Slashdot Mirror
Four New Unpatched Windows Vulnerabilities
peeon writes "Right before Christmas, four new Windows NT/2k/XP vulnerabilities were posted to the Bugtraq list. This story discusses two of the vulnerabilities in the LoadImage function (buffer overflow) and Windows Help program (heap overflow), but the Chinese company discovered two more exploits in the parsing of a specially crafted ANI file (causes DoS). A Bugtraq posting has more details."
Hmmm, so windows has bugs in it. Surprise surprise. Merry Christmas everyone. In Soviet Russia, Windows Exploits you...oh wait...
My Favourite Meme
Vulnerable:
Windows NT
Windows 2000 SP0
Windows 2000 SP1
Windows 2000 SP2
Windows 2000 SP3
Windows 2000 SP4
Windows XP SP0
Windows XP SP1
Windows 2003
Not vulnerable:
Windows XP SP2
They'll do anything to get you to upgrade.
GETPKG - Package Management for Slackware
But does it have a faraday cage so the data doesnt escape? And.. Can it be compiled for SkyOs?
...Will santa fix it?
Why do these bugs (all 4) at christmas eve in china?
B.
(On Christmas eve, Soviet China bugs you!)
Every experiment which ends in a big bang is a good experiment.
Could it be these bugs have been published before christmas on purpose? To allow sysadmins to defend against them over the holidays, when corporate computer use is at a minimum?
Is it digitally signed?
a time when many companies and home users are least prepared to deal with the problems.
....
Looks like I know what i'll be doing over the Xmas holiday. If not fixing the problem at work if it becomes a problem, but fixing the problem with my family as well.
But I guess this is only a problem if some genius releases a virus containing the exploit
Ah, this is yet another example of hack journalism. They missed another bug that I just had to fix on an XP box today It's a vunerability in the win.ini file- it runs a harmful program called 'Explorer.exe'. The best kind of horse to beat is a dead one...
They create the file format, they invent the algorythms used to *read* the file format, and yet they can't manage to get it working?
Come on...
Its the early microsoft christmas present to all of the world using ms windows. They do love us.
so it's christmas eve 2004, i'm at the in-laws, just spent 3 hours adawaring, spybotting, esspee2ing from a cd burnt on the latest stage 1. go figure.
30 megs of critical/av signatures to be done over diallup another time
damn you micro$hite
$ strings FTP.EXE | grep Copyright
@(#) Copyright (c) 1983 The Regents of the University of California.
Demonstration of exploits:
c us/bugtraq/2004-12/0387.html c us/bugtraq/2004-12/0360.html c us/bugtraq/2004-12/0359.html
http://www.xfocus.net/flashsky/icoExp/index.html
http://www.derkeiler.com/Mailing-Lists/securityfo
http://www.derkeiler.com/Mailing-Lists/securityfo
http://www.derkeiler.com/Mailing-Lists/securityfo
(Source: http://www.heise.de/newsticker/meldung/54610 [German])
Will they allow me to install Linux once i 0wn the machine?
Please correct me if I got my facts wrong.
Knows where a person could find a pre-compiled, local only 2k/XP administrator access binary? Something that would just open a cmd.exe with the correct privileges, to say, install java on Firefox?
I'm not a script kiddy, just not patient enough to go through the 3 month process of maybe getting it approved to be installed by IT...
...at least for the color scheme here:
0 356204
http://shit.slashdot.org/article.pl?sid=04/12/24/
It might be a bad time if you had patches to apply, but since this is unlikely to happen anytime soon you might as well relax...
I tried to crash my win 2K workstation using firefox, no luck. It is also indicated that "needs ie6 to open" ... So if it crashes when you use ie6 and not anything else, how comes this is described as a windows vulnerability??
I mean, If I create a linux tool that opens up all your ports when you send certain code, can we call it a linux flaw??
Nothing is more annoying about the holidays then going to visit family and friends and then being sucked into fixing their damn computers While everyone is drinking and having a good time we are the schmucks trying to figure out how to remove that damn proces from windows 98!
This year I wash my hands of it and am giving them a printout of a tutorial I found that has helped some friends. It is basic, but they do not bother me as much anymore:
Simple and easy ways to keep your computer safe and secure on the Internet
Why? Oh Why? they have to do it just one day before the starting of the holidays.
Its happening again this year also. Its very disheartening for all those admins who will be going on holidays to see the vulnerabilites just one day before the holidays and exploits the next day. I was admin couple of year ago and I know these conditions are living hell, when you will spend all your holidays thinking about your servers getting hacked or cracked.
Admins who have taken the backups will be in a better state though.
