Slashdot Mirror
GDI Vulnerabilities: An Open Letter to Microsoft
UnderAttack writes "Tom Liston, the guy that brought us the LaBrea Tarpit, wrote an open
letter to Microsoft regarding the GDI JPEG vulnerability, and Microsoft's scanning tool for this vulnerability, which he calls 'worse then useless'. Tom, who wrote his own scanning tool, ends his letter with 'Please stop treating your customers like idiots and give us information; information that we can use.' Like Tom explains, the official Microsoft scanning tool misses a lot of vulnerable DLL's installed by third parties, and Microsoft fails to explain if these libraries are a problem or not."
Sooooo, how exactly is MS responsible for all 3rd party DLLs?
Well, it's a nice try, but I doubt they'll do anything because of this letter. Hopefully, I'm dead wrong.
The Blaster Master Fighting for Truth, Justice, and Evil Pie since 1979
http://isc.sans.org//diary.php?date=2004-09-26
Handlers Diary September 26th 2004
Updated September 27th 2004 13:11 UTC (Handler: Tom Liston)
GDI Vulnerabilities : An open letter to Microsoft
GDI Vulnerabilities: An open letter to Microsoft
Dear Redmond Folks:
When I was but a wee lad, we lived in a rather large, old house that had, among other charming qualities, a basement that would make even the bravest soul think twice before venturing downstairs. It was cavernous, ill lit, and, quite frankly, always smelled a little funny. My older brother, as older brothers are wont to do, would tell me fantastic stories about why the basement had that odor; generally centering on some unfortunate past resident's demise. I hated that basement.
My parents, in a vain attempt to rid the basement of its malodorous "twang" purchased a dehumidifier which, because there was no electrical outlet anywhere near the floor drain, required emptying on a daily basis.
And, no matter how many times I begged, bribed and pleaded with my older brother, he would somehow know when I was making my daily trek to the basement and, as I was down there trying to pull the heavy bucket out of the dehumidifier, the lights would suddenly snap off, the basement door would slam shut, and I would hear my older brother's voice wafting down from above: "It's cooooooooming..... It's cooooooooming to get you......."
And there I stood: alone in the dark, unknown terrors approaching, armed only with a bucket of water.
Which is, curiously enough, almost exactly the position that Windows users find themselves in today: alone in the dark, unknown terrors approaching, but in their case, having a bucket of water would be an improvement.
MS04-028 is, perhaps, the epitome of bad technical writing -- the literary equivalent of spaghetti code. I've read through it far too many times, and I still understand far too little.
Your "GDI Scanning Tool" is worse than useless. Run it, and it tells you that you "may be vulnerable", and directs you to Windows Update and Office Update. Go to Windows Update and update everything you can find. Go to Office Update and do the same. Run the scanner again, and it tells you that you "may be vulnerable", and directs you to Windows Update and Office Update. Lather, rinse, repeat.
[Which is why the ISC has made GDIScan.exe and GDICLScan.exe available. See http://isc.sans.org/gdiscan.php for details.]
What about those old gdiplus.dll files that we're all finding in our Side-By-Side DLL directories? Are they a problem? Why are you updating sxs.dll? Is there vulnerable code in there, or did you just rig it to avoid using the bad code in older versions of gdiplus.dll? (Hey, if you had asked me years ago, I would have told you that this was a serious problem with your Side-By-Side implementation.)
When a third party vendor wants to distribute a Microsoft DLL with their product, don't they have to get permission from you? Wouldn't there be a list somewhere in Redmond of the third party applications that have distributed vulnerable copies of gdiplus.dll? Can you tell us what they are?
Please stop treating your customers like idiots and give us information; information that we can use.
In other words: Turn on the lights and open the door. We're ready to come back upstairs now.
-TL
Handler on Duty : Tom Liston ( http://www.labreatechnologies.com )
When you need this tool, we will tell you and provide it for you. Until then, please continue buying our other tools.
Bill
In my SUS server at my corporation, I disabled this stupid tool because all it does it pop up with some confusing error message that the end user does not understand. Then they would all just call me asking about a weird popup they got on their screen. I am deploying the windows patch via SUS and the office pack via scripts, so there is nothing for the end user to do anyways.
I'm afraid that Microsoft dosn't know any better, they can't give you what they don't have.
--- No, english is not my mother tongue.
Do not go to the peoplesprimary.com site.
Last time I looked they had a javascript in place that automatically posts the contents of your "Copy" buffer to a remote server... and then displays it for everyone to see. Not good.
No, MS IS checking third party software, but not updating it, and still warning you about it. And warning you without telling you exactly what is wrong, the worst kind of error message, one that Windows is quite fond of.
My blog. Good stuff (when I remember to update it). Read it.
weirdest.. open letter.. ever
You don't even need third-party stuff or an application to make it hard under Linux. Typical cycle is: kernel version x comes out in March. It's in a Red Hat release in July. Vulnerability found in September, with an immediate release of version x+1 on kernel.org (which also has a lot of changed/evolved drivers etc.) Red Hat back-patches the fix to version x and makes a new funny version number to signify this. They might include a couple other things from x+1 in the back-patch to version x. Except that the funny redhat version number doesn't signify much to anyone on the surface.
