Slashdot Mirror
Exploit Based On Leaked Windows Code Released
mischief writes "A post to Bugtraq from SecurityTracker.com reports an Internet Explorer 5 exploit that has been released based on the Win2K code leak: 'It is reported that a remote user can create a specially crafted bitmap file that, when loaded by IE, will trigger an integer overflow and execute arbitrary code.' Only affects IE 5 apparently, but still - it didn't take long!"
More proof that code who's source is open is less secure!
(trigger-fingered mods : thats a joke)
to fix it...
"/Dread"
OTOH M$ should thank the code thiefs for expediting their QA process :-)
perl -e '$_="\007/4`\cp%2,".chr(127);s/./"\"\\c$&\""/gees
Of course the bitmap is of a penguin! More ammunition for the M$ FUD campaign.
-m
#
# Modus Ponens
#
What the fuck in a bitmap renderer could overflow and cause such problems?
Fuck MSFT it's called bounds checking. e.g.
1. load int from char array
2. check int against sizeof(yourbuffer)
3. reject if greater
Not exactly a challenging task. I guess they're too busy adding in all that crapware to actually code at least one thing right.
Tom
Someday, I'll have a real sig.
Microsoft just needs to get a copy of the leaked code and look it over for potential exploits.
:^)
Oh wait.
My old sig was REALLY stoopid.
Smells like bullshit....like the jpeg virus hoax a few years back. IMAGE FILES CANNOT RUN COMMANDS!!!!
Wishing I was a millionaire since 1969.
So I should be all set for the next 2 days until the next major security flaw is found.
Anyone? Come on, there's a million /. readers. Somebody must have thought this wasn't going to happen.
Maybe the once-a-month patching schedule's going to have to be revised though.
Haida Manga
"It's called IE6"
Weird... I would have sworn that it was called Windows XP.
-m
#
# Modus Ponens
#
This means that the exploit is so obvious that even a 14 year old can figure it out.
I guess all those advertising^W software engineering dollars that MS spent on their security inititive were not^W well spent.
And here I was thinking it was called Mozilla.
#define DRM chmod 000
Mine's called "Linux". Seems to fix a whole host of problems.
For the love of God, please learn to spell "ridiculous"!!!
Finally, Microsoft's "Trustworthy Computing" exercise begins in earnest.
Hehe
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
a specially crafted bitmap file
.jpeg .gif and .tiff
Good thing all thoes Goatse pictures where in
The More Knowledge you have the Luckier you Get- J.R. Ewing
1. Fake a source code leak of some of the shittiest code in your projects
2. Act surprised
3. Wait for people to look at code and publish found holes, getting free QA resulting in major savings
4. Create Patch before major damages
5. Sue person who found hole
6.
7. Double PROFIT!
</conspiracy theory>
[alk]
i wanted to post this in the first MS leak story, but oh well, here it is now.
/win2k/* | wc -l
$ grep -ir " don't care "
332
check it yourself
I see this is good news in that there is going to be an ongoing stream of exploits in Windows. This is good news. Think of all of the boxes that will be broken in the next few months. I should mention that I make a living fixing Windows boxes. I also fix Mac and Linux - but there isn't really much money in fixing them.
Stay tuned for new sig...
"We have an interesting 6 months ahead of us, folks."
...."
;)
I can see the headlines now;
"New exploit found in IE5"
"Yet another exploit found in IE5"
"Exploit found in Minesweeper"
"Expolit found in Notepad"
"Yet another exploit found in Minesweeper"
"Yet another exploit found in Notepad"
"New exploit found in IE5"
"God damn! Another exploit found in Minesweeper"
.
.
.
"Exploit found in taskbar"
"Exploit found in Times New Roman"
"Exploit found in bootstrap"
"Exploit found in Wingdings"
"Exploit found in
Sounds pretty redundant and boring to me.
-m
#
# Modus Ponens
#
Can the same thing happen to linux?
Yeah, let's hope that the source code for Konqueror or Mozilla never gets leaked... No telling what kinds of exploits might pop up then.
The cure for cancer is coming: Reovirus
So now the /. servers are going to be raided by DMCA police? Time to move offshore, guys! ;)
In the free world the media isn't government run; the government is media run.
I cant wait to read a whole thread of slashdot people saying "i told you so".
However, i feel bad for the "slashdot team" of the microsoft PR department. I doubt those guys will have presidents day off. They might even have to pay extra for an additional delivery of "bulk mod points".
That's all I was hoping to see. MS says that it reponse time for bugs is lower then OpenSource reponse time.
Now we have a released bug, and I want to see how long will it take until MS fixes this bug.
Somebody, please, monitor this bug (or teach me how to monitor it)
-=-=-=-=
I know life isn't fair, but why can't it ever be un-fair in MY favor!?
You bastard! That's my IP address!!!
Did you hear about the image that kills your computer whenever you view it?
And the other question: How long would Microsoft have lasted?
You have 'contaminated' me.
I will no longer be able to code a buffer reading algorithm with an overflow bug without violating Microsoft's IP.
