Slashdot Mirror
MSN, Word Vulnerable To Shell: URI Exploit
LnxAddct writes "InfoWorld is reporting that a few Microsoft products are also vulnerable to the "shell:" scheme vulnerability found in Mozilla last week. These applications include Microsoft Word and MSN Messenger."
Well at least Mozilla will fix theirs...
"This is you left and that's your left. This is your right and that's your right. You're gonna die!
Intelligence Guy: "We have top men working on it right now."
Indy: "Who?"
Intelligence Guy: "Top... Men..."
=P
Comment removed based on user account deletion
Aren't we over our bugs-o-the-day limit?
Well now, let's see how long it takes for their patch to come out.
Anyone know if Word 2004 for OSX is safe from the URI exploit? I know that the macs have been having trouble with the URI exploit over the past few months based on some articles I've read at macslash.
Aj
GroupShares Inc. - A Free and Interactive Stock Market Community
-------
artlu.net
The article is short on details. Does this really work on xp sp2? I know that xp sp2 protected against the Mozilla exploit, so I would imagine the same is true here. Which would make your claim that these sorts of things are only fixed "in the open source world" seem pretty specious.
I'd rather be lucky than good.
Fortunate that I don't have them then! :)
If it's non-obvious and contrived, is it reasonable to assume that Microsoft could be lifting, or at least peeking at, code from the mozilla project and replicating it in their own browser?
Naw; if that were true, IE wouldn't suck so much.
I just tried it in Microsoft Word 2002, with XP SP1 and all of the approved hotfixes for my agency, and it restricted it just fine- wouldn't even recognize it as a hotlink.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
According to the article "Malicious hackers could launch programs associated with specific extensions using links embedded in Word documents or instant messages sent using MSN. However, the vulnerability does not allow attackers to pass instructions to the programs..." Now call me crazy, and I know i'll probably piss off the microsoft hating people here, but what harm is there really? What's some "hacker" gonna do, open up Acdsee and show my porn collection to well...me? Maybe pop open a few dozen IE windows or programs to force me to reboot? If there's nothing else being transferred it's really just more of a nuisance than something major. Or am I just reading this wrong?
So open source is literally infecting MS Windows :) So this is how we plan to take down the empire?
Giving IE users a taste of their own medicine since 2005 - http://pods.-is-a-geek.net/
By the time the Mozilla story was posted on Slashdot the fix was already available - the link was even posted with the story.
I don't see a patch posted with this story so I guess there's no way Microsoft can win the patch-speed race for this bug - all we will be able to do is place bets on just how much slower Microsoft is. Predictions, anyone?
~~~~~~~
"You are not remembered for doing what is expected of you." - Atul Chitnis
Now we know wether the shell scheme bug was in the OS or the application :)
"while you guys were down here talking, we were upstairs having hot buttered corn"!!!
HeHe!
(Score: -1, Troll)
I find it interesting how they talk about "no exposure to malicious attackers", as if their products are magically invulnerable until someone discloses the hole to the public.
Comment removed based on user account deletion
HA! Take that M$ :-D
HA HA
Does it also count as the obligatory Simpson's quote?
i thought once I was found, but it was only a dream.
Oh good, I'll go and download SP2 then... What's that? It's been delayed to mid-August? Oh dear!
The URI exploit in its general form is mitigated by the fact that you can't pass any command-line arguments to the command. So you can launch a bunch of Notepads, so what? However, you CAN type a filename in and have it open in its associated application. If that filename is too long, you can exploit a buffer overflow in the helper application. There happens to be a plentitude of client applications on a standard XP box with buffer overflow possibilities. Once you're there, go anywhere you want with the privileges of the user on the XP box (which is usually admin, and if not, you can usually get admin without a lot of effort).
Anyway, SP2's memory protection would have prevented the overflow attack. It would not have prevented the most general (and less harmful) form of the attack, however.
What the original poster was probably meaning, if he had a point at all, was that non-Windows systems don't do this sort of "command-line-as-a-protocol" bullshit because it's quite obviously the wrong way to do things. Security through obscurity works in a lot of cases because people think "nobody would EVER design an OS that did THIS" and they never bother to look. Well, now someone's looked and found an ancient kludge coded by someone who probably doesn't even work for MS anymore. And more man-hours are going into fixing this bug than would have gone into creating a proper implementation of whatever this goober was trying to accomplish in the first place.
That said, Open Source isn't pixie dust that makes everything happy and secure. Stupid things happen in Linux. They just happen in the open where people can find them and fix them before applications start relying on them to function.
... what gets patched in the open source world gets exploited further in the proprietary world. MS should probably pay more attention to projects like Mozilla... it might save them a lot of time and effort in the long run.
SFU you smug asshole
I mean c'mon, WebSideStory confirmed it today and all.
Quantum materiae materietur marmota monax si marmota monax materiam possit materiari?
I kI know that xp sp2 protected against the Mozilla exploit
Are you posting from the future, sometime like september? Which might be after sp2 is finally released, because given MS's history just because something is fixed in the beta doesn't mean it will make the final cut.
only fixed "in the open source world" seem pretty specious
That's not what was said and you know it.
I think the handling of this problem demonstrates the difference between Microsoft software and other software like Mozilla. In Mozilla, the problem didn't even require a real patch to fix, just a quick config setting to tell it not to pass things along to the shell: handler. My bet is that fixing Word etc. will require not just multiple registry changes but actual new code to allow shell: to be disabled. And odds on the first thing they try is to just add filters, and we'll see half a dozen iterations of exploits of this using different ways past the filters until MS finally includes a patch to allow it to be disabled.
it simply passed on requests it didn't understand, it was a bug in the OS itself,
the Mozilla hack is just that, a hack to
cover a deeper Windows vulnerability.
I'm typing this on my computer running Windows 98. This overlooked operating system doesn't have the bloat that other OS's have, and it's a lot more secure. We don't even have the shell protocol, so there's no shell exploit to worry about it. Just turn off file sharing, use Mozilla, and everything's great.