Similar things happen for Red Hat (and other branded linux binary distributions) of Apache, SSL, etc., things that are all quite critical and you'd hope would be crystal-clear as to which patches your version has or doesn't have.
Now finding whether version X of a library or application has a vulnerability patched usually isn't too hard. And Red Hat does a pretty good job of keeping on top, way better than say Microsoft.
Disclaimer: I'm no fan of Microsoft, but I'm not a big fan of Red Hat (or, as I prefer, Head Rat) either (or any binary linux/gnu toolchain/popular application distro for that matter).
...to ignore.
This is my sig. There are many like it but this one is mine.
Dear Tom,
Next time, less cutesiness and more explaining what the fucking point is.
HTL. HAND.
The argument is that these companies need permission from MS, who should then have a master list of who asked for permission and why.
But, I'll bet that MS gives developers permission to distribute these with Visual Studio, which would mean there is no way that MS has a master list--moreover, much of the software may be for internal applications and the developer is long gone.
So, any VB program that does image manipulation may be poetentially vulnerable.
The funny thing is.. no slashdotters are windows users until a cool tool like that NASA world wind one comes up.. then suspiciously its slashdoted. .
Yes, Microsoft should be responsible, when those people who wrote the code using Microsoft dlls are distributing a vulnerable version of the dll. Microsoft approved the distribution of the dll, so they should know who did. It's a nightmare for Microsoft, but it is their job as the creator of the mess in the first place.
Most users ARE idiots. It seems completely appropriate that they should be treated this way. I very much mean this.
Yes, the slashdot crowd and others might do well to receive more information regarding vulnerabilities and fixes for them, but the average user would be overwhelmed.
I once mentioned to a gentleman that the standard encryption on an 802.11b WAP wasn't entirely secure and he panicked. He asked if hackers would steal his credit card and social security numbers. I asked if he ever shopped online or transmitted those numbers across the internet to which he replied emphatically no (he didn't even store them on his computer for that matter). He still did not understand that a "hacker" can not steal his information from a WAP if it was never there in the first place. He promptly switched to using a ethernet based network.
Most people are too stupid to be told even the fisrt thing about security. Better a patch is provided that works and they use it. Seeing as how the patch was not complete in this case, that'd differenty, yet the users should still be treated like morons.
-dave
http://millionnumbers.com/ - own the number of your dreams
Any valid points the author has about the uselessness of the tool, or the general state of affairs with security at Microsoft, are dimished by his pompous attitude and snide remarks.
Why not write a technically detailed letter about the code you find (since he read it so many times) and perhaps offer some constructive alternatives to improve it?
Not only would it be more interesting to read, but they might actually be more willing to consider it.
Okay, everyone. One...More...Time...
RTFA!
I thought the LaBrea Tarpit had been around for millions of years....
I spent about 45 minutes reading docs at MSDN/MSKB trying to find an explicit statement that IE6SP1 on Win98 is vulnerable, and I swear that they don't actually state that fact (explicitly) anywhere! I eventually was able to read between the lines and conclude that Win98 isn't vulnerable, but Win98 + IE6 is, so you should run Windows Update to DL the patch.
Am I certain? No. Like I said, it's very difficult to find answers to very simple questions in their docs sometimes. I especially hate reading their security bulletins because it's like they were written by very technical lawyers who are trying to maintain the illusion of releasing information without actually doing so. As often as is possible, I try wait a day or two for the DHS CERT to issue their bulletins because they do a slightly better job of relaying useful information.
"Lawyers are for sucks."
- Doug McKenzie
Actually, according to TFA, your analogy should be:
"My home-built kit car has a Ford engine. There's a problem with the engine. Ford needs to fix it"
"She's furniture with a pulse"
His letter might as well read:
It seems that Microsoft, for all its blustery and arrogant, dismissive attitudes toward end users, manages to find itself in a quandary. If it releases too much vulnerability information, it could very well help exploits be written at a faster clip; if too little, then it risks being irrelevant. The timing is tricky too in this case.
Another problem, though, may have something to do with the audience. Trying to be "all things to all people" (including less-than-clueful admins), it is likely that they decided to "dumb down" the announcement, in short proclaiming that your computer "may be vulnerable". Some could argue that it is language of FUD, but I would say that they are trying to impress on as many people as possible that this is not just another "critical" update. This one is really, really critical.
I guess I am too smart for my own good... It told me to only check Office update as it seemed to know that I was already up-to-date on the OS side.
So I go over there and download/install the updates. The only problem I saw with it was that I had to supply my Office CDs during the install (and it warned that might include a key -- luckily I had both in close proximity). If MSFT fucks up I shouldn't be the one that has to produce the CDs/Key to fix it. MSFT should happily go about the update without needing either of those two things. They shouldn't be allowed to check for piracy during a security fix.
That's at least how I saw it.
