Slashdot Mirror
Microsoft Issues Five New Security Warnings
smelroy writes "Microsoft on Wednesday issued security bulletins for five new software vulnerabilities, including a flaw in Visual Basic for Applications that the company rated as critical. The company has posted patches for each of the flaws on its Web site. Four of the problems affect Microsoft's Office desktop software.
You can read the story here and the security bulletins here."
i'm having this funny feeling of deja vu...
Confused me because I couldn't figure out why Microsoft was releasing bug reports for openoffice. (Aside from the obvious conspiracy theory that Microsoft would be trying to make the competition look bad)
There comes to a point where you just can't patch things anymore, and it's time to start over new. And, hopefully get it right this time!
Same old sh*t, different day. Other than alerting admins who really should know this is there a reason for having it on the front page?
wouldn't ANY vba flaw be critical. if i recall correctly, through vba, you can manipulate the entire file system. while it doesn't give you low level access, it has access to every COM object on your system. in fact, weren't the code red and i love you virii (and many others) written in VBA. VBA seems to be such a big reason that businesses can't move away from windows/office. to me, it seems like a reason TO move away from office.
My problem? I was perfectly gruntled, until some numbnuts came by and dissed me.
...without either e-mail from RedHat about a bug or news from MS about one. Lucky me, today I have both.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
1.SuSE
2.Red Hat
3.Mandrake
4.Debian
5.Gentoo
Crap! That means I have to touch every machine in the enterprise--again! Just two weeks after "touching 'em all" (not in the baseball sense) from the last round of worm patches.
How I long for the old days of Novell... Ah...take me away!
Who did what now?
I thought Visual Basic was a flaw!
"Some things have to be believed to be seen." - Ralph Hodgson
I remember in HS I could own any mac in school that had office installed on it. At that time office had a find file program built in with the added "feature" that it could move files around once you found them. The security program on the macs of course disabled apples find file and locked certain folders so you couldnt delete programs. Office bypassed all that. All you had to do was find and move the security programs preference file to the trash and restart the computer. The password would be reset to the default password, which I happened to know (admin:admin is pretty easy) Voila, Office as a hacking tool. And it was a feature of office!
"This looks like another story to laugh and mock MS. In reality, it is you zealots that look like mormons."
That doesn't make any sense. A Linux zealot can't even get a date, let alone several wives!
How are you going to keep them down on the farm once they've seen Karl Hungus?
It doesn't make any sense for a company to keep building something that requires a patch every few days. Are they actually making money off of these patches?
It's just that I've never heard of anything so blatantly broken that is so successful.
Maybe I'm just angry because some scumware got into my computer system.
in girum imus nocte et consumimur igni
When we get more like 50 of these a week, then we'll know that they've really gotten serious. Large systems have a lot of holes in them -- especially when no one was plugging the holes for oh, 10 years or so.
stuff |
My tinfoil cap has 2 pennies.
"Learning is not compulsory... neither is survival."
--Dr.W.Edwards Deming
Flaws in Visual BASIC are documented right here
Stick Men
[29 Aug 2003] DSA-375 node - buffer overflow, format string
[26 Aug 2003] DSA-374 libpam-smb - buffer overflow
[26 Aug 2003] DSA-344 unzip - directory traversal (new revision)
[18 Aug 2003] DSA-364 man-db - buffer overflows, arbitrary command execution (new revision)
[16 Aug 2003] DSA-373 autorespond - buffer overflow
[16 Aug 2003] DSA-372 netris - buffer overflow
[13 Aug 2003] DSA-358 linux-kernel-2.4.18 - several vulnerabilities (new revision)
[11 Aug 2003] DSA-371 perl - cross-site scripting
[09 Aug 2003] DSA-361 kdelibs, kdelibs-crypto - several vulnerabilities (new revision)
[08 Aug 2003] DSA-370 pam-pgsql - format string
[08 Aug 2003] DSA-369 zblast - buffer overflow
[08 Aug 2003] DSA-368 xpcd - buffer overflow
[08 Aug 2003] DSA-367 xtokkaetama - buffer overflow
Stop calling the kettle black! Fix your own problems. This stuff wouldn't happen if Debian didn't use out of date software, as most of the flaws mentioned were fixed in the new versions!
What's the big deal here? Microsoft finds a flaw, issues the patches, get coverage from slashdot.
