Slashdot Mirror
Another Critical Microsoft Hole
gmuslera writes "Not was enough that recent vulnerability in IE that can run any program in an unpatched windows system. Now there is another
related to an ActiveX control that can make IE and IIS to run any code in the system. The Microsoft solution? kill the related ActiveX control and replace it with a safe one. The Microsoft problem? As this control is Microsoft signed, any site can require it, upload it and replace the "good" one with the vulnerable one. The final recomendation from Microsoft? Don't trust/run ActiveX controls signed by Microsoft." Gimble points to the appropriate locations on Microsoft's website: "Another buffer overrun (that allows arbitrary code to be run) has been admitted to by MS, and it affects IIS and IE on clients (but not on XP), and they have a patch available here Security Hotfix for Q329414. The kicker is that a patched system can be rendered vulnerable again by a hostile web site or HTML email. The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
"can make IE and IIS to run any code in the system"
Noooooo!
Minesweeper WON'T stop coming up!
--This girl at the library the other day
Why doesn't Microsoft wake up and just apply the "mozilla patch"? :^)
Slackware forever. Honestly, what else would you trust when it absolutely positively has to be stable, secure, and easy
``Don't trust Microsoft'' is just a good security principle in general. Finally they realize it. :-)
Hey, good thing that little bird told me to never check the box that says "Always trust content by Microsoft Corporation"
Doesn't this just make you excited for the prospect of Palladium and a world where all code is digitally signed? I'm tingling all over.
I'm all for code signing for authenticity, but not for code signing as execution control. Code signing should be purely an audit mechanism.
Not was enough that recent vulnerability in IE that can run any program in an unpatched windows system.
Difficult to read this post is, hmmm?
microsoft has never been a trusted partner in my mind....or on my computer
This must be the most utterly humiliating admission I have ever read. The fact that it comes in the context of a security problem beggars belief.
Reality is defined by the maddest person in the room
The final recomendation from Microsoft? Don't trust/run ActiveX controls signed by Microsoft.
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers.
Will Do!
Interestingly, that page doesn't render properly in Opera 7 Beta unless you identify as MSIE - when it works fine.
Can we please stop all this MS bashing? Every piece of software has security alerts and patches issued. Why, in a week where we have alerts for Samba, php, kde (libs and network) and apache, do we have to hear about IE yet again? Yes, we know thats its not a secure bit of software. It just makes us look like insecure teenagers if we keep bashing it like this.
*flame retardent jacket on*
That is all.
They keep attaining hole records all the time. It just makes me wonder.
---
When you come to a fork in the road, take it! --Yogi Berra--
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
Am I the only one who finds this uproariously funny...?
Micro$oft wants us not to trust it. Not that this will be a problem in many cases, but... Maybe if we applied this more generally the world would be a nicer and safer place?
"Now listen to me very closely, because I have the answer for your problems. The way to fix your troubles is to not trust me..."
Catch-22, eh? The company that's giving you the solution is also telling to that they're not to be trusted. I don't care WHAT company that comes from, it's funny...
Why can't IE run in a process with reduced privaliges? Why does IE need the privalages of the current user on NT/2000 when all it does is browse the web?
Wow. Some heads must be rolling at Microsoft over this. Recommending that Microsoft be removed from the list of trusted signees? They're certainly not pulling punches on this one. It looks to me like they're placing a higher priority (with the treatment of this bug) on user security than company image. That's a first...
The reason they're in this mess is the whole "trusted computing" paradigm which they started with this signed-ActiveX stuff and are continuing with Palladium. Perhaps this will make them reconsider. Quis custodiet ipsos custodes: Who watches the watchers?
I never though I would see Microsoft telling us NOT to check the box:
"Always trust content from Microsoft Corporation"
I guess with the next version of IE they will be changing it to:
"Never trust content from Microsoft Corporation"
Now that's the kind of checkbox I'm talking about.
-S
We Apprentice Developers and Designers
Slashdot reports on pretty much anything security related. Besides this is not a little problem it's something that is pretty damn serious if you ask me.
All you linux freaks should pay attention - here is Microsoft issuing some very timely and correct advice.
"Don't trust us"
Once more unto the breach, dear friends, once more, Or close the wall up with our American dead!
As this control is Microsoft signed...
Trusted computing, digital signing... I guess it all boils down to "You can trust Microsoft that this signed control will screw over your computer."
Outdoor digital photography, mostly in New Engl
Reproduced for your enjoyment:
What steps could I follow to prevent the control from being silently re-introduced onto my system?
The simplest way is to make sure you have no trusted publishers, including Microsoft. If you do that, any attempt by either a web page or an HTML mail to download an ActiveX control will generate a warning message. Here's how to empty the Trusted Publishers list:
1. In Internet Explorer, choose Tools, then Internet Options.
2. Select the Content tab. In the Certificates section of the page, click on Publishers.
3. In the Certificates dialog, click on the Trusted Publishers tab.
4. For each certificate in the list, click on the certificate and then select Remove. Confirm that you want to remove the entry.
5. When you've removed all entries from the list, select Close to close the Certificates dialog, then click on OK to close the Internet Options dialog.
"The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
That is solid GOLD.
It is poetic justice that Microsoft's own measures for security are working against them.
(/local/home/curiosity)-#who -u|grep thecat|cut -c 44-49|xargs kill -9
Already done, a long long time ago........
I didn't want them running anything they happened to sign on my PC.
Ok, I don't run windows at home any more, unless I need it for reverse engineering drivers or file formats.
thank God the internet isn't a human right.