So I was all patched up according to the Windows Update and the Office Update sites and I figured I was done. Maybe I was too smart for my own good?
For a better analogy, Microsoft is refusing to pay Child Support for its bastard child.
Zagreus sits inside your head, Zagreus lives among the dead, Zagreus sees you in your bed and eats you in your sleep.
Has anyone ever sent a closed letter?
Yes, Microsoft should be responsible, when those people who wrote the code using Microsoft dlls are distributing a vulnerable version of the dll. Microsoft approved the distribution of the dll, so they should know who did.
No, MS should not be responsible for fixing code that third parties distributed using their code libraries. Just as no F/OSS code library project should be resonsible for trackind down anyone who might have used their code library.
However, MS should do a better job of making it clear to third party developers that the DLL may be included in their project (often without the knowledge of the project. Visual Studio does a great job of hiding the relevant DLLs that get loaded into a project.) None of the MS advisories on this that I have seen have included any recommendation to developers or consumers that they need to take additional steps after patching their system.
MS should, though, have produced the tool that Tom Liston did. His scanner is 7k. Surely MS could have come up with something like that--and if you run Tom's GDI scanner, you'll note some places where it identifies possible problems. MS would be in a much better position to be know if that is the case and thus able to provide better information.
So, I disagree with what you are faulting MS for, but not the fact that MS should be faulted.
Please look up what the semi-colon is used for; it should be used in place of a period for emphasis.
Apologies for my grammar correction, but is seriously irks me when someone decides to send *an open letter* to a company and doesn't check for grammar, punctuation, and spelling mistakes. Or does OpenOffice not support these features?
I currently have no clever signature witicism to add here.
The Microsoft tool also misses several of Microsoft's own products, including the Office Viewers like Word viewer, Excel, Powerpoint, and Visio, all of which are vulnerable to the jpeg vulneraility.
My parents, in a vain attempt to rid the basement of its malodorous "twang" purchased a dehumidifier which, because there was no electrical outlet anywhere near the floor drain, required emptying on a daily basis.
Uh, an extension cord perhaps?
Rule #1 You do not talk bad about Linux Rule #2 You do not talk bad about Linux
... first class on day one, they would cover off not including some pointless story about your childhood home which comprises half of the letter and has absolutely no relivence to the point of the letter, other than to say that windows users are "in the dark".
Don't get me wrong, the letter itself was justified, and the author is right about the tool by microsoft I'm sure. But why is that story in there, to make sure that someone at Microsoft doesn't actually read it?
----- sXe
This just in! Massive security flaw found in microsoft copyrighted code, which lests the hacker take over the users machine:
int main(){
printf("Hello World!");
}
Microsoft recommends heading over the windows update to patch this flaw.
A morning without coffee is like something without something else.
That was a strange letter. The site was already /.ed, so I read the letter in an AC comment, and kept waiting to get to the part about CmdrTaco. Never happened though.
with a letter like Tom wrote, he'd kind of deserve that response. What is he, thirteen? Microsoft will probably push it around in a little circle of their corporate bureaucracy but with little in the way of enthusiasm. How can you not put that letter in the angry, political, CS major pile?
/.'er but come on, even I can an effective letter critical of a companies product. Even as a lame attempt to curry favor with the disaffected masses, it manages to be rambling despite its brevity.
I'm as antisocial as the next
MS has written lots and lots of proza about this vulnerability, but I still don't know how to download the new updated gidplus.dll to redistribute. I've applied the update from windowsupdate.com to my computer, but I guess it would be a good idea to distribute an updated version to our customers. I just can't seem to find it anywhere.
This sig under construction. Please check back later.
It's called an envelope.
Anyone else getting this from the current version of Nero:
C:\Program Files\Ahead\Nero Toolkit\gdiplus.dll
Version: 5.1.3097.0 -- Vulnerable version
Thats like saying there is some country out there with a nuke that doesn't like the US. Do we just start randomly blowing $h!t up and hope that solves the problem?
Okay, bad analogy.
I'd have been happy if their "list of affected applications" was even remotely accurate. They say Office 2003 and .NET Framework 1.1 were vulnerable, but if you had applied PREVIOUSLY AVAILABLE updates to either of those products, then, in fact, they weren't. Mentioned anywhere in the KB article? Nope, the user has to figure out for themselves that even though they haven't installed any patches for this vulnerability for their products on the "affected" list, they're not actually vulnerable.
Not to mention that their client scanner for the Windows vulnerability didn't even correctly identify vulnerable machines until several days AFTER the initial patch was release.
This was a badly handled security update, even by Microsoft standards. I think Microsoft should start focusing at least SOME of their efforts on some sort of security initiative or something.
Indeed, Netscape, which also uses that code for its JPEG decoding had that flaw (but it was fixed earlier, and of course, it did not make the news nearly as much as this Microsoft issue, owing to its much smaller market share.)
http://www.openwall.com/advisories/OW-002-netscape -jpeg/
There's 10 types of people in this world, those who understand binary and those who don't.