Well, SP2 won't be out til August now, since Microsoft is trying to let Intel catch up to AMD.
In my 20+ years of using a Mac and getting only one virus, I can tell you how I did it, I ran as little Microsoft code as humanly possible.
I haven't used a Mac for several years, but between 1989 and 1999, I used them fairly heavily. I saw a single virus in those 10 years. A macro virus in Microsoft Word which I got by opening a word doc from a Windows machine.
(that subject is a great way to get modded down)
I created a shell link inside Office Word 2003 and when I clicked it I was warned that the hyperlink contained a potentially dangerous target and that I should only proceed if I trusted the source of the document. This warning does not appear for http, https, ftp, or other common "safe" protocols.
I do not have MSN available for testing.
http://brandonbloom.name
While bug 250180 is pretty new, bug 163767 is ancient (08-2002) and describes the same problem, although being a bit more generic. I wouldnt shout too loud about fast bugfixing in OSS in this particular case. Although the bug is more a bug of Windows broken-by-design handling of URIs it still should have been fixed (or the features needed for the bug to work should have been disabled by default.)
I use the only software not exploitable in Windows - Notepad!
"This can be done easily with notepad. Click here to open notepad"
You know, some "it's not a bug, it's a feature" things really are features. I dont see how this is worse than while(true) { window.open(document.location); }
-- 'The' Lord and Master Bitman On High, Master Of All
Later on.. our Windows user gets an unstable system and funny looking things on his dick.
I've been using MS products almost exclusively for 20+ years and have never gotten a virus either. It's insanely easy to prevent if you give it even 10 seconds of thought and config. Something I admit 99% of computer users are not willing to do...
I'm the one who posted this message to Full Disclosure. I was too lazy to test all popular e-mail clients, IM clients, word processors, etc. that run on Windows, so I posted after finding only two vulnerable programs. Who wants to help?
All you have to do is see if your programs accept links to shell:windows\notepad.exe. If clicking the link launches Notepad, it's vulnerable. If there's a warning dialog, it's somewhat vulnerable, depending on the wording of the dialog.
The shareholder is always right.
Good. Go download it. Or don't. But at least don't be a hypocrite like half the people here and say that sp2 "doesn't count" until it reaches final release form, while firefox "counts" even though it's also in pre-release form (not even at 1.0 yet). Sort of like when people claim that IE on xp doesn't have popup blocking but firefox does.
I'd rather be lucky than good.
seriously though, you can download it via windows update v5.
http://v5.windowsupdate.microsoft.com/
*meep*
As the University of Rhode Island (URI) University College Representative in the Student Senate, I can assure you that no student at the University of Rhode Island is exploiting Microsoft Word... we're only pirating it.....
Ma Bell
Microsoft... vulnerable? Ya think?
The Article's title is: Microsoft products also vulnerable to Mozilla flaw That is gross misinfomation, it should be something along the lines of "Microsoft products allow exploit of OS flaw, similar to Mozilla." The flaw itself is in the Windows operating system. It exposes access to shell functions that applications need to blacklist. Application developers shouldn't need to be concerned with "Oh, I need to stop that protocol for security." It should be the protocol developer's responsibility to say "Is this safe?"
Yet another signature that refers to itself. The irony and humor is dead.
Assuming open source advocates fix bugs immediately upon hearing about them, then how much regression testing is actually done? None. With open source the hole is plugged (good), but the fallout from the problems the fix may cause are never addressed by the advocates until later. Up to this point Linux (open source) really has no large installed base. Lets see how long it takes before those quick patches do more harm than good.
Microsoft Word 2003 w/Latest Updates.
Insert > Hyperlink
shell:explorer.exe (path should be unneccessary, tried shell:windows\explorer.exe as well)
Critical Error Dialog pops up
Opening "shell:explorer.exe"
Hyperlinks can be harmful to your computer and data. To protect your computer, click only those hyperlinks from trusted sources. Do you want to continue?
Yes | No
Pressed Yes and nothing to happened.
The title is quite misleading on first glance.
"Microsoft products also vulnerable to Mozilla flaw"
If it was a Mozilla flaw to start with, my linux boxes would be vulnerable. I know its picky, but the title is not accurate IMHO as Mozilla is being used to take advantage of a Windows feature, rather than the flaw itself existing in Mozilla.
I can type in a filename to get the same priviledges as the user (meaning myself)? How is this an exploit? The shell: problem was that it could be exploited via a link to a uri. I don't see how something that has to be typed in to the address bar is much of a vulnerability. If you can convince someone to run the arbitrary program with the buffer overrun, you've already won since you've convinced them to run an arbitrary program for you.
I'd rather be lucky than good.
It seems logical that the solution to many of these browser exploits is to run the browser with a separate set of OS permissions, i.e. as a separate user. This could be done using setuid under Unix. I don't know how it's accomplished on Windows.
The special user would have greatly reduced permissions, which would prevent these exploits from being useful. This user could not execute anything but designated plugins, and could not save files except to a designated area.
Why has this not been tried?
someone needs to come up with a program that shows end users the communications going between there system and the internet..... and call it flypaper. and have reflist files like for virus programs and spyware programs....and call them "stucky stuff"
Ie, Flypaper version 1.1 and stickystuff 3.7
but the stickystuff ref files not only catch bad stuff but fucks around with it...
so as to demotivate abusers of ports
spiderweb woudl make for a good name of such but to many spider and web word uses already
All it does for me is pop up an internet explorer window. It's really weird, because the IE window is open to the "Log in to MSN" page, with the E-Mail address in the login form set to blank. Not the usual "", just blank.
My Systems
To try out open source browsers like Firefox and Mozilla....
;)
;)
Maybe its about time for some people to concider some alternate producivity suites - not just openoffice - even some suites like Corel have some intriguing software that lacks the user base of microsoft.