If my Linux box wasn't kept up to date, there would be quite a few remote root exploits similar to this.
From the article:
What steps could I follow to prevent the control from being silently re-introduced onto my system?
The simplest way is to make sure you have no trusted publishers, including Microsoft.
Today the DOJ announced that they would no longer trust Microsoft and had removed Microsoft from the list of companies it would allow to police themselves. This was done on Microsoft's advice as they felt they could not be trusted not to screw around like they had before.
"Lets face it" said Bill Gates "asking us to police ourselves is like asking Dan Quayle to front a literacy program, its just not a good idea"
An Eye for an Eye will make the whole world blind - Gandhi
Right about now, Bill Gates is asking himself why in the world he paid millions for that "security approval" thing for Windows 2000 and wasted all of those marketing dollars in the over-hyped (and non-existent) "we make all of our programmers go to security school or something" campaign.
If Microsoft tells users not to trust it for this, when should users trust it?
The joke is to say never. But with Microsoft controlling however many trillions of computers, it seems like something they should seriously be addressing. And more seriously than they are.
I also don't trust software i write, why should MS do different? I mean you can't say elseway " The programmer was a moron" and keep the pride
Lone Gunmen crew.
Because if you don't bring these problems out into the open, Microsoft won't fix them. There have been several cases in the past where security vulnerabilities were left unpatched until people started clamoring for a fix. Also, this hole is rather severe (if a similar hole was found in SSH or Apache Slashdot would announce it) and the fact that it is digitally signed makes it unusual and newsworthy.
I read the internet for the articles.
The real pain is that people that have used Windows Update often will have checked "Always trust content from Microsoft", otherwise they will have RSI by now from clicking Yes.
I didn't beleve this was true at first but this is actually what it says in the Security Bulletin:
--
What steps could I follow to prevent the control from being silently re-introduced onto my system?
The simplest way is to make sure you have no trusted publishers, including Microsoft.
--
According to the MSTECH bulletin:
Why isn't it feasible to set the Kill Bit in this case?
The ActiveX control involved in these vulnerabilities is used in many applications and web pages to access data. Many applications, including third-party applications, contain hard-coded references to it; if the patch set the Kill Bit, the web pages would no longer function at all - even with the new, corrected version. As a result, the patch updates the control to remove the vulnerabilities, but does not provide a brand-new control and set the Kill Bit on the old one.
Conclusion:
-Microsoft refuses to kill itself.
how does this relate to: the story Microsoft on Security: We'll Break Your Apps
Hey... linus refused to change the behaviour of kill -9 -1 also
Because there are still quite a few of us
who still use Windows...
I've got half a dozen software packages that
are currently only available for Windows or
Mac, and as I don't like Macs, I'm stuck
with Windows for the time being.
This kind of story is "News for Nerds", and
as such, is, IMO, much more valid a story than
most that get posted here.
And as far as the Open Source comment; yes,
Open Source systems have bugs. However, I
don't know of a single one that will have a
website pop-up ask you to download a major
security hole under the name of trusted
computing.
Do you?
I like you, Stuart. You're not like everyone else, here, at Slashdot.
but I think Microsoft is doing the right thing here. They are in a pickle and they have given a good solution (and one that is embarrasing to them). Of course what they should really do is redesign IE to not run in "root" mode but that is another story. I wish the slashdot editors did not relish so much the foibles of Microsoft in their editorial comments.
I miss the Karma Whores.
...that the only safe place to run a Microsoft browser is on an Apple Computer operating system.
How is it that they implemented a cryptographic signature system and don't provide for revocation? Surely somebody's missed something here...
25% Funny, 25% Insightful, 25% Informative, 25% Troll
People don't move to something because, firstly it's something different and many people are happy to stick with something comfortable. Secondly many people don't see the point in downloading something that they already have installed ("it works for me, why do I need anything else?" mentality) and finally, for many people they never experience the nasty possible ill-effects of these security alerts.
Sure, plenty of people were hit by Code Red but it never really affected them. Sure it affected their computer, but as far as their documents were concerned - there was no change.
Until we see a security alert that does cause damage to personal files and does roam rampant in the wild, the average Joe Blow user doesn't give a toss whether or not there 6 or 6000 security alerts.
Avantslash - View Slashdot cleanly on your mobile phone.
Probably because a lot of us are sysadmins with companies stuck with Windows, and with this sort of news, we can take steps to protect our computer systems from MS-induced death, including convincing the PHBs to switch to Linux. ;-)
Also, Windows is more popular, so this sort of thing affects more people, especially clueless ones, the ones we need to educate to switch to Opera (ohokay, Mozilla then)
What time is it/will be over there? Check with my iPhone app!
I'm no M$ fan, but I deal with it at work so I make a point at figuring out how to deal with the problems. Frankly, this isn't a suprise. The most well secured enterprises I've seen allow only internal ActiveX publishers -- ActiveX is just too hard to make safe.
.NET Framework Security -- anyway, it seems like Microsoft is at least attempting to solve this particular problem. And, their approach isn't completely idiotic. Really.
.NET common language runtime (read: M$ JVM) is controlled by a fairly sophisticated access control system. The default policy in XPsp1 from M$ allows no code from the Internet to execute, at all. Not exactly what I want as a user, but its what I want as an admin...
.NET mobile code without also enabling ActiveX controls. Not sure what the issue there is, but I suspect the CLR loader is some sort of ActiveX control. Anyone know about that?