Feminist-Mom is an obvious troll. Check out some of "her" other posts. Someone with the power to do so needs to get proactive and take obvious trolls such as Feminist-Mom and set them to automatically post at -1 Troll. Otherwise slashdot is going to continue to go downhill as it has been doing for quite some time now.
an open letter to microsoft?! wow, that'll show'em.
Liberal (adj.): Free from bigotry; open to progress; tolerant of others.
So you're saying most lefties really aren't liberals, and a lot of conservatives are? That would be my conclusion.
You are in a maze of twisty little passages, all alike.
Okay so the tool found some problems.
What is the best current work around for this?
(or is the point there is no good work around?)
Correct me if I'm wrong, but doesn't using shared libraries the way linux does avoid exactly this problem of having one library installed a dozen times on one machine and thus being virtually unable to fix serious security holes?
And can I use this story everytime someone tells us that software installation on linux should be the same as on windows?
I've been trying to clean the system from spyware and other mallicious goodies. Finally firefox works with pogo.com so IE is now not in use at all. I managed to find a site that posted ALL of the startup locations for XP. And this has stopped the lurking spyware in the background.
However I'm still looking for a site that can direct me on how to delete the malicious DLL's that are loaded up with IExplore. Anyone have any tips?
I got that message, did everything it said, got the message again, and figured MS was on crack, reporting problems that didn't exist.
It's good to know, instead of them being on crack, they're just failing to actually solve any problems, present any logical ways to solve them yourself, or even tell you exactly what is wrong, but there is actually a problem.
I guess you're supposed to search for the filename you weren't told and check and see if the version is higher than the vulnerable version you weren't told, so you can go and download updates from Microsoft's website at the URL that you weren't told.
It's certainly an interesting defination of 'Automatic Updates'. It's like a giant idiot light for your computer saying CHECK ENGINE, but it says UPDATE SOMETHING.
If corporations are people, aren't stockholders guilty of slavery?
A vulnerability in libjpeg would be a planet-killing event, akin to the Earth being hit by an asteroid the size of Texas. Yet, no vulnerability has been found in over six years since the last release, despite the source code being freely available. Too bad Microsoft apparently decided to write their own decoder.
http://shit.slashdot.org/article.pl?sid=04/09/27/1 649256
If your Ford had a Harley engine in it (which compared to my truck, might as well be the case), then yes, Harley Davidson SHOULD be able to fix it. Also, next time you need something that doesn't have a lame engine, buy a real truck, dipshit.
My home-built kit car has a Ford engine. There's a problem with the engine. Ford needs to fix it
Well, yes. If Ford has a manufacturing defect in their engine, they do need to fix it. In keeping with the analogy, this Ford engine may well reside in a Saleen car.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
Yes, when my Ford pick-up is having engine trouble, I always drive it to the nearest Harley Davidson to get it fixed.
You might if it was a Harley manufactured component that was failing.
Or, more accurately, if you have a Ford car which you've installed a Kenwood stereo in, but that stereo uses a special Ford component to integrate with the car; then if that component failed, who would you expect to fix it?
Learn how to spell!
I think "learn how to cut-n-paste" would be the appropriate admonition.
I am not a crackpot.
You aren't willing (or able) to back up your claims? Come clean, are you really Dan Rather?
You are in a maze of twisty little passages, all alike.
I have serious doubts that this 'open letter' will draw a response of any kind from our pals at Microsoft. If it takes more than 15 seconds to get to the point, it's going to get scanned in Redmond. I have heard repeatedly of management and strategic meetings (particularly those run by contracts, vendors or other "outsiders") wherein people will simply stand up and walk out if they aren't implicated in the first two minutes. The travails of a boy terrorized by a sibling won't keep a busy exec from his IM session with the Portuguese yacht firm that's fitting out his troller. Live and learn, eh? Too bad though, it's really a rather compelling tale of deceit and greed. I wasn't expecting the part at the end about the snake.
"The Borba"
Intentionally spreading FUD about their _own_ products?
Actually, I was trying to be Insightful, not Funny.
he said he likes purple flowers with sprnkles on top.
See Sig! See Sig Zig! Zig Sig Zig!!!!!
http://litepc.com/
Open Letter to Micr0$haft, I had a basement which smelt, and my brother would lock me in and yell at me saying: "It's cooooooooming..... It's cooooooooming to get you.......". And there I stood: alone in the dark, unknown terrors approaching, armed only with a bucket of water. This is exactly like Windows. I can't read your code because it is spaghetti code. Your "GDI Scanning Tool" is worse than useless. stop treating your customers like idiots. Windows sucks, I hate you x 10, -TL
Moin,
:) revese their decision and do not bundle libs but require them.
other OSS libraries also sometime bundle libraries like libzip, libpng etc. A prominent example (but not the only one, don't want to pick on them!) is Irrlicht:
Thread
I voiced my concerns in the linked threat, so far they were not compelling enough. I hope that the IrrlichtNX developers (and maybe also Nico then
This is also directed towards other libraries that simple include some version of a library they need instead of linking against the installed version.