Rant>./rant
On a sidenote.. Corel lost a big share of its market to MS Office around the same time Netscape was crushed by IE. I remember my highschool used Corel at the time. Netscape was very smart to start the Mozilla Foundation insead of trying to beat MS, they are letting their supporters promote for them, gaining them some brand awareness if nothing else. Perhaps It wouldn't be so strange if Corel was to support a open source initiative, or merge with OpenOffice. The next best thing since frozen coffee for the computer geeks would be firefox and corel. Corel could sure use some geek to geek praising around now
For those of you not very firmiliar with Corel, at one point they were doing fairly well, then they kinda fell thru - had to lay off alot of people and are now trying to get back into the market.. but I personally think they face the same fate as Netscape.
In the real world, If you loose a customer, it takes twice as long to get that customer to come back to your business, and that customer is a big factor keeping other possible business from you, as they will tell at least 10 people of their experiance.
Based on this, even old Corel users would be hesitant or unwilling to switch back to Corel -so Corel needs a new movement. Open source anyone
Dying Proprietary Software + Open Source = Improved Code + Brand Awareness + "PROFIT" (Donations, Memberships? Support? and Smart Usage Of Your Brand Recognition)
With so many software companies expected to bust with news of the markets this week, I wouldn't be surprised to see a few new related open source projects pop up.
Rant> logout
Mod me down im a newf (wiki)
Oh, man! I tried so hard! Look at my ID #. I'm not an old timer like you - four digit slashdot id?!? Did you stock when /. was sold to VA?
causes nothing at all to happen.
I tried shell:windows\explorer.exe and shell:explorer.exe
Nothing happens.
What percentage of *nix users patch vs. MS users? And if *nix attains parity with an MS OS, what percentage of grandmas will patch? What you are calling "Microsoft users" could well be *nix users in a few years. You are confusing an OS with user eductaion.
Okay, I'll bite. Some of us have a standard of stability and completeness, totally independent of version numbers. Was Internet Explorer 1.0 a happy, complete, stable application? Is Firefox 0.9.1? I think you're fooling yourself if you think version numbers provide any sort of yardstick of the readiness-to-use of an application. I personally won't use ANY Microsoft product in a production (read: at work) environment until it has at least TWO service packs. Windows, Office, SQL, SMS, doesn't matter. Microsoft's standard is "it's 1.0 when we need to release it. it's sp2 when it's ready for prime time". Not all companies are the same way. Corel has yet to release a product ready for prime time, and WordPerfect's up to 12 or so. Cisco, when motivated, can get things done right in the first release. Open Source projects all have their own standards. Firefox 0.9.1 is much more mature and ready for prime-time than the latest PR or SP2. The Xine maintainers, who must all be insane,
have a project that's been stable for years and it hasn't hit 1.0 yet. If Firefox suddenly released 2.0 would it sudenly be more mature? How about 3.0? What's the magic happy number? THERE IS NONE. You have to gauge each vendor, and each application, by a consistent set of rules and just forget what version number the marketing people decided it should have.
This works in Outlook XP and OE 6. So who's up for a nice chain letter?
My Systems
Well according to ____ Journal that stupid fix broke XX applications because it wasn't regression tested. The patch developers are now scratching their heads trying to find what their nice patch broke.
There's a difference between programs and protocols. Applications should trust any protocol you hand to them that they support. They should not just launch applications. This is a basic security fuck-up, and it really isn't relevant if you understand how it works, as long as it's fixed. Soon.
What gives? Open source is saving Microsoft!
Mozilla guys patched their Windows versions to protect Windows users. Which M$ has not been able to do yet with its products.
Do you expect Mozilla ppl to fix Word?
Sorry if I'm being dumb here, but I couldn't figure your post out.
Here'show it works:
You predict the next security flaw,exploit etc etc etc and what product it will hit. Apache buffer overflow (smart money says don't pick that one), Word vulernability etc. This could be cool.
Dibs on Wednesday IE exploit.
I boycott signatures
The Xine maintainers, who must all be insane,
have a project that's been stable for years and it hasn't hit 1.0 yet.
It's worth noting that, technically, Emacs hasn't gone 1.0 yet either. The version is really 0.21 - it's just that they've been in the minor version numbers for so long now nobody refers to it that way anymore. Is Emacs incomplete? Lacking functionality perhaps? Apparently yes.
Jedidiah.
Craft Beer Programming T-shirts
"Microsoft users have shown time and time again is even when the patch does come out, it's often not applied on many machines."
A sobering testament to their broken model of supplying patches across the Win 95/98/2000/XP family of products, not to mention the fear of many users and institutions to install patches due to stability concerns.
All of which falls squarely on the shoulders of MS. Build trust, provide security and stability. How would the public rate MS on those three counts?
There is a big difference between the degree of risk I take with upgrading Firefox and the major overhaul that SP2 is going to turn out being. Sorry but this hypocrite isn't buying your assertion.
I don't want knowledge. I want certainty. - Law, David Bowie
>In my 20+ years of using a Mac and getting only one virus
You also only have one mouse button, so I wouldn't be too proud.
Firefox is mostly stable and highly prone to memory leaks. So no, it's not ready for prime time. How are people using Windows 98 and such supposed to use it? You people advocate it all over the place but forget that it still has flaws and that's why it's not at 1.0
-]Phreak Out[-
First, it's not a Mozilla exploit, it's a Windows exploit. Second, this "exploit", being a Windows exploit, never existed on Linux. So yeah it's a pretty specious claim, mainly because it never existed "in the open source world" so there was never a need to for it to be "patched in the open source world", only in a mixed open and proprietary world. Fuck, now I'm off on a tangent, back to the point, it was a Windows exploit, not a Mozilla exploit.
Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws-Plato
Um, well, the difference here, my friend, is that one is an upgrade for an application (Mozilla Firefox), and the other is an upgrade for an entire operating system (Windows XP). One risks the ability to browse , the other risks the ability to boot .
Prudent people might be willing to risk blowing up their pre-release browser for functionality and security, while not be willing to risk blowing up their entire OS with a pre-release patch just to get their browser updated...
If I understood it right, what you are describing is the Mac bug in Safari.
But on Windows I don't believe there is some way for the malicious site to "install" a program unless it actually runs some software. If they can get to that point they might as well do the malicious stuff right then rather than rely on this shell: step.