.NET: Enforce Code Access Rights... .NET Framework
Looking forward, I recently picked up
Mobile code that runs in the
Frustratingly, you can't run
Anyway... here's some additional links to M$ references on mobile code:
Security in
Security in the
"He wrested the world's whereabouts from the heavens And locked the secret in a pocketwatch." - Dava Sobel
The problem is that unless you remove Microsoft from the list of trusted publishers, a malicious web site or e-mail message can reinstall the vulnerable version without your knowledge or consent.
To me, this proves that digitally signed code, that is, "trusted systems" are absolutely no guarantee of security. Bad code can be signed.
The solution is to upgrade to Windows XP because it doesn't have this problem. This is the best news Microsoft has had in years!
Doesn't anyone consider this a mysterly convenient way to incourage the masses of windows users who won't drop them to move over to XP? All the news sources highlight that XP isn't vunerable.. yeah.. not with THIS flaw. I wondered how long it would be before they started admitting the really bad flaws in all the other versions to move everyone towards their .net mordern os. hmph
or maybe I'm just nervous 'cause my coffee just accidently cross bred with a poison-ivy staph-infection vaccine GE plant and was recalled after I drank it
pm
** "It's not my job to stand between the people talking to me, and the ones listening to me." -- Pego the Jerk
Here's a URL for you, even...
MDAC 2.7 Refresh
Keeping Windows secure is hard, but it's easier if you install the recent components...
According to the MS release, the reason that they can't simply revoke the certificate for the control is that they signed other controls with the same certificate.
Wouldn't it make sense for them to just sign every control with a DIFFERENT certificate, so when one is found to be flawed they can revoke the cert and only the new version will install easily?
It's not like MS can't afford the cost of the individual certs, if they aren't a CA themselves already...
I thought we were all critical Microsoft 'holes.
Oh.... I misread it....
J.
This space for rent.
So Microsoft says to not trust them. Ok, I will not trust. But then I don't believe in this request. So I should trust MS. Ok, I'll trust'em. But then the request is true, and I should not trust...
Prescriptive grammar:linguistics
Sure there is.
Bigger issue: If 'trusted' sources can be shown to turn out untrustable code (like the Active X control in this case), there isn't much use in trusting them in the frist place.
Its cute tho; 'trustworthy' computing from Microsoft involves not trusting them. I don't see how you could possibly not find that funny unless you were employed by MS.
"Old man yells at systemd"
While researching the article linked below, I developed the impression that Microsoft has for years allowed its programmers to submit sloppy code. Now bugs are not easily found or fixed because everything is a mess.
Windows XP Shows the Direction Microsoft is Going.
Here's a theory I've long held regarding the excessive number of buffer overrun security holes in MS software:
The lack of an snprintf method in the DevStudio standard C lib causes MS developers to use the unbounded sprintf instead, potentially resulting in buffer overruns.
What do you think?
I'm interested in seeing any other browser that can provide robust, arbitrary plug-in support without a security compromise.
Security and utility are two contestants in a zero-sum game.
Which is not to say that <insert browser here> isn't a technically superior product...
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
From MS02-065:
So, who want to bet that the e-mails we will soon see circulating will have something like:
From: billg@microsoft.com
Subject: You can safely trust me
<html><body> Please read this e-mail carefully and make sure you download the provided control.
Asking people to decide whether or not they trust somebody based on, uh, well, whatever, that's asking for disaster. People will do that based on what they see in the From-field, most likely...
Well, admittedly, I haven't touched a windows machine in a long time, so I might be totally off here... :-)
Employee of Inrupt, Project Release Manager and Community Manager for Solid
...you could run it on Solaris too.
Somewhere in the heavens... they are waiting.
I don't know if I'm karma whoring, but this last security hole gives me the creeps. In all honestly, I kinda ignored them up until now -- I don't know why, but I think it was because "they" could not delete my data (nothing scares me more than losing my documents (read: not "My Documents"). This security hole that allows people to "format my hard disk" (quote from the original /. article that I cannot be bothered to find) has me burning My Documents to CD-RW which I'm going to (finally) migrate to my Linux laptop which I previously used only for programming.
I know we've seen a million security problems from MS before, but this one (for me at least) is the last straw.
best... article... ever
Intelligent Life on Earth
Why are these things posted here? Is it because of the many /. users that use windows :-), or is it because we're always trying to make windows look bad?
I guess the same reason that...
Security Vulnerabilities in KDE 2.1-3.0.4, 3.1 RC3
Trojan Found in libpcap and tcpdump
Bind 4 and 8 Vulnerabilities
and
Vulnerability In Linksys Cable/DSL Router
were posted?
i.e. this particular article would have been posted were it about windows, redhat, solaris or pretty much any other "widly used" system
. . .or is it because we're always trying to make windows look bad??
You know, I don't think that's fair. The slashdot community dogs out everything they think is controlled by 'the man'. Just look at how much BIND and sendmail get bashed. Granted, these things have proven to be significantly less problematic.
3cx.org - A truly bad website.
1. Yes, a lot of Slashdotters use Windows. I am using it right now. I have to, because that is what is mandated where I work. I am sure that is the case for many other people. I am sure some of the admins have to administer Windows systems. Basically, we are stuck with Windows, so we need to know this information. At home, on the other hand, I only boot up the Windows machine if I need a Quake fix.
2. We don't have to make Windows look bad, it is doing a fine job of doing that itself, thank you very much. Slashdot didn't release this alert, Microsoft did. Would you rather not know about it?
