versions of Internet Explorer, which leaves your computer completely open any time you browse the web with IE. Microsoft has known about it since November 19; they refuse to provide any information about when a patch might be made available, if ever. This bug has been successfully handled by Microsoft's "Security through Obscurity" policies - since there's no public notice, Microsoft has no need to actually patch this hole which renders several hundred million computers vulnerable any time they access a web page or parse an HTML email.

For readers who care, this vulnerability results from Microsoft's integration of IE and the operating system. Files received via HTTP are supposed to be handled by examining the Content-Type header sent by the webserver - for instance, the Content-Type sent with this webpage is "text/html", identifying it as a text (non-binary) document which is marked up with HTML.

Netscape and most other browsers have no problem with this.

You will notice, however, that this method is rather different than how a Microsoft operating system determines how to handle a local file - by its three-letter extension. A file named "foo.txt" is handled as a text file, even if it is a binary image file that has been renamed for some reason.

Now, what happens when you integrate your web browser and your local browsing, say to render moot an anti-trust suit filed against your company? Will local files get a Content-Type? Will remote files be handled by examining their file extension?

IE handles files in an odd mish-mash of looking at the Content-Type sometimes for some purposes, looking at file extension sometimes for some purposes. It's hardly surprising that the bug-hunter in the above story has found a way to feed it a Content-Type at odds with the file extension - the Content-Type may be innocuous, but the extension says "execute me", so when the "integrated" IE engine gets ahold of it, the malicious content is automatically executed.

Now Microsoft has a problem. Because they chose to ignore the standard for handling downloaded files, Microsoft has painted themselves into a corner. If Microsoft suddenly changes how their browser handles downloaded files, tens of thousands (perhaps hundreds of thousands? any webpage which downloads files) of webpages "designed for IE" will have to be rewritten. No doubt this is the issue their programmers are wrestling with right now. It's a fundamental design issue - Microsoft designed their web browser with the goal of doing what was best for Microsoft (evading anti-trust charges) rather than doing what was best for their users. In fact a proper "fix" of this hole probably involves de-integrating their browser and local file handling to some extent.

If you routinely browse with Internet Explorer or read mail with Outlook, keep in mind that any web page you visit or any email you open can take over your computer, steal sensitive files, destroy your machine, anything. This has been true for at least two and half years. And keep in mind that you can't fix the problem, you must rely on Microsoft to do it, if they so choose. And keep in mind that Microsoft is in no hurry to do anything about it, because it doesn't even consider it a vulnerability. Happy browsing!

Comments

Unsafe at any speedy

[famazza]

This sounds to me just like the GM/Ford cases at the 60's about negleting consumers. Isn't time to DOJ put a period on all these things?

First that stupidity of Nimda IIS bug, that can't be fixed until next IIS release. And now this Security through obscurity crap?

Now I want to ask. "Where will M$ take us". I know where I want to go, but what about them?

Re:Guess What?

[mrseth]

Not exactly. Linux and Unix determine file type by magic number. Try renaming a postscript file (or whatever) as foo and type

file foo

and you'll see that it still returns the correct file type.

Hold on a sec . . .

[Selanit]

From the article:

"Microsoft will patch a flaw in its Web browser that could allow an attacker to silently download and execute malicious programs on the computers of users who view a specially constructed Web page or e-mail message." (emphasis added)

From the article's intro:

"Microsoft has known about it since November 19; they refuse to provide any information about when a patch might be made available, if ever."

Also: "And keep in mind that Microsoft is in no hurry to do anything about it . . ."

Full marks for a more thorough description of the exploit and how it came about -- but did the poster actually read the article before posting? Looks to me like he hit the original report but not the article, which says that MS did initially plan to let it go, but did an about-face after a while.

Nasty flaw nonetheless -- glad I switched to Mozilla.

A perspective

[Vicegrip]

The concern, from what I understand, is that a user might be lead to believe that "readme.txt" will be opened and viewed as a text file by IE. This, when in fact the website has placed executable binary/script data in the file and changed the appropriate response headers so that IE is fooled in to executing it as a program if it is 'opened'.

All the user sees as a prompt is "Open" or "Save Target As" using the menu options OR again "Open, Save, Cancel" by clicking on the link.

For an inexperienced user, the appropriate option will probably not be obvious. This is because many users have a lot of trouble navigating the file system to find files that have been saved by applications and enjoy the shortcut of having the windows decide how the file should be 'opened'.