Does not surprise me.
Even the code to display ANI cursors is buggy in almost all Windows versions.
The timing values for the single pictures is not evaluated correctly. Best seen with the metronom.ani
Merry Christmas... from all the people at Microsoft. Buffer overflows for everyone this year ;)
Is this even news anymore?
The preceding message was based on actual events. Only the names, locations and events have been changed.
remember that test someone did where garbage code was thrown at IE and firefox in order to see how they held up and find things like buffer overflows which could be potentially exploited?
What ever happened with that? Were the bugs in firefox fixed? I remember that IE did well in that test, but I dont remember any specifics.
Anyone know?
-- 'The' Lord and Master Bitman On High, Master Of All
Stupid question, but does the LoadImage() one affect images which are viewed in FireFox or Thunderbird?
Why do they have to release this stuff JUST BEFORE we actually get time off? Are they deliberately being bastards to us Bastards who have to herd Redmondware amongst the other less sucky things?
At least I won't have to spend Christmas removing viruses, trojans and spyware from my Dad's computer. I bought him a Mac. Worth every penny in reduced aggro.
Oolite: Elite-like game. For Mac, Linux and Windows
Silent night, holey night,
All is calm, all is bright,
Round yon virgin PC and screen,
Holey computer, so exploitable and keen,
Sleep with spyware downloading,
Sleep with spyware downloading.
-=test-sig_0.1.5(NoWhitespaceVersion)=-
Just for the hell of it, i tried it with firefox and fedora core 3(updates and all). Resulted in total X lockup :\. I usually dont side with MS, and X lockups arent as bad security wise, but still :\.
...to write software without buffer overflow problems?
_ SIZE){
It's not just MS, even plenty of OSS programs have buffer overflow exploits.
I haven't done any lowlevel programming, but can it really be that difficult to do
malloc buffer MAX_BUFFER_SIZE
if(mem_to_copy.length>MAX_BUFFER
return ERROR_DATA_TOO_LONG
}else{
copy(mem_to_copy,buffer)
}
?
Is it "the company" or "The Company"?
Life is just nature's way of keeping meat fresh.
Depending on the reaction you'll get, you can always reset the admin password on your box to a new one of your choosing, and install away... Whether or not this is a good idea in your situation is left to your judgement.
A useful utility to accomplish this can be found here:
http://home.eunet.no/~pnordahl/ntpasswd/
While it's kinda overkill in this case, I think I'd trust it over a newly released exploit. Hope that helps a bit.
sorry?
No more I say.
Santa's sleigh!
Man is a slave because freedom is difficult, whereas slavery is easy.
Hi, you've missed the point. I hope you're not trolling, because I'm going to bite.
Every box at my workplace is patched with SP2. In this case, it doesn't matter - one of the exploits is still useable.
The problem is not (this time, thankfully) the corporate enterprise deployment of windows. It's friends and family. Every time a new windows exploit like this comes out, jerk spyware/worm/virus writers are on it within 24 hours, populating their zombie networks with your mom's, friends' and families' computers. Manditory regular patching at work is easy. The same for people you see occaisionally who are not computer literate is not. These are the people who it really screws with - for example, all one of my buddies wants to do with his dell is play games, send email and surf. He knows nothing beyond that, and is certainly not going to run down to the basement on christmas eve to make sure his operating system is secure RIGHT NOW.
This business of "patch or you deserve it" is utter BS. I maintain that virus writers should be dragged into the street and beaten with keyboards, followed shortly by geeks who empower them by putting any of the blame on the end user. If I paid thousands for an OS site license, I should not be spending my holidays fixing it. If I spend hundreds for an oem copy at home, the same applies. The only ones who deserve ANYTHING bad here are the exploiters and the providers of the crappy OS in question.
[BLOCKQUOTE]"They are rather serious," Huger said. "Both can be exploited by anything that processes images or reads help files."[/BLOCKQUOTE] Oh noes! Firefox isn't safe. It must be the end of the world.
Warning: If you are on Windows Don't download
www.xfocus.net/flashsky/icoExp/KERNELBLUE.ani
Instant Reboot. This is a very critical vulnerability. Reminds me of the old exploits that referenced "CON" in the file path inside a webpage to trigger a BSOD.
...are the bugs digitally signed?
my True Love gave to me,
Four hacked boxen
Three spywares
Two viruses
And another Windows vulnerability.
Brackets contain world's first nanosig, highly magnified:[.]
I've tested all of the vulnerabilities on Windows 2000 and they did nothing!! I'm invincibNOCARRIER
...does Internet Explorer use any of these functions to load internet images?