My beliefs do not require that you agree with them.
The folks that are out there converting people to free software are the people that read slashdot. Keeping the slashdot crowd informed of the latest security holes in Windows, Microsoft's most recent snafu, and the best new open source project allows Slashdot readers to spead the word more effectivly. New information and new arguments are key.
Perhaps it's the same exploits mentioned in the linked Slashdot article, and in that case pardon my ignorance. If not, I haven't seen these nine security holes talked about at too many places. Why I don't know. They are certainly vicious.
However, I am getting a little tired at all the MS bashing on Slashdot. It has been said before, but do we really need to have a story posted each time an Outlook/Explorer security breach, no matter how insignificant, is made public?
"If you think education is expensive, try ignorance" - Derek Bok
If this doesn't affect XP, why can't Microsoft just issue a patch that installs the Windows XP components which aren't vulnerable? And also... why the hell isn't XP vulnerable? maybe they knew about this for a long time...
I've acually thought that MS would buy out Connectix just as a bargaining chip against Jobs (apple).
OT - Why would Connectix *not* make a Virtual PC for Linux? Do they have a deal with MS? It seems to me that they could rake in the dough, hand over fist.
Virtual PC is great for 'trying out' untrusted software. It's too bad that Windows itself now fits that catagory. Run with it Bill!
Since probably a million people submitted this, maybe we could pick the post that actually doesn't read like an entry from the Yoda diaries?
brain hurt make!
Apologies if the poster suffers from dysphasia.
I am not a number! I am a man! And don't you
"The simplest way is to make sure you have no trusted publishers, including Microsoft."
So OK. If this signed certificates thing was a good idea to begin with, why are they suggesting people remove ALL trusted publishers?
It's only Microsoft's own certificate that can reintroduce the problem. Why would they advise removing all certificates?
Is it because they think their users are too stupid to remove Microsoft only? Are they trying to look less bad by making it look like the problem effects all publishers? Or are they simply admitting that this signed certificate thing isn't working?
Oh, if we can't run anything we want on your system, nobody else should either. pfft.
oktay
---------------
Founder of the The Free Linux CD Project
Because in a recent /. story there is reference to a recent /. poll which shows 47% of those who responded still use a Windows operating system.
/. users use Windows.
/.
Nearly half of
This would seem to validate the need to have stories about Microsoft software bugs, especially those as grevious as this, on
Current Microsoft story on CNN Tech news:
"Microsoft innovates"
With a nice little sponsered by, Microsoft icon right under the headline. That is why..
Hello, today when browsing the site, I found an error (probably typographical) on the site. I would appreciate it if you could correct this: The story "Another Critical Microsoft Hole" should be reposted under the "It's Funny. Laugh." category. Thank you for your time.
It's getting tiring to see all this sarcasm, like open source is so free of bugs or something.
Sarcasm directed at success can be quite healthy for those who wish to motivate themselves to compete against and surpass that success - and to make sure that they do not repeat the mistakes of that success.
1. Open Control Panel.
2. Select Add/Remove programs.
3. Select Microsoft Internet Explorer.
4. Select Add/Remove...
5. Download Mozilla.
6. Run the mozilla installer.
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
It's because a lot of slashdot users (47%) still use windows.
Were the public to follow their suggestion, this would be a big deal. They would basically have deprecated ActiveX controls as a dynamic content strategy (you can use what you have, but you won't get any more). You could argue that this has been done for them over the last year or so, but this is the first time I've seen them admit it.
However you look at it, having a bug that causes even a temporary strategy change is big news, regardless of how you feel about MS.
It's all Eolas' fault :)
http://www.mozilla.org
What we have here is a clear case of people letting their ideology interfere with their business sense. Ideology / religion seems to be the only reason anyone would not go right over to better products like Opera or Mozilla. The only value MSIE can add, beside keeping the AV and security consultants in gravy, is vendor lock in.
Microsoft is falling further behind in technology every month. Rather than trying to catch up, they've been trying to hold everyone else back. It's time for them to get out of the way and stop hindering economic growth in the IT sector.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Interesting- seems like they're telling you to remove all certificates, not just those from Microsoft.
-- If god wanted me to have a sig, he'd have given me a sense of humor.
I don't think the question revolves around whether open-source or closed-source is better or worse. Honestly, they both have their pros and cons. As for this issue, ActiveX Controls were a good way (way back when) to get a rich feature set onto a web-browser. But eventually it was realized you needed some security around this, so they started to digitally sign them, now it seems this might have a hiccup in this logic as well. So what's the real answer? How do I get a rich feature set to the web without running anything local (the most secure way)? When you really start to understand the challenge you understand how difficult the problem is. Think about it: people who don't download ActiveX controls also are the same people who download MODs to their favorite games and those dlls don't have to play in a small sandbox! I think people are accustomed to lots of snazzle with their web pages and we, as technical folks, should find a way to do that securely. Good luck.
"This isn't a study in computer science, its a study in human behavior"
Yes.
Why all the focus on microsoft products, I submitted an exploit for opera a month or so ago, and it was rejected.
autopr0n is like, down and stuff.
Aberdeen Research Group has this to say about open source and Linux security:
Open Source and Linux: 2002 Poster Children for Security Problems
November 12, 2002
Open source software is now the major source of elevated security vulnerabilities for IT buyers. Security advisories from Cert for the first 10 months of 2002 show that open source and Linux software accounted for more than half of all advisories. The poster child for security glitches is no longer Microsoft; this label now belongs to open source and Linux software suppliers.