Things that happen all the time with unix/linux OS and apps.
Don't be mistaken, i ain't pro-Microsoft. I just think that slashdot is often bashing MS products for no reason. Their ideology is bad. The world domination plan is bad. But i'm tired of "hardcore" unix/C fanatics that dismisses
Whining and moaning everytime they issue a security warning is just plain childish...oh wait this is slashdot
I hope this wins some more business and government contracts for non-Windows based systems.
Windows is ok for some applications. But this sort of thing (actually a whole month of bad security press) should jar a lot of decision makers to recognize that MS is not the ONLY REAL OS OUT THERE, as there marketing strategy has led all non-tech inclined business execs to beleive.
The Truth will set you free.
Slashdot Syndrome: the sudden, extreme urge to correct someone in order to validate one's self.
Welcome to the family, WS2K3!
... but we should really be debating how we get this right on an OSS platform. If I put RedHat9 next to Windows Server 2003 I have significantly more updates to apply to my Linux box.
This is a community of smart people, the race is on to figure out how to best solve this issue for our end users. Microsoft appears to be beating us by requiring far less updates to be applied than a randomly chosed Linux distro.
We need to think about the process of distribution and application of these patches, if we can get that right then we get a larger percentage of the desktop.
Today any undereducated end user who is judging security by the number of patches that jumps to a Linux distro because they've "heard" it is more secure will quickly be jumping back to Windows.
your box is only as secure as the person administering it.
and apparently, windows users, left to their own devices don't know, or don't care about keeping up to date on security patches.
although, when enough of them are willing to just go ahead and doubleclick on any attachment from an unknown sender (msblast), these kinda exploits aren't really even necessary.
all the tools for a secure windows box are already there.
(though a security-patch-only windowsupdate flavor would be very helpful).
// "Can't clowns and pirates just -try- to get along?"
didn't make "our products will not kill customers and burn down buildings" one of it's "top priorities"
think- where we would be then?
every day http://en.wikipedia.org/wiki/Special:Random
I'm in a mixed environment where we have some Dells that came with Small Business Edition (either SR1 or original), and other users who needed Access that we purchased Office 2000 Pro for. Because Microsoft requires the original CD, it really adds to the burden of updating because you have to figure out which friggin' disc to use on each individual station. If they would just let us run the damn patch without the CD verification it would be easier.
.
Plus, their order of updates is fux0r3d. They have the spell checker update listed as more recent than SP2, but when I run it I get an error message that the update only runs on SP1
It's bad enough to need so many patches, but there are many basic things like the above that Microsoft could easily improve.
...is anyone surprised? /. anymore. We know MS writes buggy and vulnerable software.
I'm not even sure this belongs on
Of course, MS isn't the only company to write such buggy software. But before anyone says a word about MS being bashed too much, let's remember that 95% statistic. When a company's software runs on approximately 95% of the world's computers, they have the moral responsibility to ensure its stability before they release it.
We could always blame sysadmins for being too stupid to check for and install updates, but instead, why don't we just educate people on why they should run Windows Update every week (or sooner).
I'd think billions of dollars in damages to the economy would be enough to get executives cracking the whip at their IT staff. Then again, I also thought Bush lost the election.
Good troll, but try coming back with an analysis of the actual severity of the holes.
I better hurry to run off and patch a hole in some obscure OSS app I don't have installed as opposed to the constant REMOTE ROOT EXPLOITS in the core Microsoft OS.
Quick quiz, hot shot Troll: Here are the first 5 vulnerabilities from that list:
atari800, gallery, eroaster, mindi, phpwebsite,
Now, how many of those are "linux" (i.e. the linux kernel, shell and important utilities.) None.
How many are remotely exploitable? None.
Given the user base of those 5 obscure programs, how many would *you* rate as critical?
Perhaps comparing all the security vulnerabilities for all software that could possibly run on Windows to this list would be SLIGHTLY more fair.
As it stands now you are comparing all open source applications to the Windows Oerating System.
So good job on attempting to call the Slashdot community on hyprocracy, unfortunatly you seem to be very confused about what Linux is and unable to make a valid comparison.
Finkployd
I just thought of something - what do companies like Dell do? They just sell the stock OS on their systems, right? Everyone always complains that people don't patch their systems, but what if you buy a new machine from Dell? I am sure people don't think "oh man, I have a new system, I need to go out and figure out which patches to install". They fire it up and go. Should OEMs be required to sell systems that are up to date on the OS patches?