We cal discuss all day about some local API exploit but there is a big difference between a local API bug and a remote bug.
Does IE use these functions to load images? Or does it handle these kind of primitive formats using his own code? After all, is not that hard to "parse" BMPs and ICOs and it would be much better to handle all file formats inside an internal library, thus avoiding conflicting API methodologies.
I'm really curious about this. Does anyone knows the answer for my question? Can anyone test the faulty BMPs and ICOs inside a HTML page?
It sure is a good thing Microsoft digitally signs everything. Clearly they are lightyears ahead of open-source in terms of security.
Now that it takes less than 5 minutes connected to the Internet for a Windows box to be hijacked, I have gone back to dual-booting Linux with Windows 98 SE.
A lot of Windows viruses simply won't run on it.
All I need is Office, so it's good enough.
We must be alert to the danger that public policy could become captive to a scientific-technological elite. - Eisenhower
Twas the morn be for Christmas and all through the cage.
Not a creature was stirring not even a 10th level mage.
Then Flash, i look at my bookmarks and what did appear!?
A story on slashdot spreading with fear.
"Peril Peril", It screamed with fervor and fight.
"What shall we do about this vulnerability tonight?"
It's christmas eve and in the story lay more,
For this affected Santa and hurt him to the core.
His Server Used Exchange to give and recieve,
a malicious cracker got in to make Santa Grieve.
The clean cut elves said format and reinstall, while the ones with long beards solved it in no time at all.
"There will be no Christmas this year" Santa Said with dismay.
The naughty and nice list was lost in the fray.
And yet with precision and care the elves brought out from back,
santas new gift! a blade server rack!
"It runs Linux in fact!" said the elves in unison
"cron jobs too, back up that old piece of Sh.."
one interupted "Stop it Sam",
So christmas would go on with ease and ablitity, that is until santa went on his killing spree.
The End
At least dual boot, shhez. What does it take for MSFT users before they finally get enough?
If it gets any worse they're going to have to start including a jar of anal lube with a Windows license. Knowing MSFT they'll try to charge you for it and blame users for not being able to keep a tight bunghole.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
I haven't had a Windows machine for a long time, so I don't have much knowledge of the inner workings of the latest Windows versions, so I've been wondering, does XP SP2 have some kind of buffer overflow protection besides NX?
AFAIR, only the latest x86 CPUs have support for NX, yet all the recent buffer overflow exploits in XP don't seem to affect SP2.
If Microsoft found and fixed all these exploits for SP2, wouldn't releasing a complete list of the fixes be less embarrassing than the weekly news about newly discovered vulnerabilities.
How can these exploits be unpatched if SP2 isn't vulnerable? Or do they mean that while the other windows versions are exploitable, SP2 just crashes?
using namespace slashdot;
troll::post();
If I'm reading the news right, none of these bugs work in XP SP2? I'd hardly call that "Unpatched"
why in this day and age, 99%-100% of automated exploits still happens to be some kind of overflow. why do we keep thinking that we dont have to check the sizes when moveing data about as its defined by a standard anyways? its like not checking to see if you have room for something in your house or car before buying it at the very least.
comment first, facts later. http://chem.tufts.edu/AnswersInScience/RelativityofWrong.htm
...when all thru the house
not a feature responding, not even the mouse
All processes were hung by the Exploit to scare,
In hopes that St. Bill's solution soon would be there...
etc. ad nauseam
Merry XMAS/Happy Hols all.
...about running knoppix or any of the other live cds? Easy enough for them to run XP when it's not connected to the internet for games or whathaveyou,and therefore avoid exploits, and when they want to surf, have them boot up a knoppix. Really, an easy enough solution to that sort of problem. Not sure what sort of machine they have, but just recently, like two weeks ago when I gave away an older machine to a kid with no computer,I've run knoppix down to a pentium 1 level Iit's a 166 machine) and only 32 megs ram and it still worked, slow but once loaded after a few minutes it was zippy enough. It's not even supposed to work at that level but I tried it anyway just for grins. Anything above that with a reasonable amount of RAM and it's quite speedy. And as to useability,really, how is it much different from a windows OS, down in bottom left corner is a big K start menu,mash that, slide around, pick an app, works. About the same as any other OS with a GUI.
--just a suggestion is all, no biggee, but avoiding holiday (or any other day) headaches is a good thing, IMO. Linux, especially from a live cd, is just not that hard or different from windows unless you are a power user, and these folks sound like non power users, so the learning curve is probably identical, so you might as well start with something a little more secure.
what about the php worm, that effects linux...HUGE flaw...
Well, it isn't that easy (and really not as easy as you get your insightful).