Read more here
Some of column A and some of column B.
/. reader (which is different from the average /. poster), when reading from work, is probably using a Windows box. Sure, in certain fields, the likelyhood of a /. reader not using a Windows box rises dramatically, but let's stick with the "common perception".
/. posting on the sheer wonders of "insert your distro here" brand of Linux is going to change that overnight. Therefore, news about yet another "gaping hole" in Windows, especially in the "browser that cannot be separated", is going to be news.
Okay, let's face it. The average
And in that "common perception", Windows has one hell of a large chunk of market share. No amount of
Also, who doesn't like seeing the big dog getting taken down a peg? It's "American" nature to root for the underdog, and that means wishing all kinds of nasty things to happen to the big dog. It just so happens that Microsoft does so many things to shoot themselves in the foot, or at least wing themselves, according to the editors here.
And no, Open Source is not free of bugs. But you know what? It sure seems to have a damn sight less, and they seem to get fixed faster.
Kierthos
Mr. Hu is not a ninja.
ok, so Microsoft says "You can't trust us".
Anybody see that this resembles the following situation:
"I am a pathological liar,
Everything I say is a lie,
you can trust me on this."
Now what are ya gonna believe??
Re enable the runas service (it's on by default). Now try right clicking an exe with the shift button held down. See that "Run As..." menu item? Click it, now the program will run with alternate use privledge. Welcome to NT... What I want to know is why 99% of the fscking setup programs need to run as admin to install simple little applets into my user context..
What better way for the US Gov to get some spyware into all M$ installations, than to have M$ issue a major warning like this. I'm sure they're considering using M$'s monopoly to exploit eavesdropping on some of Al Qaeda's employees.
--note to self--
Consider buying stock in proposed Hades Ski and Ice Skating resort... it must be getting real cold down there about now, somewhere between slushy and completely frozen over.
...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
I've read that critique of Dilbert before and it is utter crap.
I've also read "The Dilbert Principle" by Scott Adams as well. It is an insightful and honest book about business.
What the author criticizing Dilbert does is say that by stating and exaggerating some of the bad things business does, he is condoning them. What a load of crap.
As for Microsoft, there are actions that they have taken that I do not like. But I have to use Microsoft products at work and have to know a lot about them. It doesn't mean that I can't also totally disagree with their licensing schemes. And while it may not seem like a big deal to you, my decision at work is whether to let users run Active X controls or not. There are big implications here, this story is absolutely not trivial and Microsoft made a major screw up in allowing this security hole to exist in this particular product in the first place.
It's not about anger, it's about vigilance and fairness. I may run Linux, but - like many here I imagine - I'm also the de facto Windows Support guy for family members and non-technical friends. So I want/need to stay informed of severe Microsoft vulnerabilities.
To tell you the truth, it's been a while since I've no longer needed stories such as these to convince me that Linux is more secure than Windows...there's no "anger" left (I don't thing there ever was - outrage and disdain, yes, but no anger), just a desire to be informed so that I can better protect my windows-using loved ones...
Reminder: find a new sig
Actually, it's "micros~1". First six characters, tilde, then number to allow it to fit with in the "8" of the 8.3 file format.
</NIGGLE>
BD Phone Home!
Shameless plug. Like you weren't expecting it.
So, to fix this particular little problem needs a hardware replacement "upgrade" :-(
Microsoft has warned about a security hole in Notepad. While Microsoft prepares a fix, it advises that we all use EDLIN in the mean time.
I'll feed the troll. The issue is for users of IE, not IIS admins. Every single person who runs Internet Explorer is vulnerable. How many of those do you suppose keep up with security advisories? Even if they use the Windows Update system, how many of them do you suppose will read advisories and clear their trusted providers list?
So many MS supporters think Slashdot readers are hostile to them. It never seems to occur to them that there might be valid reasons for the climate out there.
Reasonable for a home computer is to do nothing, actually. I'll probably get railed for saying this, but for most people, security isn't really that big of a deal. They pick shitty passwords, leave tons of security holes open, don't bother patching, and don't even know what they're doing is unsafe.
Granted, this vulnerability is considered critical, but few people will ever encounter it. Someone has to hit upon one of these malicious sites with IE after having trusted Microsoft by default and must have MDAC 2.7 (comes with Windows XP, I believe). The chances of this are very low.
You asked what you would do for your mother's PC and I would say do nothing. My dad browses all the time, but he pretty much sticks to the same big-name sites, reads the news, keeps up on a few messageboards, and sends email. I'm not going to give him a confusing list of things to worry about -- I'd be calling him every day for things to watch out for, trojans to be wary of, and websites to avoid. Most people won't encounter the problem, so I'm fairly comfortable with not having to panic about it and call everyone I know.
Which is funny, because the Slashdot article keeps citing "IIS." Maybe someone forgot to edit the "canned microsoft submission.txt" file before submitting the story.
(...)
"The simplest way is to make sure you have no
trusted publishers, including Microsoft. If you do
that, any attempt by either a web page or an HTML
mail to download an ActiveX control will generate a warning message."
(...)
We could use this idea also with SPAM. Why use Bayesian filters (that aren't still 100% safe)? We could open every single message and decide if it is SPAM or not. If it is SPAM we can then delete it... it's easy!!
This message doesn't need a signature
This message doesn't need a sig
From the MS Technet article:
Q: Why would an attacker be able to silently re-introduce the old version of the control? Shouldn't there be a warning message?