My beliefs do not require that you agree with them.
While I've just about managed to educate friends and familly about the need to run Windows Update, WU does not in itself warn of critical security issues - you have to remember to visit Office Update manually... and who is going to do that? No one, in my experience.
but it gets better - The Office Security updates require you to insert the original CD. This seems a mighty strange move, and not terribly useful for me since the CD is several thousand miles away locked up in a cupboard on the other side of the Atlantic.
Can anyone explain the warped logic here? I could understand it if the new patches enabled new functionality? but these are security patches.
- Black hats knew about the vulnerability before Microsoft
- Widespread attacks come some days after Microsoft finally get know of it, but don't releases any advise of the danger because they had no patch ready, so it took final users by surprise.
With linux at least you could have the warning even before the patch (like one of the latest apache vulnerabilities) so you can take measures before the patch is ready/tested/approved/signed/whatever.Criticality of this is horribly underrated by Microsoft.
.DOC extension, Word will be invoked directly when the user double-clicks the attachment. Word will automatically recognize and convert the document, and run the hostile code with no further opportunity for the user to stop the virus.
This is critically important for all Windows MS Office users - "the user must open the attachment" is no protection because most users open attachments to see what they are.
If the infected Word Perfect document is given a
The vulnerability could also be exploited through a web page, and the user would get no chance to say "No" if ActiveX is enabled.
That's funny.. last time there were security vulns I read about them on 3 different news sites and I didn't have to do a thing because my system updated itself.
It is the distro's job to make sure you are protected when a new exploit is discovered just as it's Microsoft's job when the problem is in windows. Also, if you think anyone accepts accountability for the problem in windows land you may want to read through the EULA again because it sure isn't MS.
Linux distros get bashed just as much over this and some of us actually avoid the distros with overly bad security records.
You also need to keep in mind that there is less downtime involved when upgrading Linux systems. My Linux servers are all fully upgraded but have not been shutdown in months. Window? 4 patches 3 reboots.. yuck
I'm sure this will get modded down, or ignored by the moderators all together, as off topic; but I feel it's a good camparison. I have two, relatively similar, workstations. One running Red Hat 9 and the other WinXP. I use RH Up2Date on the Linux bawx and Windows Update on the XP machine religiously. The observation that I have made are pretty amazing. Microsoft releases roughly 4 patches for every 1 that RH releases. The RH packages, other than kernel updates, do not require any reboots; where most of the MS ones do. I've not had a single occurrance of an adverse effect on my Linux machine from any patches, where I have had a miriad of issues with the XP/Office updates (insert CD, permissions issues, BSODs, etc). I'm not at all trying to scream the virtues of Linux and downplay MS, but there are real issues. Not to even mention never having adware, spyware, etc. installed on my RH machine without my knowledge. I'm extremely carefull with all of my machines and I stilled managed to get some IE search bar added to my browser. I removed it quickly with Spybot search and destroy, but it still happened. I think MS needs to take a step back from the cash register and seriously evealuate their tactics and practice where desktops are conncered. That is, if they ever want their update service to be even close to as effective as RH. But thats just my two cents and I'm sure there are a line of people out there to tell me I'm wrong and/or full of crap; but these are real world observations from someone who is completely OS neutral. ..jab
"Reality is a crutch for people who can't handle drugs" - George Bernard Shaw (1856 - 1950)
Okay I see a lot of Microsoft apologists saying that "all software has bugs", "Linux has problems too", "dumb admins need to keep their machines up to date".. etc...
.. you gotta ask yourself .. is "similar to Linux" in terms of security problems the BEST they can do?
.. the problem today, right now, is Microsoft. The constant flood of pings to my machine are coming from microsoft machines. The viruses are coming from microsoft machines. When is it going to stop??
Let's see:
Linux written by volunteers and small companies.
Windows written by a company with tens of billions in the bank.
Linux used mostly on servers and installed by educated admins.
Windows used by everyone from grandma to the CEO.
Linux on a small percentage of servers.
Windows on 96% of machines (or whatever the figure is). Windows used in ATMs, in medical equipment, by the government, etc., etc. The Microsoft antitrust ruling was typed out on a Windows machine.
