Slashdot Mirror
IE Download.Ject Exploit Fixed
Saint Aardvark writes "Just in time for the weekend, the
Internet Storm Center is reporting that Microsoft is providing
a fix for the Download.Ject vulnerability that hit IE late
last month. The press
statement says that it'll hit Windows Update later
today..."
This configuration change to the Windows XP, Windows Server 2003 and Windows 2000 operating systems improves system resiliency to protect against the Download.Ject attack.
In addition to this configuration change, which will protect customers against the immediate reported threats, Microsoft is working to provide a series of security updates to Internet Explorer in coming weeks that will provide additional protections for our customers.
Please note that this isnt a fix, it is only a configuration change to help defend against the problem and nullify the threat from the known places it is spreading from. No doubt that within a short time, whoever is behind the virus will find other places to have the virus attack from. This is just another "this will help for now, please wait for the real fix" incident from Microsoft.
That assumes I remember to run Windows Update... Why do I have to do it myself Microsoft! I want automatic and forceful patch downloading and installation! Sure, you could throw in an extra DRM patch here or there... but I don't care, I'm lazy!
Help Brendan pay off his student loans
For the others, Microsoft has provided customers with prescriptive guidance to help mitigate those issues.
You can have Automatic Update download and even install things on Windows XP.
Got it, but in the meantime I switched to Mozilla Firefox and I honestly don't see any reason to go back to IE apart from a handful of aggressively IE-only sites.
Never email donotemail@WeAreSpammers.com
O get the fix early, HERE.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
Fix can be downloaded here.
I Am My Own Worst Enemy
The Department Of Homeland Security said it is safe to go back to using Internet Explorer as your main browser...for about 10 minutes, when the next exploit will be released.
So, the vulnerability will hit Windows Update later today? How do they know? (Other than the fact that Microsoft is running security at the Windows Update site, of course.)
If aspiration is a virtue, achievement cannot be a vice.
That means all the sys-admins will have to work late on a Friday night making sure its installed.
Excellent timing.
Unknown host pong.
"Late last month"
vs.
"A week or so ago"
I know Microsoft is not one for timely updates, but this wording makes it sound like Microsoft has been sitting on this particular problem a lot longer than they have.
They might've found one way to prevent the auto-download, but there are still plenty of ways to force a download using ActiveX. Even with that, there are still a few ways to run them too; methods that are still unknown to most assholes trying to get you to buy their pills that give you bigger penis-breasts-ego-wallet-spyware-car-wife-mom-WMDs .
'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
when you set high security you cannot even use windows update, and putting windows update into trusted sites does not work right
Snowden and Manning are heroes.
Late last month actually means June 25th. Which by my count was only 1 week ago. But it wouldn't be a bash microsoft topic without a little twisting and manipulation.
Why is it called Ject? Is the virus writer or the AV firm some kind of closet Final Fantasy X fan? Seriously? Why Ject?
This is completely incomprehensible. I'm using Mozilla Dangerphoenix, and ms let me get the download with no hassles at all. Of course it's not one of their usual updates, but I still find it hard to believe that they haven't broken the link for non-IE browsers like they do for the rest of their site. Unless the "Configuration Change" is really just an extension to "fix" my Mozilla Pornopony to behave just like IE. DAMN YOU MICROSOFT, WHEN CAN I TRUST YOU!!!
1.Netcraft confirms:In Soviet Russia all your base welcomes a beowolf cluster of CowboyNeal overlords. 2.? 3.Profit!!1!
Download.Ject.A
Download.Ject.B
Download.Ject.C
Download.Ject.D..............
What use are IEs extra features if they have to be turned off by default.
ActiveX should never have been embedded into a browser in the way it has been. Yet most of the sites that I have to use IE for is because of ActiveX controls.
Microsoft tricked a lot of the world into using ActiveX and now they're paying the price.
I can hear the support conversations already -
"Yes, if your security zone is set to high your computer won't be vulnerable. But if you want to view anything with ActiveX (read: multimedia) you'll have to turn these vulnerabilities back on."
Does anyone else find this mildly insane ?
[ Monday is a terrible way to spend one seventh of your life. ]
Well take a look here and see the blog of a windows developer. He really does get upset when people say that MS doesn't care about security.
I am sure you are all aware that windows is a fairly large OS that is designed to be easy to use for novices but allow Power Users to do their thing as well. I think it accomplishes that fairly well. They provide automatic updates to every computer now (if you are not too lazy to turn it on). I realize that this option is turned off by default but this is more because of the people (*cough* slashdotters *cough*) that say that MS will somehow steal all their secrets if you let them install updates automatically. I think MS does a good job updating system.