A: A warning message is generated anytime there's an error associated with a digital signature (e.g., a bad signature or expired certificate) or the signer isn't trusted. But in this case, the digital signature on the old version of the control is still valid, and the signer is Microsoft - which is a trusted publisher in many cases. Because of this, most users would not see a warning message of any kind if the old control was re-introduced.
Ha! Microsoft is now providing very well written ammunition to the Anti-DRM movement; this makes me very happy.
$8.95/mo web hosting
Trusted Computing FAQ | Free Dawit Isaak!
did you read the EULA?
...."
You just sold your soul! 1 d (e)"indemnify, hold harmless, and defend Microsoft from and against any claims or lawsuits, including attorneys' fees, that arise or result from
Didn't I recently see on the front page an article about unpatched Apache servers? Wasn't this Apache OpenSSL Worm article on the front page last month?
Hmm...
I just got a prompt to update to Windows Update V4, signed by Microsoft. Should I trust this???
There is really no need to have Microsoft be a trusted publisher of ActiveX controls. The "complete fix" for this problem, removing Microsoft from the trusted publisher list, is a standard part of securing IE.
Left shift 1 for e-mail...
Linux users know all about their bugs. They are the ones fixing them. Bugs in proprietary software are more interesting/important because they acknowledge commercial vendors inability to get working code out the door before profiting from it, a despicable but almost always necessary evil (if you're commercial and proprietary, that is).
1. Get an idea for useful softwaree
2. Write a lot of working but buggy code
3. ??????
4. Profit
Then later when you can rest assured that the investors or collectors are happy...
5. Fix bugs
And if you're a monopoly...
6. Release bug-free "Upgrade" and charge more money.
A fool throws a stone into a well and a thousand sages can not remove it.
Cause I am lazy. :-)
Seriously, because I haven't been able to get my scroll mouse to work under Redhat 7.3. I have tried to get imwheel to work, but it just doesn't. I need my wheel when I play Quake (I play the old Team Fortress, not that fancy-pants new one). I have a zoom cfg file that uses the wheel mouse to variable zoom. Quite handy.
Ahh, what the heck - here is where you can get my my zoom cfg file...
SuperflyTNT's Quake Page
My beliefs do not require that you agree with them.
So this is news because it blows the doors off the signed executable philosphy and makes the sandbox philosohy of the java VM look like the only viable approach. Notice that the JAVA approach would have avoided both problems. first it would have avoided the buffer overrun problem in the first place since that would be caught by the VM when it examined the code, and second there would be no signed app trustworthyness issue.
Some drink at the fountain of knowledge. Others just gargle.
Agree, but you only had one little error. In this particular flaw, you don't get a pop-up. It downloads automatically and silently. You have no idea that you have been penetrated.
Hmm. Reading the above sentance, I just KNOW some karma whore is gonna make some comment about "penetration" and "MS"... Sigh.
Yeah, I know, you shouldn't be using JET anymore, but sometimes it's the hand (or product) you're dealt.
What a pain...
whereas almost all windows boxes have IE installed
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
wheeeeeeeep
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
so it's a huge piece of news
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
this one
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Opera isn't running on 90% of all computers out there. I'm not even sure that Opera is running on 10% of all computers out there.
Opera could have a big gaping security hole, but the impact is still going to be marginal because of the (relatively) small size of the installed base.
Wasn't that the rationale for the existence of "certification authorities"? If one must make one's decision about trusting a software or not based upon the site where it seems to be, then there is no need at all for security certificates. Speaking for myself, if it says "Signed by Microsoft", I don't trust it at all, no matter if it was in a cracks site or not.
Watcha gonna do when something like this happens, and the airtight MS security system is burned into your hardware?
Comforting thought, huh?
I'm sorry, but it doesn't appear that anyone read the freaking article.
From the MS TechNet article:
* Customers using Windows XP, or who have installed MDAC 2.7 on their systems are at no risk and do not need to take any action.
* Web server administrators who are running an affected version of MDAC should either install the patch, disable MDAC and/or RDS, or upgrade to MDAC 2.7, which is not affected by the vulnerability.
The "fix" to this vulnerability is installing MDAC 2.7 which is available on all versions of Windows back to 98.
Other than the fact that this is the 50,000th security patch that I have to install on all my machines, what's the big deal?
"Anyway, long story short... is a phrase whose origins are complicated and rambling...." - Abraham Simpson
So whos scanners should we avoid? (my money is on UMAX as the culprit).
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
Why doesn't Microsoft wake up and just apply the "mozilla patch"?
Seriously? Because this would work against the goal of creating a seperate Microsoft Internet that requires Microsoft platforms to run on. The enticement to lock yourself in is the additional features. Like a narcotic. It's the easy solution. No more pain. Surprise, you're addicted. Installing Mozilla takes you a step in the wrong direction. The direction of being more platform neutral and standards compliant. From this standpoint it would be better to keep you off of Mozilla and just do whatever embarrasing thing is necessary to fix IE.
I'll see your senator, and I'll raise you two judges.
I really like that the mainstream press is using "yet another" here. Think about your neighborhood: if somebody down the street gets burglarized, it's a terrible thing, but it's an isolated incident, and in a couple of days, you'll unload the shotgun and soundly again. But when two houses a week get broken into, well, you're gonna start acting like there's a pattern here.
What will happen when people start treating Microsoft's security lapses like the epidemic they are?
This is not my sandwich.
have you not noticed that virtually _all_ of the Mac exploits ever published involve IE and/or Outlook?