So I agree with the initial poster that this does not sound as dangerous. In fact the Mac bug was pretty much ignored even though it could run arbitrary programs, but could not pass arguments to them. It required some searching to find programs that would do nasty things without arguments.
The Mozilla page describes some of the nasty things that could be done with shell:, but they mostly amounted to crashing or rebooting your machine, I think.
I've always run Microsoft software. I've never had one of my systems or a system that I manage get infected by virus. Never once. It's called Antivirus software. If you keep your definitions up to date and combine it with a solid, properly configured firewall and keep your systems patched then your not going to have many problems. If Mac's had 50% of the market share that Windows had you would have seen a lot more viruses for Mac's over the years. If tomorrow Mac's suddenly had the market share that Windows has, you can bet your ass you would have seen a fair number of viruses, worms, exploits, etc.
These bugs are totally irresponsible. Microsoft is the worst offender, as their OS/app integration cuts both ways. But the only solution is IPC security with a simple UI for the masses. That needs OS hooks, and is one of the few truly essential features needed in a modern desktop OS. M$ is obviously going in the other way, and Apple isn't feeling the heat enough to do it. But open, network-native Linux is the perfect candidate for this feature innovation, especially as it is going through revisions to basic relevant features as its scheduler. Where's my process login kernel patch?
--
make install -not war
No, it's a Mozilla exploit. Mozilla was passing unverified user input to the shell (to Windows) and effectively telling Windows "I want you to run this program". Windows would then run the program. The bug here is that Mozilla should not be giving untrusted input to the operating system. The bug is not the fact that it is possible to pass something to the OS in that way, it's that Mozilla was not validating what input it was passing. Not blindly trusting user input is one of the first prinicpals of writing secure code, and Mozilla neglected that pricipal while IE didn't (but apparently MSN and Word did). It was probably a good idea to remove this from the OS (as was apparently done in xp sp2) since it was being abused, but it was not a "bug" in Windows. There was also a pretty short article in eweek about the topic which you might find interesting.
I'd rather be lucky than good.
"A new security report today reveals that all computers are vulnerable to the latest of a series of never-ending security exploits. This latest flaw, which manufacturers are unwilling to disclose the details of at this time, has been proven to exist on all platforms and affects all operating systems. Manufacturers are currently working together to find a solution. Until then, security experts are recommending that users unplug their machines from any cables that connect to the walls. Critics suggest that even this solution has flaws as some are using wireless technologies to circumvent the wires. Industry analysts suggest that the latest exploit is linked to other reports on 'user stupidity' and 'God's wrath on civilization as we know it.'"
Exactly. Applications have to trust the OS they run on you know. If they don't, the application itself might as well be a whole OS.. jesus christ.
Ya, tell them to start the new program by opening a URL in IE then click on the "start new program" link. Ya, it's great for explaining that. There is NO need for any program to run another program based on the content of data (web pages).
For you information, SP2 beta can be only installed on ENGLISH (or german) version of Windows XP (pro). I am running finnish languaged Home edition and haven't been able to test SP2 because of that.
The problem is that 98 doesn't properly deal with the kind of RAM a lot of us need. Even a gig will toast an old 98 installation, but if you use the patch to allow that much RAM the caching schemes and everything don't work well at all.
That's fair, although it's not true that it's only available for English. The wegpage says "It is currently available in English and German. Note that this version requires an existing installation of Windows XP. For information regarding the Japanese version of SP2, please go to the Japan TechNet site.". I followed the link to the Japanese site, but don't know what's going on there because, surprisingly, it's in Japanese. But it sounds like it probably has sp2 for download, so that's three languages, although you're right that finnish isn't one of them.
I'd rather be lucky than good.
Highly prone to memory leaks? I can run Firefox all day long on my Win2k or Fedora 2 boxes at home, or my XP box at work, with nary a problem. If you're going to make assertations like that, you'd best be prepared to back it up with a link, at least.
From his post:
Goes to show what gets patched in the open source world gets exploited further in the proprietary world.
From your post:
Which would make your claim that these sorts of things are only fixed "in the open source world" seem pretty specious.
How about reading what he says before trying to reply? At no point did anybody claim that open-source is the only way of fixing this issue.
Does anybody else see the possibility of a 2-bug attack: .exe
* first bug rewrites a program's config file to cause mailicious initial actions
* shell uri bug causes said program to run
Or:
* first bug writes
* shell uri bug causes said program to run
Or:
weeeeeeee!
Steps
1) Write bugs
2) Negotiate with Pr0n fnords
3) Deploy bugs
4) Pr0f1t!
Me glad me not part of collective at moments like these...
the clock on the wall says 4 til 7
Guess what: I discovered a new exploit in Windows. Just double click on a program and it will be executed without any warning!!!. This is truly appalling and I am considering alternate OSes right now. I hope they don't have this 'security breach'.
No, I mean, if Mozilla asks Windows to execute a file, why is Windows responsible exactly? Responsible for executing it?
Write boring code, not shiny code!
But at least don't be a hypocrite like half the people here and say that sp2 "doesn't count" until it reaches final release form, while firefox "counts" even though it's also in pre-release form
Well, when Microsoft can do the equivalent of:
Run old version.
Install new version.
Run new version.
Decide you don't like it and reinstall old version.
It's not a level playing field. Half-baked open source "counts" whereas Microsoft's "almost" doesn't. Works like the beta of alpha-beta statistical errors.
Is this like dubby blaming the CIA for bad intelligence ? So what the CIA gave bad intelligence don't you have the brains to at least heed to what the whole world is complaining about ? Its the same thing over here - if mozilla says blue screen yourself MS OS shouldn't do so just because an application is asking it.
No Sig for you.!
If the Mozilla problem wasn't really a problem, then it can not be called a problem for these MS products for exactly the same reason.
The Mozilla problem was a problem.. and it was caused in large part by Microsoft's catch-all handlers. And all the people who were saying that is was all Mozilla's fault because IE had been modified to prevent it are beeing shown how wrong they are now.
problem with anything Linux, blame MS.