I agree that an experienced user would never choose open because they know this is very risky. But, in my mother's case, she has trouble deciding when to click and doubleclick.

In Microsoft's defence, however, the "Open" option is never the default. Thus, it's probably safe to say that an ignorant user will almost always be safe from this attack as they will be picking the default and saving the file to the disk. At that point, "readme.txt" will cannot be executed and only openable from a text editor.

Anyways.. no matter how you look at it, this is a problem that fundamentally involves the act of downloading a file. Something even my mother knows not do by herself. This is not a security issue in the same magnitude as the worm viruses that plagued IIS.

Re:A perspective

[rseuhs]

All the user sees as a prompt is "Open" or "Save Target As" using the menu options OR again "Open, Save, Cancel" by clicking on the link.

For an inexperienced user, the appropriate option will probably not be obvious. This is because many users have a lot of trouble navigating the file system to find files that have been saved by applications and enjoy the shortcut of having the windows decide how the file should be 'opened'.

I agree that an experienced user would never choose open because they know this is very risky. But, in my mother's case, she has trouble deciding when to click and doubleclick.

I can't believe how fast every design flaw in IE/Outlook/Windows is becoming "the user's fault".

There is a lot of non-html content on the net and when I encounter a .pdf I press "open" without a second thought, I do it all the time.

Is it really asking too much that Internet Explorer and Outlook tell me the *real* file type? What's the big advantage in hiding file extensions and messed up concepts like this?

This is not just another bug, it is a DESIGN flaw.

Before you ask: No I don't use Outlook/IE and those security flaws are one of the reasons. I don't consider people stupid who were fooled by Outlook. (it was Outlook and not ILOVEYOU who made the users believe it was just a textfile. I don't consider a user stupid because he believed Outlook. You can't expect a newbie to know that you can't trust Microsoft's programs) But I do consider people stupid who recommend Outlook and Internet Explorer to newbies.

There are a lot of alternatives out there.

Intergating Web Browser and File Browser

[Tachys]

I notice many people complain about MS using the web browser and file browser as the same thing. But it seems everyone else is doing that too. KDE's Konqueror is a combined web/file browser. Nautilus also does this. If this is such a bad idea why is everyone doing this. The only desktop that I know of that doesn't try to do this is the Mac OS.

Re:Intergating Web Browser and File Browser

[babbage]

And with Apple's proposed adoption of file extensions as the standard filetype recogntion scheme, they'll be in the same boat as all the others anyway. The more I think about it, the more I realized what an interesting area file metadata & it's repurcussions is.

Stong metadata allows applications like Signwave FinderMail to exist (individual emails are stored as individual files, and handled in the Mac Finder like any other files, in folders and sorted by date and so on), and it was what BeOS was pushing hard & well with their advanced filesystem, and Microsoft may be copying in supposed plans to make their next generation filesystem out of SQL Server, rather than NTFS.

It seems like file extensions suck as a way of managing all this, and I think all the major vendors & open source development groups realize this, but it's a lowest common denominator that we're having a hard time shaking off.

And that brings me to my point and my question. Does this problem affect only the Windows versions of IE, or is it a problem on the Macintosh too. What is the proposed fix to this? Clearly it seems to be an architectual problem, but will the solution also be architectual? Will MS accelerate any efforts to move away from file extensions? (I doubt it, but you can always hope...). Will this discourage Apple from adopting them while deprecating what they've used in the past? I'd like to see how big the fallout of this could be, particularly if an nasty exploit crops up & there's no easy fix. Hmm...

Re:Let's see..

[DeadMeat (TM)]

Unless you combine it with the fact that IE is set up to automatically execute certain MIME types (like audio/x-wav). Send a message with an attached .EXE file, but hack up the message so the MIME type reads something else, and -- presto! -- instantly executing attachments. That's one of the attacks Nimda used.

parent is pandering

[buzzini]

This is a shameless pandering to the preconceptions of the Slashdot crowd. The statement that "Nobody is willing to do an honest cost accounting for the top guys" is simply not true, and it's an unfair dismissal of IE's very real successes in that space.

IT guys can and do choose other browsers. Last I heard, Navigator still had over 1/3 of the corporate browser market. Suggesting that IT folk would be cowed by the "top guys" flies in the face of every experience I've had with them: that they're pragmatic, honest, and outspoken.

Fire Michael

[EchoMirage]

Microsoft designed their web browser with the goal of doing what was best for Microsoft (evading anti-trust charges) rather than doing what was best for their users. In fact a proper "fix" of this hole probably involves de-integrating their browser and local file handling to some extent.