Also, if I see one more reply to an IE article with the line "Download the patch here" rated as "Funny", I will kill myself.
Wonder no more. 11 months of IE exploits and at least a year or two's worth of future exploits can be avoided with one simple registry change. The problem that MS has isn't that they are incompetent, it's that they insist on leaving default features that are used by 1% of administrators like myself.
98% of spyware released since January 2004 can be avoided with the above registry fix. If you think that statistic is outrageous, I challenge you to find one piece of malware installed without using ADODB.Stream in one way, shape, or form. Be forewarned, I make and research IE exploits for a living and wouldn't make this kind of a claim without having the data to back it up.
And, while it's unfortunate that many people don't (or can't) run Windows Update, it works well for people with fast connections who are behind firewalls so their systems don't get screwed up before they can patch them!
Best Buy can have you arrested
There's a copy at http://www.kb.cert.org/vuls/id/323070. Right down at the bottom under "Use a different web browser".
Black Knight: Have at you.
King Arthur: You are indeed brave, sir knight, but the fight is mine.
Black Knight: Oh, had enough eh?
King Arthur: Look, you stupid bastard. You've got no arms left.
Black Knight: Yes I have.
King Arthur: Look.
Black Knight: Just a flesh wound.
It's all fun and games until someone loses the key to the handcuffs.
Microsoft e-mailed me the patch some time ago, like they do with all their other security updates. I install them all as they come in, and keep my system virus free!
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
It was only mentioned two posts before this that CERT advised people to stay away from IE, even though CERT released that advisory on June 10, and it was even reported on BBC on June 14. Now this story comes along mentioning the patch will be available later today? The CERT advisory could have been published on Slashdot nearly a month ago, but conveniently is published on the same day as the fix is released. Was it intentional to keep information about the CERT announcement off of Slashdot until the fix was released?
"Microsoft Kind of Does Something Vaguely Related to Download.Ject Exploit"
Slashdot in 5 Paragraphs
Stupid Mods. If you don't know what the poster is talking about, don't mod it. Just leave it and go to the next post.
He is referring to this Security Focus article
From the article,
Still, speaking at a press conference here Monday, Gates told journalists that Microsoft's patching process compares well with competitors'. "You know, the time -- the average time -- to fix on an operating system other than Windows is typically ninety to a hundred days," said Gates. "Today we have that down to less than forty-eight hours."
I already posted link to this article here
Free XBox, PS2
Dear Microsoft,
I am writing concerning downloading the most recent Windows Updates. I am unable to obtain them as your site requires IE, and the government recently suggested that users cease use of IE.
Please help!
-Adam
Talk about damage control... they don't have the fix on their site at the time of this writing... so it's vaporware for now.
I know of at least two very large companies who have moved to Firefox in the wake of this latest episode. I suspect many people are finally fed up, which has prompted MS to announce patches before they're even available.
Considering a recent patch to fix a vulnerability broke the complaince of IE as it relates to embedded uids/pws in URLs, I wouldn't be surprised if this "fix" ends up crippling something else.
We should start collecting wagers on what new problems this upcoming "fix" introduces. Otherwise it would probably be online by now.
Nope, XP and 2003 have windowsupdate.microsoft.com as a trusted site. Unless you remove it manually, no setting will affect that.
.
Mind you, that still leaves the door open for someone clever to put an entry in the HOSTS file and do some nifty DNS man-in-the-middle trick, sending the unaware user somewhere else and trusting that "fake" windowsupdate.microsoft.com
Which is nice.
Wearing pants should always be optional.
It's worse than that. MS only appears to care about big customers, typically large corporations, institutes, and government departments. i.e places that are behind a firewall and have (nominally) competent IT staff to keep the network running smoothly. Just look at the number of TCP/UDP ports they keep open. That sort of behaviour is ok on a safe intranet, but it's sheer negligence for home users connected directly to the internet. I'm constantly seeing incoming requests to the "windows networking" ports (137, 135, 445) on my ADSL connection. Those ports just should not be open to the wider internet. And lastly, witness the number of error dialog boxes in windows that simply advise the user to seek help from "the network administrator".