Linux was never effected by any of this, it only happens on Windows. Why are you talking about Linux?
yeah, you're using understanding, instead of panicking.
Word has been vulnerable to some form of attack since it was created. Why is anyone surprised?
Professional Politicians are not the solution, they ARE the problem.
If you open the run dialog and type shell:windows\notepad.exe it opens it. That means Run has this flaw too!
Why is anything anything?
There you go in denial again you linux loving bastard.
Yes, the Mozilla problem was a problem, because it was sending commands to Windows that are potentially high risk.
Did windows ask Mozilla to send these commands? NO.
So the Mozilla problem was not the fault of windows.... but do go on. keep blaming others for your own mistakes.
emacs will hit version 1.0 when it can shake the programmer's hand, look him in the eye and say "I'm ready."
Considering that Word's macros might need to launch another app, by means of the Shell command, it's a feature, not a bug. I've used it frequently in macros. It became a vulnerability when Word was made "Internet aware" and started logging onto the net at every opportunity.
Thursday is Microsoft vulnerability day!
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison
But that's not what Mozilla is saying. Mozilla is saying "I wantt to invoke the following application". When one program tells the operating system that it wants to start another program, the operating system isn't really expected to say "Wait. Are you sure? Are you asking me to invoke this application because of untrusted user input? Maybe I shouldn't start the process you asked me to, just in case you're wrong and don't really want me to start it."
I'd rather be lucky than good.
Go buy a Rage Against the Machine shirt with a Che Guevara relief from the mall. Che would be proud, I'm sure.
Let's see...I'm running Firefox 0.8 on my Debian testing/unstable box, and I can keep it running for a week or two at a time, at least. Usually the only reason it gets shut down is because I've upgraded gtklib, or something to do with X, or whatever, and have to restart X to load the new library files. (Debian testing updates several packages every day...)
I've never seen Firefox start using massive amounts of memory which would indicate a memory leak. This is also on a 466MHz Celeron with 256MB RAM. Not exactly a power box.
"City hall" in German is "Rathaus" Kinda explains a few things......
It was my understanding that SP2 fixed this so that it didn't work on Firefox before the patch. Unless I heard wrong, this is not the case with RC2. Final bits are in August obviously.
There happens to be a plentitude of client applications on a standard XP box with buffer overflow possibilities. Once you're there, go anywhere you want with the privileges of the user on the XP box (which is usually admin, and if not, you can usually get admin without a lot of effort).
This is even further mitigated in MSN, since an MSN message can only contain around 1600 characters... when you take into account the URL encoding required to send any usefull bytes into the overflow, you've only got around 500 bytes to work with for your exploit to run.
I suspect a great many apps have (until recently) just blithely passed commands that have user input into ShellExecute(). Obviously, you can't do that, a fairly clever user can figure out how to get someone else to run a command on their system without their explicit consent. Note that MSDN doesn't mention anything about the possible security implications of it, which is why MS is being blindsided by it. Now, a ton of apps use ShellExecute(), it is the recommended way to launch the correct web browser on a user's system. What I did in my app was before calling ShellExecute(), extract the protocol and compare it against a whitelist of allowed protocols. In my case, I only allowed http, https, mailto, and ftp. If it wasn't one of those four, I just didn't do anything.
The IE situation was discussed before. Even though it works if you actually type it in the address bar, it won't work if you try to access the same uri via clicking a link, or script in a webpage, or whatever. Similarly, if you type a file:// path to a local exe into the address bar, it will run, but that doesn't work via a link.
I'd rather be lucky than good.
to *bash* Microsoft yet again. The article clearly stated that
.....
Microsoft's MSN Messenger and Word word processing application both support a feature that could give remote users access to functions that could be used launch applications on Windows computers,
Unless the SECUNIA people are stupid, launching an app from within another app is what every Microsoft Application is able to do and has been able to do for many years. However I do not think that such feature exists for Microsoft products only. What I am having a hard time distingushing is between Secunia trying to stay on the news and a real vulnerability here. I am not saying it might not exist, but as of this moment I do not see anyone able to run a Shell() command within your app, unless they have gotten to your app, which means they have gotten to your computer already. Also this has existed for a long time. Why now? I might be completely wrong however, and someone at Secunia knows something they are not sharing. I advise them to share any info as soon as possible. The reason I am a little pissed is because in my company I have thousands of Word and Excel documents with thousands of lines of VBA code. With news like this, I smell a panic meeting early in the morning tomorrow which might be nothing more than FUD from Secunia. Honestly I am at a point where I am having a hard time trusting anyone anymore. Hackers want to be my security gurus, OS makers rant and rave about their respective OSes and how secure and reliable they are(only to issue security patches soon after), whole campaigns asking people to boycot a product because of vulnerabilities and use X product, only to find out that X is vulnerable as well. If you look at the stack of firewalls and security appliances at my company, it looks like we're building the walls of damn Troy. I joke with the security guys about the kind of attack they are preparing against. There is hope of course.....but how long before it's too late?
The phaomnneil pweor of the hmuan mnid. Fcuknig amzanig eh!
According to http://www.gnu.org/software/emacs/emacs.html#Stabl e , emacs is on version 21.3. I don't see any reference to 0.21 on the web page or in the ftp file names. And C-h v emacs-version reports version 21.3.1.
Incidentally, does anyone know how high-quality version 1.0 of emacs was?
shell:format
shell:win
shell:deltree%20y%20\
shell:deltree/20y/20\
shell:"deltree y \"
Damn - I'll have to install windoze just to give it a try!
Oh well, what the hell...
At school, I used the "web" toolbar to launch the command prompt (verboten). Security holes are just flying out of MS products, eh?
firefox on my system routinely use 50% of my total ram (out of 320). that's with only 1 window open and 5-10 tabs. i'd consider that "excessive memory use"
it also does the same when im at work
though linux (the whole deal, whichever distro you use, not just the kernel) in general tend to consume insane amounts of ram, firefox/mozilla is the worst so far
I'm going to agree with you.