Best wishes,
Tels
I have a dumb question. I admit it's a dumb question, because I've spent the last twenty years of my career working with non-Microsoft operating systems and products. The answer may be obvious to someone with that kind of experience, but not to me. So here goes:
Why the hell are there multiple copies of the same, critical, shared system library floating around on the machine?
See, where I come from, you have one copy of shared system libraries -- the latest one, with all the latest patches. This library is fully backward-compatible with all its predecessors. Further, the shared system libraries are all in the same place, so you know where to go looking to drop in updates or, if needs be, regressions. (On very, very rare occasions, there'll be a copy of a specific version living alongside the (by definition, broken) application that needs it.) This approach leads to clean system maintenance and ensures that all applications are using the same, up-to-date, best performance, most secure version of the system libraries.
So why is Windows different? Why are there a zillion copies of GDI+ laying around? And why would you want it that way?
Schwab
Editor, A1-AAA AmeriCaptions
No, software should work AND look pretty. Just because form follows function doesn't mean it should be completely disregarded.
And why cant they enforce a piracy check on EVERY update? Eventually they will anyway..
.. 2 day grace period for weekends, and without it, we couldn't do business.. no alternative choices).. It also required admin rights, so once a month I had to login to the damned machine and do the process, manually.. And god help you if you need to reinstall... what a nightmare..
its their software, they can make it expire each month and force you to renew.. Don't laugh, I had to deal with software like that.. every month it had to phone home to verify we were current with our nearly 1000$ a month maintenance contract.. or it would die.
That said, it *would* be annoying to have microsoft do this, and might be a problem with enterprise installs. prompting users for things they shouldn't know..
But hey, make it too hard to use their products, people will start looking for alternatives..
---- Booth was a patriot ----
I am surprised that Microsoft does not do what Linux does and have a common DLL provide all the JPEG functionality. At least in Linux, most, if not all apps, use libjpeg.so.
Fixing a problem like this in Linux is trivial. Only libjpeg needs to be patched, and automagically, all apps that depend on that library are also rendered invulnerable.
We saw this with png and other shared libraries. Also, offering many of these common libraries as DLLs helps reduce code bloat since every app no longer needs to reinvent the wheel.
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
arg forgot the link:
:) revese their decision and do not bundle libs but require them.
Moin,
other OSS libraries also sometime bundle libraries like libzip, libpng etc. A prominent example (but not the only one, don't want to pick on them!) is Irrlicht:
Thread
I voiced my concerns in the linked threat, so far they were not compelling enough. I hope that the IrrlichtNX developers (and maybe also Nico then
This is also directed towards other libraries that simple include some version of a library they need instead of linking against the installed version.
Best wishes,
Tels
My college classmates and I had a term for this. We called them "flashy people". As you described them, they're the people who value looks over functionality. There's a small bit of play on words with Flash there, too, since flashy people (usually a part of management and/or graphics design) are the ones responsible for demanding the Flash animations for a corporate/product page that prevent a more straightforward display of content.
kulakovich
What's the procedure for updating third party gdi installations?
And at a fundamental issue, why does my system need multiple copies of this gdiplus library? Isn't the whole purpose of DSOs to avoid needing multiple copies?
remember the zlib vulnerability and static linking? you had no shared library to detect, the vulnerable code was in zillions of apps, inside them! (and could still be in many old binaries, without people realizing)
I bet he won't get a response from anyone at Micro$oft who matters...
...is that when you're small, scared, and alone in the dark armed only with a bucket of water, you have an uncontrollable urge to pee.
Micro$oft has based its business model on just that assumption; screw the customers and they keep coming back for more, complaining all the way. Ironically, most of them even brag about how good a screwing they got! Meanwhile, M$ just laughs all the way to the bank! SUCKERS!
He just needed to patch his brother.
I think he could have used an extension cord and the bucket of water...
Randy.Flood@RHCE2B.COM
What site do they post to? I want to see! although I suspect most of them will be "peoplesprimary.com". Also, for those that have not gone there yet, there's a loud background sound that repeats "hey everybody I'm watching gay porno", and hundreds of popups appear, and no, firefox does not block them.
CERT and Bugtraq also MUST be shutdown if users don't use this info. Might as well just write the software authors when a bug is found. Quiet-like. MS would approve."
The problem with this scenario is that exploits would be less public, and more private and nasty. No public pressure to fix. Those who wanted to protect themselves really couldn't.
The bulk may be [l]users, but the few who are not drive the business, and to some extent, protect everyone.
shutup, IDIOT!
Hi Tom,
I remember back in the day when I used to rat-race CAT's just for jollies and hack on CP/M systems for the money. Those were good times.
But, frankly, as I have aged, a couple of things have come up: one, I know have a helluva' property-tax to get out of...er... pay, yeah, pay. And you think we can send all those poor kids in Africa medicine with cheap software? No sir, buckeroo, it requires a lot of dough.
As for treating our customers "like idiots", I take umbrage at the remark. We treat everyone exactly the same. No favoritism. Except for Michael.