I refuse to put Office X on my system, and only use IE to verify why a poorly coded page won't display in Mozilla or OmniWeb
The problem is not that Slashdot is picking and choosing bug reports in an attempt to make M$FT look bad. They're reporting bugs from all the "major" OSs. The problem is the bias in the reporting and by the upwards modded comentators. Take this example from the article (and the note which it closes on):
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
NO! The 'solution' from Microsoft is that you just patch your MDAC to include the component from 2.7 or that you just update your MDAC to 2.7
For Christ's sake people, if this were a *nix bug, you'd all be beating your "we know how to update our machines" drum complaining that only stupid Windows users don't use updates.
Or perhaps it would be the "at least fixes are available immediately for *nix" argument. MDAC 2.7 isn't new, kids.
Just report the bug, and report the CORRECT fix.
You disagree with me. Mod me down.
Does Windows Update require signed ActiveX controls?
If so, I presume the default action would be to trust Microsoft controls? Will this mean that the majority of users will be exposed to this problem?
Evil Space Scientist: You win this time, Kirk. But I'll be back. Mua ha ha ha ha!
I've not seen anyone actually state it here, but I can confirm that the most recent IE cumulative patch that came out this morning does indeed patch that rather nasty hole reported earlier this week. I now get a lovely "Permission Denied" Javascript error...
:)
Now.. Seeing that Microsoft got off their butt and fixed the hole in just a few days, what does this have to say about releasing the exploit publicly?
Actually, nix that... the flame war was way too long last time..
see my sig.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
The thing is, I don't have the time to implement Linux,
What do you mean, implement it?!! It virtually installs itself! Head off to some mirror, and burn some Redhat 8.0 ISOs to CD, and stop using lame excuses.
Get your own free personal location tracker
I like UT for all out fragging, but I really like the old Team Fortress for the gameplay. Half-life was OK for this too, but it seems a little refined for my tastes. Kind of like driving a new sports car vs an older one - the older ones have a certain raw charm about them. Plus, I like the modding that has been done for TF, and I even created my own map. Fun stuff.
My beliefs do not require that you agree with them.
This exploit should be known if they have fixed it in XP as another reader stated. Are Microsoft hiding vulns until they are found by others to keep the numbers on bygtraq etc. down? Heck, i understand them if they have a hard time getting less vulnerabilities than the biggest linux dists, together and with some vulns counted multiple times. Not to mention that a typical linux dist includes a couple of thousand applications more than windows.
I have a hunch that Microsoft is actively trying to downplay vulnerabilities. They probably knows about many more than they tell just to keep their numbers down.
The audit that took place at the launch of their Trusted Computer initiative hasnt made any impact. It hasnt resulted in new bugs found in any significant number. I would think that it points towards:
a) They did a crappy job and didnt find any new bugs.
b) Windows hasn't got any more vulns left (not bloody likely)
c) They found a bunch but to release them would show that windows is a schwiss cheese of code so they only aknowledge the ones found by outsiders. They hope they go unoticed until Net is ready.
Personally i vote for c since they should have found a bunch if they really did audit the code.
HTTP/1.1 400
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
Trustworthy Computing!
Yeah, sure... And then they recommend to be removed from the trustworthy list...
The basic idea of signing code sounds quite good until you look at it deeper. There is no guarantee that signed==good. This is an excellent example where the signed one is actually worse. Now imagine if palladium was in there, refusing to accept a patch, or cheerfully undoing any attempt to fix the system, with NO way to fix it (you would no longer be able to say "I don't trust MicroSoft").
If you think only MicroSoft does such mistakes, I seem to remember there was a design error in the new Linux capabilities where it was possible to throw away the capability of *changing* your capabilities. If a bug happened to throw this away, and then your program tried to drop capabilities (and then ignored the error return, because that would be assummed to work always) and then execute untrusted code, the code would execute at full capabilities! Suddenly a system being advertised as a big improvement in security has turned into a worse liability!
I'm afraid that there are a lot of problems like this that are going to bite people. When you start to work on security you better know exactly what you are doing and plan ahead, and write a lot of real appliations, and assumme that there could be a mistake *anywhere*.
Why does Java not qualify for that?
I suppose you can define robust and arbitrary in a way that makes Java an answer. Furthermore, I've seen demos of teleconferencing/whiteboard software under Java with a 56K dial-up pipe, given righteous data compression.
Yet, Java applets are not overtaking all browsers in sight. Begs the potentially trollish question: is Java the new Betamax?, or is it just Mr. Softy playing monopoly?, or is it something else?
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Well, gang, we did it: we slashdotted Microsoft! Windows Update is reporting "Service Unavailable" when I try to update my boxen here at work. Yay, Slashdot!
Moderate drunk! It's more fun that way!
Uh, ok, stupid question.. but can't MS just revoke the signature on the compromised applet? If not, why not? Does that mean that anything MS signs, is signed for life? What about 3rd party software/drivers? What if there is a backdoor or some other hidden malicious code?
"Hot lesbian witches! It's fucking genius!"
From the recommendation page:
...
Who could exploit the vulnerability?
* Web client. A user could exploit the vulnerability against a web client if he or she were able to construct a web page that would send an appropriate HTTP command, and then convince a user to open it. Typically, this would be done by either hosting the page on a web site that the attacker controlled or sending it directly to users as an HTML mail.
Also:
A warning message is generated anytime there's an error associated with a digital signature (e.g., a bad signature or expired certificate) or the signer isn't trusted. But in this case, the digital signature on the old version of the control is still valid, and the signer is Microsoft - which is a trusted publisher in many cases. Because of this, most users would not see a warning message of any kind if the old control was re-introduced.
