Latest Version of MyDoom Exploits New IE Flaw

techentin writes " CNN Money is reporting a new and improved MyDoom variant which is spread by a hyperlink in email. Clicking the link connects the user to an infected machine, which exploits a recently discovered buffer overflow in Internet Explorer. McAfee has a more detailed description. Is this yet another good reason for running Firefox?" CNET also has a story.

Comments

SP2

[Anonymous Coward]

SP2 not vulnerable... Upgrade or perish.

Install SP2 You Dummies

[lseltzer]

>>Is this yet another good reason for running Firefox?

Or Windows XP SP2, which is not vulnerable.

What kind of imbecil runs XP but not SP2?

Sensationalist /. headlines

[Swamii]

Woopsie! Slashdot forgot to mention the fact that this vulnerability has no effect on XP machines patched with SP2. Way to go Slashdot!

Not as much of a problem though

[einhverfr]

There are a few design flaws in IE that make it a uniquely dangerous program to use to access the internet. These mistakes have, as yet, not been made by the Mozilla team. Perhaps we have learned a few things...

The largest problem (mostly the cause of spyware rather than viruses though) is the issue of ActiveX scripting. Because ActiveX controls are trusted on the basis of vendor signature, and because someone can force an old version to be downloaded and installed, it means that no security patch can protect you against a malicious site scripting against a bug in an ActiveX control signed by a trusted vendor. No security patch can be writte to do this without breaking *every* ActiveX control in the internet.

The second issue is that of security zones. This allows an attacker to exploit any flaws that come with the enforcement of such zones. This is an issue for viruses and spyware alike.

Now, it is possible that a new as yet unimagined sort of attack will eventually be possible against some type of functionality in Mozilla. At least one type has (XUL files spoofing interfaces), but if these become a problem, it is open source, and so you or anyone else can pay for somone to make a version with a different structure. If enough people switch, the process begins over again. But each time, I think we are safer.

SP2 immunity

[jaiyen]

For those who don't RTFA, XP SP2 doesn't appear to be vulnerable.
"Users who have installed Windows XP Service Pack 2 are immune to the programs that use the vulnerability, including the two new variants of the MyDoom virus."

Re:Software without security issues:

[YOU LIKEWISE FAIL IT]

#include <stdio.h>

int main(){
printf("Hello World!\n");
}

While your assumptions are most likely correct, complacency is the friend of the buffer overflow. Depending on your implementation of the clib, printf, usually considered safe, could possibly be a problem - particularly as it ends up using the locale system and the user settable LC_NUMERIC to determine how to represent numbers, radix, etc.

My favourite printf gotcha however is the seldom used %n conversion character - unlike it's brethren, this one writes data to the pointer in the argument list ( the number of characters printed so far ). This can be used to scribble over various pointers in the arg list and is why you should never, ever allow users to provide format strings to the program without vetting them first.

YLFI

Re:CNN Story

[Tackhead]

> Will someone puleeese explain what's so great about tabbed browsing? Do I really need another mini window manager inside of my application? And for most Windows users moving away from XP most of the tabbing is already done by the task bar. I like Firefox as much as the next guy. I seriously entertain the idea that I'm missing something here. Something BIG. So tell me.

1) Go to www.BigNewsSiteorFaveBlog.com
2) Decide you want to read 15 of the 30-40 news articles available to you.

Then either:

3-Tabbed) Click on the things that look interesting, and keep clicing on interesting while the 15 news articles load in separate tabs. By the time you've clicked the 15th thing, 10 of the 15 articles have already loaded and been rendered for you in their tabs. Hover the mouse button over an "X", and click once to close the tab without moving. (sweet on a conventional mouse, and really sweet on a touchpad-based laptop!)

or:

3-Untabbed-option-1) Click on the interesting thing. Click "back" (hoping that the stupid marketroids at the website haven't borked "back" on you). Click on the second interesting thing. Wait for the HTTP session to start. Read the article. Click "back" (and wait for the HTTP session to start as the original reloads). Click on the third interesting thing. Wait for... [repeat 15 times].

or: 3-Untabbed-2) Click on the interesting thing in a new window. When window focus changes to the newly-popped-up window, curse, and click on the first browser window. Click on the second interesting thing to pop up the next article in a new window. When window focus changes, curse, and click on the first browser window. [ ... repeat 15 times.]

If you read at the pace of a slug, and/or spend more time scrolling the article because you render all fonts in 24-point Gothic, tabbed browsing offers little advantage, because you spend a lot more time reading and scrolling through the article than you do loading and rendering it.

If you read quickly, and/or cram enough text onto the page to see an entire page with one or two presses of PgDn, the 500-1000 milliseconds of HTTP session initialization, page-loading, and HTML-rendering time is an appreciable fraction of the time you spend reading an article. For CNN articles, we're talking about 5-10 paragraphs of text (5-10K of text, tops) and hundreds of kilobytes of frames, ads, banners, style sheets, and other crap that has to come down the pipe (often requiring multiple HTTP sessions to different websites - DNS lag can also come into play), and that ratio can be significant.

Anything you can do to minimize the amount of time you spend waiting for content relative to reading content is a Good Thing. The larger that ratio of waiting:reading is, the bigger the advantage offered by tabbed browsing.

Re:CNN Story

[Frogbert]

For me personaly the security issues with Firefox have always seemed a lot less dangerious then with those of Internet Explorer. What especialy annoys me about Internet Explorer is its constant ability to be infected with various toolbars and browser hijackers and dialers. These things are automaticaly installed in a lot of cases and, correct me if i'm wrong, firefox doesn't have vunerabilies to the same extent that are as wide spread.

I don't typicaly get these things installed unless it is an automaticaly installing problem however my friends and family all had problems with Internet Explorer getting bogged down with this crap. I know once I install firefox I'll have a lot less crap to clean up when I next fix their computers.