Slashdot Mirror
Ten Security Bulletins From Microsoft
wschalle writes "Microsoft has released 10 "new" security bulletins, including one pertaining to a vulnerability in the Windows Shell, apparently exploitable via the web. The shell vulnerability only allows code execution as the user viewing the malicious web site. Aren't you glad your shell is web-enabled? The recent GDI+ vulnerability is re-released here as well as a vulnerability in zip compression handling."
....Win2k patched fine. Another Tuesday Patch roulette over with....
I was just about to write a pro MS defence post to stave off the oncoming attack. I just re-read the article. I quit.
Ok, Now is a really web enabled experience! :)
What's in a sig?
The recent GDI+ vulnerability
Good thing I choose to join NOD.
/rimshot
-------
Support Indy Music. Buy
It's nice to know that they have made security such a high priority. Hopefully their next high priority will be 'doing something about it'.
This is my sig. There are many like it but this one is mine.
I can think of a more comprehensive bulletin:
1. Internet Explorer (All versions)
2. Microsoft Office (All versions)
3. Microsoft Windows OS (All versions)
Si tacuisses philosophus mansisses. If you had kept quiet, you would have remained a philosopher.
links or lynx are programs they are not intigrated into the shell. I don't think you understand what a shell is.
Just in case anyone is wondering, SP2 is not affected by any of these vulnerabilities, except for MS04-038. That's the fix for the "drag-and-drop" vulnerability that everyone's been crowing about.
Please select your argument here:
[ ] MS has these security exploits because it is the biggest OS
[ ] MS is a steaming pile when it comes to security
[ ] MS is working on fixing these things, and is doing the responsible thing.
[ ] 1337! I can't wait to #4x0r!
There are a number of user-friendly configuration tools for iptables. FireStarter is the first one that comes to mind, though there are others.
Wow now these are guys I can trust!
Are Windows 98, Windows 98 Second Edition, or Windows Millennium Edition critically affected by any of the vulnerabilities that are addressed in this security bulletin?
No. None of these vulnerabilities are critical in severity on Windows 98, on Windows 98 Second Edition, or on Windows Millennium Edition. For more information about severity ratings, visit the following Web site.
Don't sweat it, a remotely exploitable shell is
not critical!
Got Code?
The newest version of XP is the safest and most secure version yet. Try counting how many of those bulletins have to do with SP2.
and (on my page) a microsoft windows server 2003 advertisement right below this article.
beautiful. fucking beautiful.
This sig contains repetition and redundancy.
"The best thing about Microsoft bugs is that there are so many to chose from..."
The shell vulnerability only allows code execution as the user viewing the malicious web site.
On most XP installations, the only user is "Administrator".
Aren't you glad you need admin privileges for day-to-day operations on too many windows boxes?
Aren't you glad that even if you can get by without admin privileges, you can still completely hose your own files just be visiting the wrong website? Aren't you glad the only files that you can infect are the only files that you really care about?
You bet I'm glad my shell is web-enabled! After all, this Windows box belongs to my employer ... its his time that will be wasted.
See what I've been reading.
Why are there more big announcements about MS patches?
Because MS is the dominant OS, and many Slashdot readers need to know about these things.
There have been Slashdot articles on Linux bugs, but fewer. Why? Maybe because there are fewer critical bugs. Why? Market share.
Not everything is anti-MS. Some of it is just reality.
desiv
People like myself that use LiteStep for a shell under Win32 don't have to deal with the memory overhead of a web-enabled shell, or these web-based exploits.
It's pretty cool and it's open source and stable (unlike Windows sometimes) and has a decent-size user base, eventhough most of the themes are pretty worthless. (Then again, for any themable program, aren't the bulk of the themes crap?)
Anyhow, people that are stuck using Windows like I am (Lycoris' Tablet PC version of Linux is next to featureless) should give it a try, if nothing else but as a preventative measure against future bugs like this.
With the exception of a proof of concept GDI+ exploit posted to USENET, none of these vulnerabilities are known to be exploited.
The shell and compressed folder vulns require user interaction, just like 99% of all other "worms". As long as your mail application is patched you can't get hooked via email and if you visit "malicious websites" with anything other than Lynx you probably should be shot anyway. Ditto for a decent firewall.
On the other hand, I wonder why things like these for soem reason never get posted.
Cmd.exe is the command line shell. The Windows shell is explorer.exe (which now has IE built in, or something like, as of Windows 98 you can surf the web from the "My Computer" Icon). Explorer has been the Windows shell since Windows 95. Before Windows 95 it used to be progman.exe (the Program Manager).
That's what I get for having faith in you, Microsoft!
Yeah, for about 10 times more applications.
Karma: Segmentation fault (tried to dereference a null post)
sigs, as if you care.
We should all be nice to Microsoft because they would never bug their competitors' hotel rooms, perjure themselves in court, open their source code to China while claiming in court that opening it would damage national security, sabotage their competitors' applications by changing their API's, or promise delivery dates that they know they cannot meet in order to starve their competition. Everyone knows Linus does that kind of stuff all the time.
That does it. I'm switching to Linux- Ubuntu, *noppix- or even *BSD, anything but Windows.
Installing today's updates, it asked me if I wanted more information about a vulnerability- and proceeded to open a page with Internet Explorer. How many times do I have to tell the computer that Firefox is my default browser? Whose machine is this, anyway?