This is not a flaw in Mozilla, nor is it a flaw in IE, Outlook, Word, or any other part of Microsoft Office.
This flaw is a flaw in Windows, and is typical of flaws in Windows in that the OS is expecting it's applications to handle security, will run any peice of crap handed to it by any app, and we can expect to see more flaws that are similar in nature due to the heavily integrated design of the Windows operating system.
Read, L
I'm sorry, but if it takes 24 days to get past the name calling when confronted with a security flaw deemed major, OSS doesn't stand a chance.
-Lucas
At school the command prompt is disabled, and you can't right click and make a new batch file, and you can't rename the extensions so in order to run some commands all you have to do is write them in notepad, and then tell it save as "all files" and then give it the .bat extension.
We sure did have a lot of fun with the netsends :P until someone put it in a loop and the teacher found out.
ok the notepad maybe is harmless, but
what if the attacker actually launches IE?
There's something wrong with your system, then. I had to open 20 windows and 23 tabs to get even close to that (145MB).
Show me on the doll where his noodly appendage touched you.
Yeah, they were great for all about five minutes. After that it was like the grits cooled off and it just wasn't the same. :P
I don't want knowledge. I want certainty. - Law, David Bowie
It's AMAZING what you can do in 500 bytes... Some of the recent worms are good examples.
No. It's saying "I have a URI I don't know what to do with." This is how non-http URI's work to launch external views such as real player with RTSP:// and such.
Creating a URI handler to execute shell commands is boneheaded. The Mozilla guys knew this but MS failed to fix it. And now we have more MS apps that don't work around this stupid thing. Any guess as to how much other software doesn't block access to this massive windows security hole?
About the only thing the Mozilla team did wrong is underestimate the stupidity of MS.
You've got it completely wrong. As discussed at length when "Mozilla exploit" was announced, this is clearly a Windows bug and not a Mozilla bug. This bug only exists on Windows 2000 and XP. Not on any other OS (Linux, Sun, AIX, Mac, etc.) The fact that Microsoft themselves have supposedly fixed this in XP SP2 tells you that even they think it's a bug.
Mozilla doesn't do what you claim it does. It doens't just see a "shell:" URI and execute it. In fact, Mozilla doesn't know anything about the "shell:" URI, just like Mozilla doesn't know about the "xyz:" URI. When Mozilla runs across a URI it can't handle itself (e.g. http or ftp) it asks the OS if there is an application registered to handle this type of URI. The OS says, "yes, please launch this application with these parameters", and Mozilla does so. This is no different than clicking on a Real audio stream link and having it launch the Real player for you...or a PDF link when you don't have the plugin installed, but you do have Acrobat Reader.
The real bug is that the application that's launched via the "shell:" protocol is the one not properly checking its parameters. Mozilla is just doing what the OS told it to do.
That's only because they have to compare honestly to VI, which is far superior...
...OMGVIVSEMACSTROLL
I don't have WINE installed on my system, or the time to install and configure it, but since WINE re-implements the Windows API, wouldn't it have the function that Mozilla/IE/Word call to execute shell: URLs? Has anybody tested this vulnerability in WINE? Does anybody care what the results are?
Ian
>Cisco, when motivated, can get things done right in the first release.
The key here is "when motivated" which seems to coincide with the output of rand(x)
Need Geek Rock? Try The Franchise!
CorelDraw 2, back about 1991 was excellent. Since it was pre-Truetype and ATM, it had is own font engine, which was quite nice, BTW, if non-standard. Version 3 added support for TT and ATM fonts. I did a lot of work with those appas, still have Draw 3 on hand. I wasn't thrilled with what they did to Ventura though, I stick with the DOS version. As for WordPerfect, once they got the hang of Windows its main problem has been marketing rather than anything wrong with the product.
That's by design. Any ram that's not being used is being wasted. Empty ram is a disservice to everyone -- stuff that could be instantaneous will have to be fetched from disk, electricity is going for nothing, etc. So if you have any empty ram, linux will cache things to speed up access for you. This is a good thing. Except that it leads to clueless folks saying "omg linux is always using ALL MY RAM what a hog!"
This way you can create unlimited numbers of vulnerabilities similar to shell: one. However, does these vulnerabilities belong to IE/Mozilla/MSWord? They are problems of insecure protocol handler themselves, aren't they? (e.g. if WMP has a bug and is exploitable through mms:// URL opened in the browser, it is just a WMP's bug and not browser's).
And shove my one button mouse right up your sorry wintel worshiping *ss.
You CAN download SP2 RC2. It works just fine on my laptop.
no need to say anymore
Uh, I've been doing it for IE and MSN Messenger for the past few weeks - since I was forced to switch from W2K to Windows XP at work.
/savecred /env /user:veryrestricteduser "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
/env (use current user's environment) what you need to do is allow the restricted user write access to your IE required directories- e.g. Favorites, Cookies, Local Settings.
/env and run IE in the veryrestricteduser's environment and allow your normal user read access (and probably write access) to the veryrestricteduser's environment/profile. Then you don't have to allow the veryrestricteduser access to your normal user's directories. The more finely grained ACLs on Windows NTFS could make certain things more convenient.
/savecred on Win2K, so you need to enter the password everytime you launch the shortcut for Win2K or WinXP Home. Savecred works on WinXP Pro.
Create a user called veryrestricteduser and put it in a new morerestricted group and remove it from the Users group. I made the filesystem permissions more restrictive for members of that morerestricted group - so they can't even list files in c:\ only traverse it.
My shortcut for IE is:
C:\WINDOWS\system32\runas.exe
Because of the
Alternatively you could remove the
The latter method is probably safer, but doesn't allow you to share Favorites and Cookies when you do want to browse as your normal user for whatever reason.
You'll probably want to change the icon back to one of the IE icons.
The runas thing is klunkier than setuid and you can't do
If you don't trust other applications I think you can do a similar things with them. For stuff that you really cannot trust, you should run them on a VMware VM or a separate machine.
With Windows NT 4, it was SP4 before it was anywhere near stable.
The point is more that you could link to a Word
Don't confuse pixie dust with angel dust.