HTTP commands are the method for exploiting this vulnerability. By default, IE trusts MS. I must use HTTP commands to visit the MS site and thereby learn not to trust MS (as advised). But in doing so, I accepted anything that may be malicious, before I knew exactly how not to.
From this point of view, it seems to be more of a Catch-22. But then, in that scenario, MS would host the malicious server, which would be horrible PR and therefore improbable.
One last thing, AFAIK it's the "Paradox of the Lie" and not the "Liar's Paradox", since the classic example is a statement (Like: "This statement is false" or my sig: "This is not my sig."), and does not refer to a person or liar. I lost points on a philosophy paper for just that reason. Pissed me off enough that I still remember it today.
This is not my sig.
I don't get it. If there is a bug in this ActiveX control by Microsoft, why do you have remove certificates of all other Trusted Publishers?
-------
Warning: Slashdot may contain traces of nuts.
How did it got there? This list is empty on clean install. To be able to remove something from "trusted publishers", you have to add it to this list first.
So you clicked "trust Microsoft" link to be able to remove it later. Are you sadomasochist? ;)
MSDOS: 20+ years without remote hole in the default install
Actually, I think more realistically, this would mean that Windows Mozilla would become the next hot bugtraq item. Mozilla running on Windows is not the same as Mozilla running on any other OS. Mozilla is guilty of using Windows-specific stuff too (like the JavaScript interpreter).
While that would be better for Mozilla (more bugs would be found faster, and there would be more incentive to become as homogenous across platforms as possible), I'm not sure it if would help Windows users all that much because by default Windows users are at or near the equivalent of root users. Windows is a security-week OS. Granted, integrating something like a web browser so tightly with the OS doesn't help, but the problem is still that regular Joe user is still allowed to do a lot of damage on his own with little or no checks and balances. Don't get me wrong. I don't like Windows, and I choose to run Linux on my desktop, but Microsoft-related security problems go a lot deaper than just IE.
Personally, I'm not sure there's a way around this problem. Attackers are smart and well-informed. Not being fooled into running bad stuff requires knowledge, a healthy dose of skepticism, and vigilance. The problem with Microsoft software in general is that it makes it trivial for the ignorant user to run bad stuff. If all the buffer overflow and security wholes were fixed tomorrow, it still wouldn't stop companies from developing spyware, nor would it stop attackers from using social engineering to find ways into systems. This plagues even the non-MS world (look at the recent compromises in OpenSSL and sendmail).
Here's an anology: Imagine that I was a "car cracker", and I devised a way to sneak into gas stations and replace their fuel with sugar water. NO ONE would notice until their cars stopped running and their engines siezed. Why? Who smells or tastes or tests gasoline from the pump before it goes into their car? The only real thing stopping someone from actually doing something like this is the logistics of cracking a gas station's fuel supply. As a result, people have a reasonable (and yes, in this case it is reasonable) amount of trust in what's coming out of the pump (even if it is gas-ohol).
However, it's much easier in the world of easily-reproducable flying bits to do something very similar. There's a much smaller barrier there. Now users really should smell/taste/test their gasoline before they put it into their car. The only problem is, just like with the car analogy, there's little to no tools available to make that process available to the common consumer. What's worse is that even if they were, the common consumer is so lazy, they probably wouldn't take advantage of them unless they were forced to.
No, I am not an advocate of DRM. I hate the stuff. If anyone ever tells me I can't use my computer the way I want, I'll kill 'em (metaphorically...I don't wish actual physical harm to befall anyone...it's not my place to judge and dispense punishment). My point is that Windows has a very long way to go before these types of problems will become manageable again, with or without Internet Explorer.
In a lot of situations, installing software is less like putting gas in your car and more like buying 50 kilos of cocaine. In that scenario the buyer doesn't trust that the seller hasn't cut the dope. As a result he has the tools (guns and methods of determining drug purity) to help ensure the transaction goes smoothly.
Okay, maybe that analogy doesn't work either, but I think you get my point.
moto411.com
At home, on the other hand, I only boot up the Windows machine if I need a Quake fix
If you'd bothered to look, id have had a Linux binary for q1,2 &3 for ages.
also Return to Castle Wolfenstein
The 'no games run on linux' argument is dead.
If only a few more games houses would follow id's example...
Total Annihilation on linux would make me happy....
Burma?
No, the article is wrong... the issue is IE not IIS-related.
"Scott Adams entrenches himself deeply in corporate culture and has commercialized every aspect of his creative existence, by making fun of the very environment in which he thrives."
Nice bit of irony. More power to him.
It would be a bit hard for him to make fun of the corporate culture if he were *not* deeply entrenched in it.
It sounds like the same one that runs on every other Mozilla platform.
If that were true, then the behavior of the following would be the same across platforms:
document.forms.FORMNAME;
document.forms["FORMNAME"];
Note: the first statement works in all versions of IE that support JavaScript on both the WIndows and Mac OS X platforms. The first statement doesn't work in any version of Mozilla except the Windows versions. Several conclusions might be drawn from this:
- The Mozilla JavaScript interpreter is different for its Windows binaries
- Mozilla running on Windows is borrowing the built-in JavaScript interpreter
- The Windows loader/linker (or equivalent) is forcing Mozilla to use the wrong JavaScript interpreter (though this is pretty unlikely)
If someone knows/finds out, please let me know. I'm dying to find out.moto411.com