I doubt anyone would consider showing 10 lines or so of source code out of millions a copyright violation
SCO does.
Trolling is a art,
I guess I shouldn't have lied about my certifcations during the interview...
sudo eat my shorts
No one has yet posted a modified version of the goatscx photo that takes advantage of this security "hole".
Tuus crepidae innexilis sunt.
"Linux? Good god no, man! Didn't you see what happened when just a bit of the Microsoft source code got leaked? I thought you were up on these things!"
Ha, that reminds me of a recent article on devx. This guy demonstrates how being a little stupid and misinformed can lead you down all kinds of wrong paths.
His argument is that some crazed open source hacker is going to put a back door in an open source program. Further he presents this as a disadvantage of open source when compared to closed software. Because, of course, it is so much easier to hide backdoors in programs that EVERYONE HAS THE SOURCE CODE TO. No one could even hide a backdoor in a program that nobody except the developers have seen the code for. That is unpossible. Right.
So there was some IE 5 code in there? Too bad it wasn't the IE 4 code, I hear you can summon demons by reading that out loud.
By the way, does anyone know why the bitmap formap [sic] is writte [soc] upside down?
;)
It's an obscurity that provides extra security against exploits like buffer overflows.
Opinions on the Twiddler2 hand-held keyboard?
You say that as if it were unusual. ;)
http://alternatives.rzero.com/
Oh my god! I read the source! Now I'm tainted! All future code written by me will inadvertantly contain MS's copyrighted and patented signed int overflow techniques!
Thanks to Microsoft AutoParody Wizard!
I don't do spelling flames often, but I will for a Farscape quote in a .sig.
"guarantee"
Veteran, Bermuda Triangle Expeditionary Force, 1992-1951
It is called Firefox and can be downloaded at Mozilla.org!
It's like seeing your sister naked. Ack!
I don't know. I always thought your sister was pretty hot.
writte [soc] [sic]
..instead of making your own worm, go and hack the evil corp and steal all their code. That would be really ironic and fun :)
I wish that I would of thought have that.
:)
It could of been me that was modded insightful for of-ing no grammatical skills.
Well, you know the old saying... birds have a feather, etc.
Of a nice day!
The patch is called "IE 6"
bitmaps are not a particluarly clever choice to use on the Ineternet. there are JPEGs, PNGs etc. that are much better suited for the web. But as a side smirk - it is highly amusing to see microsoft products die trying to read microsoft formats
Who browses as root? Oh, yes, thats right Windows users.
I'm a safety-conscious Windows user! I never login as "root"! I just use the "Administrator" account instead!
I think you misunderstand: he's talking about your sister.
That is a little funny... Isn't a 'specially crafted image' the same 'exploit' that Geordie LaForge came up with for introducing a virus into the borg collective? Remember the first episode with 'Hugh'?
-db
According to the comp.basilisk faq about Basilisks (images that cause system crashes in wetware):
10. Is it true that Microsoft uses basilisk booby-traps to protect Windows 2005 from disassembly and pirating?
We could not possibly comment.
So, where's the .bmp I can link to my web site that makes IE5 remotely execute Mozilla Firefox installer?
Ask a silly person, get a silly answer.
I can see the ultimate virus now: you click an innocent-looking link, it takes you to a goatse bmp, and the exploit will lock your keyboard and mouse...leaving you utterly defenseless! Oh the horror!
I mean really, who runs IE 5 anyway. I'm sure that most corporate network admins keep up with updating IE. Let me check on a random company machine...
Help-About Internet Explorer-.....Never mind my previous comment.
worse than that, it contains a "goto" statement... *shudder*
That kind of thinking explains the collapse of the British Empire completly.
Professional Politicians are not the solution, they ARE the problem.
"Wouldn't it be interesting to see the patch come out later today, from an anonymous source!"
Line 3: replace "int" with "unsigned int"
Do I need to be anonymous for this to work?
60% Funny
20% Troll
10% Insightful
Welcome, Microsofties!
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
Where can I download the patch for IE5?
The Patch.
Scott
(Come on, you knew this answer was coming!)
We, the members of MSDA (Monkey Software Developers of America), are deeply offended by what you imply. We are much better developers than MS and smell better too.
You tell 'em. Someone called the cops the last time I exposed myself.
"Kittens give Morbo gas!"
You of a keen wit.
You're the sort have guy I admire.
You could of noted the grammatical humor, but instead you chose to be have a cleverer sort.
Shame about the lead paint in your nursery.
Yes, but you didn't post the uptimes.
I want my Cowboyneal
You said:
There are also no exposed pointers in Java, thus no way to clobber the stack by writing to a negative array offset, as in this exploit. Reading or writing to a negative array offset in Java will result in a RuntimeException of some sort. Buffer overflows are also impossible in Java, since writing off the end of an array will result in a similar exception.
I say:
Yes, I agree completely. The next version of Windows should be written in Java.
Of course you realize that it is absolutely pointless.
If MS is doing its work they will check the exploit's code and fix it in a timely fashion.
IANAL but write like a drunk one.