"Never attribute to malice that which can be adequately explained by stupidity." -- Hanlon's Razor
It's definitely not lacking in bloated file size.
The Farewell Tour II
I've got to agree, never seen a version of CorelDraw that wasn't ready for prime time.
The Farewell Tour II
Is *Word97* vunerable?
I never got a round to updating since then.
There were 2 service pacs though.
Less features more security?
Abiword ain't too bad neither
Artificial intelligence is the study of how to make real computers act like the ones in the movies.
but it doesn't have so who cares if it would/or wouldn't. lets speak about the facts and the fact is that windows is vulnerable to all this bugs/exploits. MS has more market share and it's MS that gets all the money so it's MS that should spent money also on securing their products.
Congradulations. You have just posted the dumbest post this week!
What about all the win2000 installs?
MS seems to be telling the world "buy XP or else" when they should be patching all vulnerable systems ASAP.
Granted, 2K still gets security patches but its not going to get that new firewall or IE changes. There are a lot of win2k installs out there which will be around for quite sometime until Joe User's computer dies and he buys a new XP machine. Of course, the fate of the 2K machine is still unknown, it could be given to one of his kids, parents, etc.
The zombie problem cannot be solved by SP2 alone. Win2K needs to be addressed just as fully.
Obviously, I can DOS your computer by overtaking your resources by running some app a bazillion times.
I can also use launching apps to say I'm from MS, Yahoo, etc and tell the user to login and change their password (among other things). What user will say "I see you can run apps remotely on my computer but I know this is just the shell URI problem!"
>Or am I just reading this wrong?
Yeah, you're thinking like a techie and not a user. Problem #1 in the industry and here as well.
(shell:windows\system32\format.com)You hate Using windows (shell:windows\system32\logoff.exe)You want to LOGOFF i hold no responsibility for the above links do not click them
If you have nothing useful to say post as AC.
>So you can launch a bunch of Notepads, so what?
A better system would be to have your page download a small trojan and then launch that trojan from the cache using the URI exploit.
Sure about that? If you're in Firefox/Epiphany with Gnome installed (you don't have to using it) try opening this URL: ghelp:///etc/bashrc - Slashcode eats the slashes if I try and put that into an href but obviously that wouldn't occur elsewhere.
For those of you who don't use Linux (or use Konq/Opera), it will open your /etc/bashrc file in gedit.
Note that KDE is equally vulernable to URL handler attacks, see the telnet handler bug a while ago.
You've seen a version of Corel that doesn't crash all the time? Which?
To be fair, I haven't used it heavily since 8, and I've used 10 only a little.... which crashes all the time (try stitching large images in PhotoPaint, ok, you were talking about Draw...)
IIRC that was fixed in 0.9.2
While I can't back it up with links, FF is terribly unstable on my dad's Win 98 box... of course you could say that it's the fault of the underlying OS - Win 98 first edition - but MSIE is remarkably more stable.
Some of the media are saying that some MS apps. are vunerable to the 'Mozilla bug' as if somehow Mozilla causes the problem.
Mozilla should, to protect its reputation, cease allowing downloads of its apps for MS systems, and issue a press release explaining that because MS software does not meet their standards, that they will no longer support Windows versions.
My faith is expressed through Nihilism. Do you understand?
Strange, my whole system uses 240-340mb RAM out of 512. Of course it also uses no swap so I consider that pretty good.
Here at work, 244964k used, and 34564k paged. This is on win2k.
Just a Tuna in the Sea of Life
no i dont mean the ram used by the caches. i know about that.
i am talking about (very) simple applications gobbling up 15 megs EACH (took at look at KDE recently?)
I used the shell command of AutoCAD to hack myself to DOS when everything was shielded off. The other option was Word Perfect.
;)
After that I found out the password for the menu was hard coded in the exe file (searched for 'password' and looked for interesting ascii). After that they moved the password wo a separate file and made it hidden. It took about 3 sec. to find that file.
Etc etc. Anyway... Those were the days, but finding ways to get shells is still funny and interesting
Privacy is terrorism.
> though linux (the whole deal, whichever distro you use, not just the kernel) in general tend to consume insane amounts of ram, firefox/mozilla is the worst so far
Then explain to me how my old p200mmx with 96MB memory runs Linux (slackware with a 2.6 kernel) + X + Windowmaker + Firefox while anywhere recent windows versions (2000, XP) do not even boot on it (don't support the CPU, too little memory)
You, like many out there, are seeing the effects of KDE 3.x and think it is a Linux problem.. well, simple solution, don't install KDE 3 if you don't have the hardware for it.
On Linux that is actually an option you know... you have choice in such things, and can 'tune down' a configuration to fit well within the limits of your hardware, even when that is hardware from more then half a decade ago.
A lot of the time it makes sense (sickening as it may be) to take a shortcut that will take longer to fix in the future than it would have to do it right in the first place.
If you have enough money to develop for 3 months and you have the choice of producing a working product that it will take 6 months more to get right, or producing half of a working product that is done right, the first is almost always the right choice. It's hard to get ongoing development money based on half of a product. Which means, of course, that it will never get done right, because no one is financing it.
> Prudent people might be willing to risk blowing up their pre-release browser for functionality and security, while not be willing to risk blowing up their entire OS with a pre-release patch just to get their browser updated.
Prudent people would eb runnign a stable enough OS that isn't so insanely and cluelessly integrated.
I upgraded my FreeBSD workstation and server last night. Including recompiling the entire operating system and 2 kernels, that took less then 2 hours.
I was quite able to do it in such a way that the upgrade was tested, and that a complete rollback woudl be possibe till the very last moment (and is still pssoible now untill I tell the system to throw away the data needed for it)
OS ipgrades that FIX things instead of introiducing tons of new stuff should never ever cause such problems as you are scared of. WHen they do, it points at one of the following:
- the underlying design was so horribly flawed that it was impossible to fix it without breakign the system
- the upgrade installs new functionality that interfers with your installed software
- the upgrade is broken
Only the first one is not always preventable, but should be very easy to document, the peopel creatign the upgrade KNOW they are changing the design or interface instead of fixing something so it behaves as designed.