We have responded to the problem. After all, we have said security is job #1. Well, actually, we said profits, didn't we? Okay, let's call it job #2. Or maybe #3? We can't forget all those poor African children. Or do you have something against African children, now?
Again, I hope for the best for you. Perhaps this is merely a subject you and I can agree to disagree.
Your pal,
Bill
IANAL, but I've seen actors play them on TV
It's a tough job if you want the absolute highest currently available level of security.
The Linux problems that get found (and usually fixed within a very short time indeed) are mostly theoretical vulnerabilities that nobody would even bother to report on Windows. For example, last month there was a vulnerability (now fixed) that could, theoretically, enable an ordinary user to get root access.
Nobody would ever report a flaw like this in Windows, because everybody knows it is trivial to do on Windows. (E.g. the shatter attacks.)
For reasons like this, any reasonably recent Linux distro is more secure than the latest patched version of Windows.
Did a file search and found 13 *gdi*.ddl files on my XP Home + SP2 system. Liston's scanning program reported the following warnings:
* \G diPlus.dll
* \G diPlus.dll
C:\Program Files\RecordNow!\gdiplus.dll
Version: 5.1.3097.0 -- Vulnerable version
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus
Version: 5.1.3097.0 -- Possibly vulnerable (Windows Side-By-Side DLL)
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus
Version: 5.1.3101.0 -- Possibly vulnerable (Windows Side-By-Side DLL)
To-do List: Receive telemarketing call during a tornado warning. Check.
Another Amen. Judging by the tone of Tom's letter, he apparently doesn't want to be taken seriously.
© 2004 The SCO Group, Inc. All Rights Reserved.
Assume: Microsoft Windows is useless, Scanners are less code than Microsoft Windows
GDI Scanning utility is a Microsoft Windows Scanner
All Microsoft Windows scanners are less than Microsoft Windows
Therefore, GDI Scanning utility is less than useless.
Cliff Claven
K.E.G. Party Chairman
Founding Leader of: Koncerned for Egalitarin Governance
No, this is incorrect. MS is not checking 3rd party software and warning the user. MS is only checking MS software, but not all MS software on the computer, and then giving a message that, for instance, MS Office 2003 may be vulnerable and that you should update via this link (insert link to office update). However, after getting there, you may scan for updates and see that there are none. Running the GDI scan will give you the same message.
MS' GDI vulnerability scan tool does not mention 3rd party software.
The truth doesn't care what I think.
Microsoft PPL think we're idiots because they're idiots, too. They can't seem to distinguish that there are VARIOUS KINDS of users. Dummies, informed, advanced, experts, and superpower users.
They may not want to confuse a user with bloated information he doesn't need. But they should provide the info for us advanced users, anyway!
Wouldn't you like in MS apps to give you access to "advanced" information when you click a button?
i.e.
BEFORE: "The current application has terminated abnormally"
(advanced)
AFTER: "The current application, process executed by filename.exe tried to read at address xyz. This address is currently in use by process mnop."
Or in this particular case
"The following DLL's were found defective:
c:\program files\yaddayadda\yatta\gdiplus.dll" which was installed as part of application "Yatta Plus!".
(Finishes list)
Do you want to?
a) Replace defective dll's with fixed ones whenever possible
b) Delete defective dll's and render applications unusable (but safe)
c) Nothing.
Hey, how about other vulnerabilities in the MS knowledge base?
"A vulnerability has been found that permits a user take control of the system" (Hey, big deal! We already know that. Why don't they tell us:
"A workaround would be to disable X and Y service from windows XP. Click here for more info."
The same when i accidentally delete some file that is used by the system (hey i didn't know netmeeting was required!)
I only get something like:
"Warning! You idiot deleted some critical file. Insert the CD before the next reboot OR ELSE!"
Instead of:
"You deleted critical file xxxxxxx.yyy. Please insert the CD, or try to specify an alternative directory.
This is something that's ALWAYS bothered me. That Windows takes ALL the decisions for me.
According to NTBugtraq's article, TiVo has software package that allows a user to setup an Image and Audio server on their PC. When connected to the same LAN as the TiVo it allows the image and audio files to be viewed on a TV via the TiVo DVR. The software uses gdiplus.dll file that has a JPEG parsing engine.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
It's not Microsoft's code, it was written by the IJG - independendt JPEG group.
I feel the need to lay out some ground rules before we go on:
1.) Microsoft is somehow responsible for all third-party DLLs on a system. Their scanner must contain a self-sufficient, learning AI that just "knows" which DLLs to scan on any system in existence.
2.) Mozilla was affected by this same vulnerability, but it's okay because it's Mozilla and not Microsoft.
3.) When Mozilla's XUL bug was marked "Confidential" since 1999 only to be revealed earlier this year when exploits came out for it, that's okay too. There won't be any "open letters" to Mozilla over it, because it's Mozilla and not Microsoft.
I hope we can all follow these simple ground rules in the discussion to follow. Thank you.
public class HelloWorldApp {
//System.out.println("Hello World!");
public static void main(String[] args){
System.out.println("Your computer may be vulnerable!");
}
}
In related news, the Las Vegas Prostitution Association has demanded that its female members stop being called "hookers" and "hos". They suggest the replacement term "copulatory assistant".