Hey Malda and VA Software executives, or whoever is in charge of keeping a minimal amount of decency on this site: why do you keep letting crap like this make the front page? This is not informative, insightful, or in any way useful. This is just a rant by a pissed-off bigot, pure and simple.

The vulnerability is real, but it is presented in such a hate-filled manner that it's unbearable to read. Michael has done nothing but spew venom in this posting. He's doing the right thing by bringing this to the attention of millions, but he does so with only malicious subtext to his main point.

This reads like a stream-of-conciousness scream from a 13-year-old who's just had his Nintendo taken away from him. This isn't journalism, it isn't even information, it's just garbage.

Please, do us all a favor: if Michael can't clean up his act and give us his material in at least a somewhat-presentable manner, fire him. You're losing respect for your site with postings like this. And no, this is not a troll, I'm serious.

Re:Fire Michael

[NatePWIII]

I would have to agree, with this one. I'm not so against the bias, everyone has their bias, especially /.'ers.

However, the information presented in this article is telling a lie whether it be through ignorance or just for sensationalism. Please, at least research and then present semi-true information before spreading it to thousands of others, it destroys the credibility of the site and underlying organization, namely Slashdot.

The last few weeks I have noticed the quality of Slashdot's postings has deteriorated. Alot of duplicate postings etc... I don't know maybe I'm just too critical... any thoughts along these lines?

The Internets Future?

[NatePWIII]

With all of the email viruses, internet borne viruses, worms, holes, DDOS attacks, it surprises me that anyone even uses the internet or related technologies at all. It will be a sad day when the whole idea of the internet is just "dumped" because of hackers (the bad kind), holes and bandwidth abuse. It seems like daily that I read through the articles on slashdot and find a new hole, exploit or virus that is being used or abused. Take for instance the recent decision to shut down the first IRC server, because of repeated DDOS attacks, that is truly a shame. As I have said often before, abuse it and lose it...

I agree!

[Ender Ryan]

Integrating the file browser and the Web browser is completely pointless, at least as far as any implementation of this fad had gone so far.

With both IE and Konqueror, you have a good web browser (excluding problems already mentioned with regards to IE...), and that web browser also acts as the file manager, except all that each is doing is mimicking what their predecessors did without providing any extra functionality that is inherent in a web browser.

Sure, IE has some neato wiz-bang "features", but it's ridiculous to claim that it adds anything to local file browsing that wasn't already provided by the previous program. Same goes for Konqueror.

Granted... they are both better file browsers than their predecessors, but that functionality is completely separate from web browsing and could be removed and used to create a totally separate file browser. There is absolutely nothing gained by integrating the two.

I would have agreed a week ago

[wirefarm]

Until one of my users got an email with an attachment that would just execute itself from the preview pane, no matter what the security settings were.

I sat there and toyed with it (yanked the LAN cable first) and absolutely could not get it to *NOT* run automatically.
(Her Outlook Express probably had been upgraded a month before, I think, but downloading the latest version *did* take care of the problem.

The real question is, why does Outlook support *any* of these behaviors? Sure, occasionally it's nice to HTML-ify an email and stick in a picture, but do I really need DHTML, scripting, cookies and all of that other crap?

When was the last time somebody had a legitimate reason for sending an embedded script in an email?
Oh, sure, let me have my personal emails set a cookie when they get read. Sure, I'm really going to do that.

Why not just have a really scaled-back HTML renderer that ignores tags that you choose to ignore?

Cheers,
Jim in Tokyo

FUD

[Wonko42]

Gee, michael, could you try and work in just a little more FUD? The exploit does require user intervention in order to execute malicious code. It pops up a dialog box asking if you want to open a file. The only security issue here is the fact that the name of the file can be changed by the malicious server. But regardless of what the fake name is, if the user clicks Cancel or Save To Disk, the exploit is thwarted.

Besides, it's not like Microsoft are the only folks who take forever to release patches.

Technical Term: Fnord

[Futurepower(tm)]

If the volunteers for OpenBSD can go through the software and eliminate security problems in advance, Microsoft, with 30 billion dollars in the bank, could also. Since Microsoft doesn't do this, maybe there is some reason. Maybe the U.S. government has dictated that they leave bugs in.

Software is only an operating system if it can be trusted. If it can't be trusted, there should be some other name, like fnord. Microsoft Fnord XP.

--
U.S. planned to attack Afghanistan before the second WTC bombing.