With SP2, XP has been annoyingly telling me I may not be protected (I run without anti-virus but am locked down regardless and still scan regularly- with no virus or reinstall in 2 years). In today's update, it keeps nagging me to reboot.
And why do I have to sign yet another goddamned EULA to install critical patches?
There isn't any windows only software I need anymore. OO.org, Firefox, Thunderbird... and now GAIM (which I've gotten used to at work, working on FC1). I'll miss some of the usability features of XP, but I just can't handle it anymore. So long, Windows!
Information: "I want to be anthropomorphized"
actually, parent is my brother(that sentence sounds weird); I just want to make sure his comment is public so he has to carry through with it ;)
Why run a firewall at all?
If you are directly connected to the net, then this is a standalone machine, and does not need to have any sockets open, except that which is supposed to be used on the net. Turn off unnecessary services, or switch them to local mode only. AFAIK, there are no vulnerabilities for closed ports.
If you have a LAN, then there is something that separates the LAN from the internet. This should not be your desktop machine.
If you have two machines separately on the net, then you should use ssh tunnels between them. That is more secure than firewalls anyway.
Outgoing connections? May I ask why are you running spyware?
Filtering ICMP? Why would you want to break network standards again. It is because of you the net is a pain to use. I like getting messages that my connection failed instead of waiting for 60 seconds.
People firewall for a simple reason: to have open services inside the network, and not outside. At this point you should be capable enough to either do it yourself, or have a complete solution (although NAT is not a firewall, it behaves as one)
As far as I am concerned there should be no need to run any firewalls on the desktop. In fact it is a sign of poor management, or a patch to a bigger problem (not trusting your own computer).
Is there something I am missing?
badness 10000
When confronted with a new Microsoft security hole, which seems to one to have existed for a while, possibly leaving his entire organization at risk, one should never react with surprise or horror.
One must make a FRIEND of the horror.
Then, one can hear about the security issue, nod sagely with a wan smile, and whisper to the junior IT staff, "But of COURSE there is a hole. This is to be expected, young one. Run and patch, then we'll go to lunch."
Bonus points for leaning back in one's chair, folding one's hands across one's belly, and sighing loudly before addressing the novice.
Farewell! It's been a fine buncha years!
MS10-01: Vulnerability in Internet Explorer may cause user to worship other gods.
MS10-02: Buffer overrun in Graven Image processing.
MS10-03: Vulnerability in RPC Service may cause the name of the Lord to be taken in vain.
MS10-04: Vulnerability in Task Scheduler may prevent computer from resting on the Sabbath Day.
MS10-05: Vulnerability in Windows Shell may allow child process to kill parent process.
MS10-06: Buffer overrun in DCE Locator Service may cause abnormal program termination.
MS10-07: Vulnerability in Outlook/Outlook Express may lead to adultery.
MS10-08: Vulnerability in MSKerberos may allow remote user to steal.
MS10-09: Vulnerability in Excel may allow workbooks or spreadsheets to bear false witness.
MS10-10: Vulnerability in Internet Explorer may cause user to covet neighbor's ass.
k.
"In spite of everything, I still believe that people are really good at heart." - Anne Frank
If I could summarize, you are saying that the desktop machine should be configured well and securely so that a firewall is not needed.
To answer your question, a firewall is for damage control when you don't know (or realize too late) that your machine is not perfectly configured. Some program has some vulnerability, or a trojan, or something. You are right --it SHOULD not be this way; but when it just IS, and the trojan starts spamming people or transmitting your private PGP keys onto IRC, the firewall is there to say, "Hey, waitaminnit, something weird is going on here."
A firewall is like a fireman. You hope that it doesn't have to do anything but sit there.
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
they are called exoskeletons.
See my journal, I write things there
1. Security in depth. Multilayered security = A Good Thing. ...and they're not on port 80...!
2. True, there shouldn't be ports we don't know about on user's PC's, but how about when they pop one open without knowing? They can't download or receive numerous file types & their peripherals are disabled, but users will be users. I've seen programs installed that install telnet or tftp servers. A decent personal firewall setup will alert the user *and* log that alert to a central console.
3. Mistakes happen. A nameless colleague quit-out halfway through creating a firewall rule. The default action is to create the rule regardless, so for 20 minutes a bunch of workstations were waaaay more accessible than they should be. Worms were spotted.
4. It's disastrous to think "We've got a firewall, ergo we're secure" (see above). Common example: User sits in internet cafe with laptop, some floppies, usb devices & cd rom. Effectively spreads legs & asks the world to infect him. Next day, brings laptop back & jacks into the LAN. My sturdy firewall is now worth jack. Personal firewalls all round, please.
5. And yes, I do filter ICMP. I'm sorry that you have to wait 60 seconds for your pings or whatever to fail, but I have to ask why were you scanning my LAN? You want me to turn on file&printer sharing too, so you can see what else is going on? It's my LAN, & within it I'll do whatever I can to keep it secure. Guess what - I run some web services....
As far I'm concerned there are valid reasons to run personal firewalls on the desktop.
Hand-in-hand with user education, security policies, patch management and effective anti-virus solutions they provide a robust & proven security benefit.
You're damn right I don't trust my computer. And I won't do until I control all access in and out, and it tells me when something tries to except those rules. Oh, wait! It does. It's my personal firewall.