And given their resources, their cash, the number of frickin' PhD's on the payroll, and the fact that the entire world economy depends on Windows crap OS (yes even us folks who use Mac/BSD/Linux are still affected indirectly)
They have a huge responsibility, and they have chosen not to meet it. Why? Is it so that the government will pass software quality laws that will place a huge burden on Free software, thus weakining it or killing it off?
Or is it because people have their heads in the sand and refuse to acknowledge that Microsoft is not worth the time and money any more. That's probably it. People are sitting there constantly patching their Windows boxes and not realizing that, hey, maybe there are alternatives. Microsoft has you all by the nuts.
Why are you guys making excuses for Microsoft? Microsoft's products should be the most secure on the planet given their resources and abilities.
I used to think, hey, all computers have problems, but after using software like qmail and OpenBSD, I realized, Microsoft is doing about 1% of what they could do. Even just closing ports and making email attachments not be executable would solve a lot of problems. They need to make their software more secure.
Instead they come up with Palladium or whatever it's called now, a gigantic complex scheme to solve this problem (and a lot of other imaginary "problems" too). Can't they try some simple stuff first?
So don't apologize for Microsoft, don't say "well, if Linux was everywhere we'd have the same problems"
To patch the security vulnerabilities in Microsoft Word, you have to 1) download the patch, 2) find the original Word CD and put it in the CD drive, 3) run the patch, 4) wait while a lot of processing is done with the CD, and 5) put the CD away again. It seems to me that, since this was a patch for a severe security vulnerability, Microsoft could have skipped the time-consuming 2, 4, and 5 steps. Think how many total hours will be lost throughout the world by users or computer professionals whose time is extremely valuable. The TCO just went up.
Is there some sort of ANSI standard-Strip-club-naming-convention that I'm not aware of?
philcrissman.com.
Second, did you even bother to read those security alerts or investigate what the packages are? Briefly:
node: "Amateur Packet Radio Node program"
libpam-smb: arbitrary code, but no privilege escalation
unzip: no privilege escalation, no arbitrary code, and who uses it?
man-db: only if you go against install-time advice and make it setuid
autorespond: "This vulnerability is currently not believed to be exploitable due to incidental limits on the length of the problematic input, but there may be situations in which these limits do not apply."
netris: "A free, networked version of T*tris"
linux-kernel-2.4.18: most are local only, "STP protocol", or an nfs3 DOS with no arbitrary code or remote root
perl: yes, "execute arbitrary web script within the context of the generated page"
kdelibs: konqueror only, client only
pam-pgsql: arbitrary code, but no privilege escalation
zblast: "shoot 'em up space game"
xpcd: local only
xtokkaetama: local only
"This stuff wouldn't happen if Debian didn't use out of date software, as most of the flaws mentioned were fixed in the new versions!"
And this is why I call troll.
From Debian security FAQ:
"The most important guideline when making a new package that fixes a security problem is to make as few changes as possible. Our users and developers are relying on the exact behaviour of a release once it is made, so any change we make can possibly break someone's system. This is especially true in case of libraries: make sure you never change the Application Program Interface (API) or Application Binary Interface (ABI), no matter how small the change is.
This means that moving to a new upstream version is not a good solution, instead the relevant changes should be backported. Generally upstream maintainers are willing to help if needed, if not the Debian security team might be able to help.
In some cases it is not possible to backport a security fix, for example when large amounts of source code need to be modified or rewritten. If that happens it might be necessary to move to a new upstream version, but this has to be coordinated with the security team beforehand."
.sig Realistic fines for copyright in
I loved the article over at NewScientist (here)
A Microsoft spokeswoman told New Scientist the risk was lessened by the fact that exploiting any of the vulnerabilities would require a victim to open a document or carry out some other active task. She added: "We don't know of any worms being created."
Uh...Open a document? You mean like an email with the attached virus/worm that says: "Here is the document you requested"?
Sigh...Damage control must be getting lazy or something.
Sig it.
Lovely. They say that Word97 is affected,
but that OfficeUpdate doesn't support Office97.
Head on over to the manual download section for
Office97. NOTHING TO BE FOUND RELATED TO
THIS in the office section. Under Word alone, the latest
update is from 2001.
Gee, go figure. Yet another reason to spend money
I don't have for a product I don't want.
Oh, and for all you astroturfers & M$ Fanboys -
at least when Linux does have a flaw, it doesn't
require me to spend 400 bucks on an upgrade to a
later, flawed version.