I know that what you say is reality when using Windows, but why not try to get to a technically correct conclusion? All you do now is accepting the BS that is being thrown at you since people who do care happened to provide a workaround for the problem instead of actually fixing the problem. Result? you will run into the problem again within some time. Unless you are extremely short sighted, it is very easy to see which costs the most.
actually i don't use KDE, and haven't in over two years. i'm currently using openbox, and blackbox before that (moved due to lack of xinerama support)
right now i have a little over 20 applications loaded, of which a lot are terminals. the X server itself takes 10% of my available ram. firefox takes 15% (one window, one tab), openoffice 9% (with one 3 pages document loaded), the java vm 7% (proprietary CVS-like application) and evolution 7% (with lots of mails and accounts, that one is reasonable).
now that's some of the lowest numbers i've ever seen. it isn't rare the X process is around 40-50% along with firefox. that doesn't leave much for the rest of my applications to run, especially since the X process can't be swapped out (always being used).
this box is a p3 500 with 375 megs of ram. it IS insane use of memory.
linux can run on a decade-old computer in shell mode no problem, but don't even think of running X on it (i tried, it "run" but, like running windows xp on a 486, you won't do much with it)
btw distro is debian sid, with the "prelink" package (did the same before i installed it too)
Not that I can see how running gedit as myself on a file is a bad thing.
This is even further mitigated in MSN, since an MSN message can only contain around 1600 characters... when you take into account the URL encoding required to send any usefull bytes into the overflow, you've only got around 500 bytes to work with for your exploit to run.
All malware writers need to do is to discover the concept of "bootstrapping" their exploits.
> this box is a p3 500 with 375 megs of ram. it IS insane use of memory.
As someone else pointed out in this thread, it is not insane, and depends almost entirely on how much memory you have installed.
Have you for example ever tried what happens when you remove 128mb memory? or add 128mb?
Chances are it will run just as smoothly with 256mb, and maybe even less.
Now, try to get XP to boot with less then 256MB, let alone running any application whatsoever.
> linux can run on a decade-old computer in shell mode no problem, but don't even think of running X on it (i tried, it "run" but, like running windows xp on a 486, you won't do much with it
And that is complete and utter rubbish, sorry.
First of all, windows versions starting with win2k simply do not support the 486, and actually support nothing lower then a 686 class cpu (pentium-pro and up), so no, you can't even try booting it on such hardware.
Next, people are running Linux + X on 486 and early pentium class machines. It does require having enough memory, sure, but depending on what you are doing, enough can be anywhere between 32mb and 2gb on such hardware. For running X + firefox you will definitely get away with 128mb, 256 will really make things go tho. Why? because of the caching it allows.
I do use a only slightly more recent machine myself as I already pointed out, and I do run X on it (you can read, can't you?). I don't know which percentage of memory Firefox uses on that machine, but I do know that it is never ever swapping, and feels more then snappy enough to use for browsing. I don't run a java vm on that machine tho, that is the one way in which to get that machine to swap like hell if I want it together with X.
Anyway, the p200 is mostly used as a browser and an X terminal. When running non browser and non multi media stuff (ie: OOo) it runs on a server, which is doing that job for upto 4 concurrent users currently. Machine is a dual cpu pII 333 with 512mb memory. Despite the fact that this machine runs upto 4x OOo, 3 virtual machines with apache2 with php, a mysql server, squid and some mail related stuff, this machine is still never ever swapping.
Ah well, all you seem to be able to convince me of is that you have little clue what the numbers mean that you are seeing.
Sadly enough, this is exactly why the old 'windows' way of just saying x% of the resources are in use makes sense, it is perfect for people who are clueless as to how to interpret actual information, and/or clueless about the workings of an operating system.
For example:
> now that's some of the lowest numbers i've ever seen. it isn't rare the X process is around 40-50% along with firefox. that doesn't leave much for the rest of my applications to run, especially since the X process can't be swapped out (always being used).
First of all, the fact that the X server is always used doesn't mean that all memory it may have allocated for a zillion different reasons is always being used and can't be swapped.
The days where Unix like systems would swap entire processes only are long gone, and Linux is able to *gasp* do what for example Windows can do as well.. swap memory in/out by memory page (4k for traditional x86 systems, tho nowadays pagesize can be set to different values depending on requirements).
It does so depending on a few conditions, one of which is if the memory has been used recently or is likely to be referenced in the very near future . How busy or not the process is that its part of however plays no direct role in this.
You may also find that when starting a new application, the OS can all of a sudden find available memory by dumping some cached data, and unmapping some not recently used files from memory.
As said before by someone else, Linux (and the same applies to for example FreeBSD) tries to make optimal use of available memory instead of trying to keep as much of it free as possible.
So do yourself a favor, and learn what the numbers mean and how the underlying system works before even trying to make sense of them.
alright. i'll rephrase that. the X server ISN'T being swapped out. better now?
and i'm using %s because it's just easier for a quick post on slashdot. if i ever want to do benchmarks i'll use hard numbers
and that still doesn't explain the 150 megs (happy now?) of memory use by firefox. that's RSS, not VSZ
enough of it. until you (or someone else) can give me a solution, or at least a reasonable explanation to that insane memory usage, i stand by what i said.
and quit spouting off your bullshit about caches, and read what i said properly. i already stated this isn't a cache issue, it's a pure memory issue
So, next year?
vsz 56908K rss 47772K here.. and?
WordPerfect is at 12 now? I remember when they went to version 6 and a month or so later micrsoft went from Word for Windows version 2 to version 6. ( it was sometime ago but i clearly remember there was no version 5 ) [a google search found http://www.emsps.com/oldtools/mswordv.htm ] granted there was a Word for DOS 5.5, but after that they dropped version numbers like a hot potato.
KDE 3 runs fine on pentiums with 64 mb ram.
ya thanks actually by being totally in denial, and blaming windows for things that are not the fault of windows, your insult (like that is a real insult) has absolutely no meaning.