It's the big customers that MS cares about, not the home users. And we're all worse off when the latest round of worms clog up the internet.
http://www.kb.cert.org/vuls/id/713878
"Use a different web browser
There are a number of significant vulnerabilities in technologies relating to the IE domain/zone security model, the DHTML object model, MIME type determination, and ActiveX. It is possible to reduce exposure to these vulnerabilities by using a different web browser, especially when browsing untrusted sites. Such a decision may, however, reduce the functionality of sites that require IE-specific features such as DHTML, VBScript, and ActiveX. Note that using a different web browser will not remove IE from a Windows system, and other programs may invoke IE, the WebBrowser ActiveX control, or the HTML rendering engine (MSHTML)."
Is the juice worth the sqeeze?
The slashdot rendering bug (bug 217527) can happen even without AdBlock. It's fixed on the trunk, so if you switch from 0.9 or 0.9.1 to a trunk nightly, you won't see the problem any more.
The shareholder is always right.
http://www.kb.cert.org/vuls/id/323070
the very last suggested solution states:
i'm no web journalist, but i'd hardly call that a recommendation or urging to use a browser other than ie.
No offense taken.
I'm not exactly the most trustworthy person anyway, I've been compromising computers for the last 5 years.
FullDisclosure: ADODB.Stream object
Any attack vector that relies on an ActiveX control can be stopped by setting the killbit. This is IE security 101.
-weld
"Second, I have never -- that means NOT EVER -- seen an IE fix that broke my machine worse than a virus would."
Hmmm. Well THERE's a ringing endorsement....
No security vulnerabilities have actually been fixed here; all that's happened is that some functionality (which exacerbated existing security holes and was probably a bad idea to begin with) has been disabled.
Okay, everyone has had a great deal of fun at Microsoft's expense today with the stories of Dept of Homeland Security dumping IE, and Microsoft taking nearly a month to fix a BIG exploit in IE. But I wonder if Microsoft's problems are less a function of them 'getting it' as much as it is a case of them being a 'victim of their own success'. Follow along with me for a minute.
When MS started its rise to the top, they hired as many of the brightest minds as they could to make their software the best of class. While many of us probably find the corner-cutting a bit too much to take, it is possible to have both world-class software while meeting a marketing deadline. It happens, but less frequently than MS or its defenders/supporters would like to think it does (lightning striking the same point twice *without* a lightning rod).
They continued to compete heavily in the OS market despite the fact that they initially wanted to be nothing more than a computer language business. The OS was to be the cash cow that would allow them to be a more effective language business. But now they own the OS business and are driving their business model into other ventures (consoles, entertainment centers, telephones, automotive brainboxes, etc). They just follow the same formula that lead to their smashing success in moving into the OS and office app market: buy the best brains in the field and use their project management skills and VOILA!, they are the new masters of the [insert market segment].
But consider the sandbox their bright minds play in: a homogeneous computing environment with computer scientists guarding the facility from outside intrusion. As has been noted in another slashdot article, Microsoft's products work wonderfully inside of Microsoft's campus.
They have extremely talented people working with the highest-end equipment in an environment where everything works nearly 100% of the time. Is it so surprising that they do not view the world the way we do?
After all, most of the companies that I have worked for are staffed with (largely) computer-illiterate people and whose firewall is maintained by a PFY with a high-school diploma.
Perhaps it would be better for Microsoft if they force their developers to create their products in environments that their customers use. In fact, maybe they should send their developers to test their products in the heterogeneous environments of their customers for a month or two.
Let them work the bugs out on their time for a change.
"Rocky Rococo, at your cervix!"
According to SecuritiyFocus. Windows 95, 98 and ME users are also vulnerable. So why is this patch only for Windows NT, 2000, XP, and 2003?
It does NOT run on Windows 98.
Oh, I remember, Microsoft only produces patches for "supported" (if that's what you can call it) products.
That isn't the point, surely? It would have been so easy to produce an executable which would have worked on 9x/ME too to set the registry key, and make it available to everybody via WindowsUpdate.
At the risk of repeating myself, Microsoft STILL hasn't got it.
Look, Firefox IS NOT READY for prime time. That's why it has a sub 1.0 version number, and why it is considered a 'technology preview'. In this context, some serious bugs are to be expected. Have some patience. The bug has been fixed in develepment and will make it into the normal builds in due time.
If you want to complain, complain about Seamonkey. It suffers from the same bug, yet is at version 1.7.
Oh, and btw, [Ctrl +] (optionally, followed quickly by [Ctrl -]) will cause the page to re-render and display correctly. It's an easy work around until the fix makes it into the official builds.
(Score: -1, Stupid)
Except IE isn't ready for prime time either, and it's at 6.0.