Re:Overreaction from Michael.

[OblongPlatypus]

There may very well be similar linux issues, but couldn't you have found better examples?

2) The Alan Cox changelog story isn't about security through obscurity, it's a silly political statement regarding the DMCA. And the other link is about Red Hat preemptively releasing a security advisory in an attempt to *avoid* obscurity.

3) The bug in this story is a *local* root hole, which doesn't even apply to most windows versions, and which certainly doesn't make for a relevant comparison in this case.

Re:Browser Wars..

[omega9]

Because it's part of the Windows OS. When grandma goes out to buy herself a nice Dell computer, it comes with Windows preinstalled, and hence has IE installed by default. She would have to take extra steps to download and install a different browser. But why, when IE seems perfectly fine, and it's integrated so nicely into the desktop? And it's hard to argue that. Think of the average home user that isn't as aware of these issues as we are.

A big part of the problem is that the clues aren't easy to spot for non-technical people. They can't see a problem in IE, as it seems to work just great. There are all these refined features to play with so it must be a solid product. And there are a whole heck of a lot of people who don't think IE is a browser, they think it is the browser. When they hear about holes like this they don't think that IE is broke, they think that someone has found out how to break into web browser (as in all web browsers). It would never cross their mind that IE is at fault. Try explaining how IE has issues with content type vs. file extensions to random people on the street. They just won't get it.

And this is where their monopoly comes into play again. They're such a huge, enormous company with a huge, enormous user base that they all turn into lemmings. If something happens to their IE, it will happen to their friends IE. Soon they start to see lots of people having trouble with IE. Then they stop relating the problem (if they ever did) to IE and start to think everyone is being affected by "the baddies who broke the internet". By the time Microsoft releases a patch user believe it to be a general problem that must be affecting everyone. Finally, since the issue has been disrelated with IE in their minds, why would they have any reason to look for a different browser?

it would be readme.exe - the crack is on extension

[leonbrooks]

RTFL

...which means that it would still be live even if saved to disk and clicked on. It may not be run with notepad, but odds are good that one way or another it will ruin notepad...

Re:How is giving advice unethical?

[autopr0n]

3. Believe the "It's legal to download ROMs if you delete them within 24 hours" type rumors that get spread around the internet by the legally ignorant.

It's legal to download ROMs and keep them for as long as you want, mp3s or any other copyrighted content as well. What you can't do is give them to other people (so the site you nabbed it off is breaking the law, disclaimer or no)

Slander?

[tacocat]

Let me say I will be one of the first to jump on the "I Hate Microsoft" wagons. But this article is just plain wrong, as in inaccurate.

The first paragraph of the referenced story talks about how they are currently in testing for this security hole. Whereas, the poster is stating that Microsoft has no specific designs on when this will ever get fixed.

Inaccurate, Fanatical Extremism like this is only going to hurt Open Source, Slashdot, and those associated with it. While Microsoft may be wrong in this case. It doesn't do us any good to exhibit poor sportsmanship. Leave that for the politicians

Re:Please, get it right

[foobar104]

I think it's even worse than that. Why should a web browser parse a URL at all, except as far as the "http://" (or whatever), server name, and the rest of the URL? Everything after the third slash gets passed to the server as a "GET" request anyway, so why parse it at all?

Re:Guess What?

[spongman]

Sure, but browsers don't use this mechanism to determin file type in the absence of a mime-type header. They all use a mapping from extensions to applications. Mozilla's is in the option dialog (I'm not sure where it's persisted), and IE's is in the registry.

Slashdot has changed....

[JMZero]

I don't know what agenda I'm trying to push. I work in a MS shop and my programming resume is very MS focused. I have a lot to lose if Linux catches on very far. I don't even have it installed on my home machine right now. I don't think you are stupid or that you're trying to tell fibbies.

What I'm saying is that Slashdot used to be nothing but nerds - the clear Linux focus meant that only a certain kind of people came around. Now it seems everyone comes around - and there's little focus. And as more of the general populous comes in, some of the old nerds (who said things that interested me) leave.

I think it's great that Slashdot is more balanced in its coverage of MS now. But its bad that I have to read through a lot more things I don't find interesting. Moderation has become very predictable - moderators waste their points on safe targets like obvious trolls and "long comments with lots of links that sound intelligent". Sometimes I think they're just trying to get by without being meta'ed down.

I'm not saying that non-Linux nerds are stupid. I'm just saying that the crowd that Slashdot used to attract said things that were more interesting to me.