(Sorry. But, hey, it's Slashdot.)
and just buy your standard Windows GDI implementation from a different vendor that is more responsive to your needs and more willing to negotiate and work with you on cost discounts for flaws in their product.
I mean, isn't that what you're supposed to do when a supplier feeds you something substandard?
"Provided by the management for your protection."
... really seemed to be a lot more about his parents' basement than the Microsoft jpeg vulnerability.
"Stop throwing the Constitution in my face, it's just a goddamned piece of paper!" - George W. Bush Nov. 2005
Until Microsoft become a profit organisation rather than a tax-harvesting one, then they get all the stick they deserve.
Thankyou,
h
Patriotism is a virtue of the vicious
If anybody knows anything about sticky situations, it's gonna be this guy.
Real programmers can write assembly code in any language. -- Larry Wall
Big problem with the "one copy only" approach - DLL Hell.
When you have library 'foo' that is used by three different programs, what happens if someone upgrades one of these programs in such a way that one or more of the existing programs are broken. That is why you can install DLLs in a "side by side" manner.
It should be noted that people bitch equally heavily about DLL hell, and the existance of this situation is the downside of a remedy for DLL hell. Cannot have it both ways...
So can I use the command line to see if my Mandrake 10 is vulnerable? It must be Gimp...oh wait...
Linux had similar issue
...just a rational thought, ignore it if you can't handle such a thing...
Or is it ok since it was a linux thing???
the senseless biased story leadins/bashing-baits/troll-foods/zeelot-baits are getting to be a joke. Lets try sticking to worthy IT news item and constructive critique...could be a good thing to have a lot of people actualy HELPING the non IT that visit slashdot, instead of filling their minds full of FUD.
What does being a monopoly have anything to do with some vulnerability scanner? Tell me, what exact rules are "different?" You can't, because it was a vague, irrelevant statement that has nothing to do with this. You didn't refute any points.
Was it okay that Mozilla's bug was marked "confidential" for five years?
is that Microsoft should have made this app look for and identify any copies of the vulnerable windows components (including GDIPLUS) stored anywhere on the system. Then there should be a simple way to get the latest version and replace the old copy with it.
:P
Course, that then results in dll hell because breaks with the new version which is why they shipped the old version in their app folder in the first place
"You regularly use devices, or the products of devices, that you can't even begin to describe the manner in which they function"
Speak for yourself. Or, maybe you are. Sorry, not EVERYONE is like that. I look at anything and everything and wonder how it works, what its chemical structure is, how the atoms vibrate and where electrons are. I think about quarks, protons, photons, shadow photons, M theory, spacial travel, and the lot.
You should really say "_Some_ people".
Generalizations suck.
nt
Try Corewar @ www.koth.org - rec.games.corewar
Good point. It's funny how /.ers love to bash Microsoft when they work outside of the standards, but get all defensive when their dyslexic non-standard English is corrected. The only standard they consistently stick to is known as the "double-standard".
Sheesh...
'Please stop treating your customers like idiots ...'
:-)
- well, you said it, not us!
I say we pull all our people back, and nuke the entire site from orbit.
It's the only way to be sure.
You hate Microsoft...so stop using their stuff and stop whining about how bad it is...if you love your crappy Linux so much, please go ahead and use it. If your employer forces you to use Windows, quit your job...after all, principles are more important than money...or so you claim.
mod parent up.
I think "learn how to cut-n-paste" would be the appropriate admonition.
Whatever floats you're boat.
1.) Microsoft is somehow responsible for all third-party DLLs on a system. Their scanner must contain a self-sufficient, learning AI that just "knows" which DLLs to scan on any system in existence.
Yes, this makes perfect sense because the GDI detection tool and surrounding infrastructure as it stands now is so perfect that to enhance it one iota (say, by having it actually do something useful) would be to make it impossibly perfect.
Every time the darn thing runs it merely says you *may be vulnerable* and as far as I can tell it doesn't every do anything else. I've written "Hello World" applications with more pragmatic value. Not only that, but you run it on a Windows XP SP2 system, and then go to MS' website and find out that the tool can do you *no good* and should never have been downloaded because WinXP SP2 is not vulnerable to this problem!! (Or at least, not in a way fixable by this tool)
In my last WinXP SP2 full install, this was a major "head scratcher" I had getting the system up and running. Why would they ask me to download and run a tool that can't possibly do my version of Windows any good? (Only now am I beginning to realize this makes a twisted sense because the tool does my computer as much good as any other...none.) Or, perhaps there's more to the GDI exploit story. But where the heck is the more? Somebody at Microsoft really fell down on this one.
2.) Mozilla was affected by this same vulnerability, but it's okay because it's Mozilla and not Microsoft.
Fixed in Mozilla 1.4.1 In October of 2003. Not even a speedbump, just another patch in the quilt.
3.) When Mozilla's XUL bug was marked "Confidential" since 1999 only to be revealed earlier this year when exploits came out for it, that's okay too. There won't be any "open letters" to Mozilla over it, because it's Mozilla and not Microsoft.
Ya, that was a cover-up worthy of a major corporation... Not the greatest thing to do, but I don't see what this has to do with the current story. (Ie: What does keeping exploits secret have to do with really lousy exploit detection/resolution tools?)
What a totally worthless thing to do.
Let's write a completely nonpolitic letter to Microsoft and see if they respond.
Hello? The way to change things is to convince MS that their policies are incorrect, not blaspheme and curse at them. They'll just ignore such letters as hatemail, the same way you or I would.
Ok so MS's scanner, tells me I may be vulnerable ... run updates, run scanner again ... still tells me I may be vulnerable, and their "Tool" did nothing to help me. Great!
So now I run this scanner which actually tells me what files may be vulnerable, fantastic! Knowing is half the battle, but now what about the other half like actually fixing the problem?
How do I patch these files? Can I just copy over all affected gdiplus.dll's with good ones? What about the other files it detectes? Do I need to get patches? if so where from? each software manufacturer? If these all came from MS can't they just patch them all and not a few here and there ?
So in the meantime should I just avoid all jpg's and just duck and cover or what?
no slashdotters are windows users until a cool tool like that NASA world wind one comes up
Two words..
Employer Supplied
The truth shall set you free!
Bleeping Computer recently published a tutorial on how to use this program and interpret its results. You can find it here: http://www.bleepingcomputer.com/forums/topict3077. html
...because third party software is really MS's problem.
Join next week when we'll ask Honda to make the Civic more secure because stupid people put modifications on it and then hurt themselves.
Yay Slashdot.
Any standard that imposes criminal penalties for software bugs will apply to open source just as it applies to closed source. So if you want criminal charges for a bug that goes unpatched for a certian amount of time or allows full access and so on, be ready to see OSS programers getting charged as well. OSS is NOT free of exploits. They crop up from time to time, even in seemingly safe places, like libpng. Firefox had a XUL venurability that allowed a fake webpage to be creatd that appeared real and secure (/. ran a story on it). It sat unfixed for over a year before someone finally made a practical demonstration of it.
The other problem is that basically every exploit results from using the software in a manner in which it was not designed. Well cars have MANY exploits like that. If you run your car in to a wall at 100kph, you will destroy it and likely kill yourself. This is a known problem with cars, and one that manufacturers take no steps to fix. However it is not how you are supposed to use a car. Coputer exploits are likewise. You are not supposed to send a large amount of meaningless data to an input in an attempt to overflow it's buffer.
So, really, trying to claim that exploits for software should be criminal is just silly and really would stick it to open source. People mistakenly think that because it's free the law wouldn't apply. Nope. If you buy bottled water that is harmful, the company that sold it to you is civily and perhaps criminaly liable. If I provide you with a free glass of water that is harmful to you I am also civily and perhaps criminaly liable. The fact that I'm one guy doing it for free changes nothing.
So if you advocate fines/jail for software bugs, just remember you are advocating it against OSS as well.
Want to see Kerry's changing positions on Iraq, in his own words?
For a more analytical look with some of Bush's words thrown in for context look here.
San Francisco values: compassion, tolerance, respect, intelligence
What an absolutely asenine letter - The author addresses an inportant issue and clouds it with useless analogy - The style of the letter screams "please ignore me, these are the ramblings of someone who should not be taken seriously" - This is a shame, since he eventually makes a very good point - S/N ratio is way too low for this to be a useful letter
Who is Tom Liston and why is he complaining to Microsoft about the gaps in his C&C defense? Just build more AGTs dude. Weird. Omroth
"When a third party vendor wants to distribute a Microsoft DLL with their product, don't they have to get permission from you?"
No.
"Wouldn't there be a list somewhere in Redmond of the third party applications that have distributed vulnerable copies of gdiplus.dll?"
No.
"Can you tell us what they are?"
You tell me....
Who writes this crap?
When the size of data structures exposed by the API changes, there is usually a versioning mechanism so that the old way to call the function still works. Usually, this is a parameter where you specify the size, or flags so that the old semantics still work.
The Win32 API is not a work of art by any means, but they (for the most part) do a good job with backwards compatibility. Can you give a concrete example so that you can demonstrate you know what you are talking about in the slightest?
How is what you describe different from switching from libc5 to glibc?
Try running an app compiled on Red Hat 1.0 on the latest Debian box. Will it work? No it won't, because the C library has changed, among other libs. However, most line of business DOS apps written in the 80s still work on Windows XP.
I Run GDIScan, I see: C:\Program Files\Macromedia\Dreamweaver MX 2004\gdiplus.dll Version: 5.1.3097.0 -- Vulnerable version I go to Macromedia, NOTHING THERE! So WTF am I supposed to do? It's all wonderful you guys want to throw bricks at M$, but perhaps someone can actually tell a poor, non-programmer, what the hell to actually do to protect my system. And the first one that says use Linux gets modded to -1000(asshat)
What I don't know I just fake...