We have plenty of critical software that does actually under no circumstances run on SP2 - and I think we are not the only ones.
It has nothing to do with the embedded firewall and/or configuration issues, but with DLL version or functionality conflicts.
E.g. PBS controlling software, various special database access tools to data in various locations (I know, they are bad programmed, but we can't fix, because we won't get the code) and so on.
So?
So, what about Windows 3.1, Windows NT 3.51 etc.?
A quick search of the source code seems to show that the native OS LoadImage function is only used to set Mozilla icons (system tray, window icons, etc) and the splash screen (and the cck). Since none of these images come from untrusted sources*, it seems that the LoadImage hole is not exploitable via Mozilla.
*without major user intervention, like installing an XPI or messing with the JAR files that make up Mozilla
My server
Slashdot has made subtle changes to the definitions of Patched and Unpatched.
Patched Open Source: A vulnerability has been identified and someone is thinking about fixing it. Because the time between discovery and fix is vanishingly small, there are no unpatched open source vulnerabilities.
Patched Windows/Proprietary: A patch has been available for not less than 12 months and is installed on not less than 99% of affected systems. It will be several months, if not years, before vulnerabilities fixed by Windows XP SP2 will be considered patched.
I know the feeling. When I visited my family back home for a week, I worked on 8 PCs before I left. If you're handing out stuff in lieu of fixing hte computer, you might consider the Ubuntu CD package. Last I checked Ubuntu is still shipping free pressed CD packs. I just received all 10 of mine yesterday, and they look good. The package includes both a Live CD and an Install CD, with a brief explanation of what each does. I plan to hand the CD out to people I think would be interested in trying something different.
For calloc() and malloc(), the value returned is a pointer
to the allocated memory, which is suitably aligned for any
kind of variable, or NULL if the request fails.
emt 377 emt 4
These guys seem to disagree:
e ie .idg/
http://www.cnn.com/TECH/computing/9903/09/remov
http://nuhi.msfn.org/nlite.html
http://www.vorck.com/remove-ie.html
Haven't tried it myself, but I haven't found any hard evidence that they're wrong.
about Windows XP is the stupid help system contating the internet whenever I clicked on it. Windows didn't have to phone home and display a fancy GUI dialog just cause I forgot a command. Wait and see, there'll be more Windows Help system exploits.
Your statement is untrue. "Forced" means coercion, which you interpret can only be delivered through violence (an Uzi) but is not a true definition.
Your narrow definition of forced is plain wrong.
Try this new software.. it's called a dictionary:
forced. Come back when you finish your homework. Other suggested reading.
Fuçking hell.., full backup yestday while the office party had started and finish crap for the fùçking payroll/bank yearend (53 month years suck)..., had beer in work so was ok..., but now on my first day off in over 6 months...., sitting in pub (in Ireland) trying to kill the hangover from office pay., to read ill have to head back into work on the "Day of Drinkng EvE"..., - rant over Snackbite getting warm (the best beer in the world) fûçk shitty Treo600 pisssing me off and crap all gprs signal in Bruxcells - best Metal Pub in Ireland.......
--------
Noodle.........,
SP2 is not immune to these buffer overrun exploits. The only thing SP2 protects against is stack based buffer overruns that do not use shellcode written for SP2. See David Litchfield's paper on how to do this for Windows 2003 server and XP SP2 (link below).
s ta ck-protection.pdf
http://www.nextgenss.com/papers/defeating-w2k3-
From what I understand, as well as a vast amount of SP2 being rewritten using NT6.0 technology (many of the NT6.0 developers were moved over to SP2), all of SP2 was compiled differently to the RTM and SP1 editions of XP so that buffer overruns were less inherent in the compiled code. This is how SP2 is not susceptible to many of the newer exploits that are effecting the other versions of Windows.
I'm, no MS fan but I think SP2 and the new line they are taking with NT6 indicates they are learning. We'll just have to see.
I'm not sure if many people have tried it already, but I loaded the exploit page with Firefox.
Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
It took a few seconds to load on my p3 600mhz, but it got there just fine.
well on my amd64 system running windows XP pro wehever i try to upgrade to sp2 the hole system crashes on all boot attempts
PMFG! j00 R teh RIGHTZORZ!! I 4m delting lynux and Nstalling windoze Midilately!
thnkuthnkuthnkuthnkuthnkuthnku!
merri khristmass!!
Dude, the list contains programs for Linux.
Microsoft could stick a thumb up your ass, and people would still buy more of it.
"This thumb is better than ever! It's new easier installation interface and slick operation will make upgrading well worth it. Yet, it is 100% compatible with your old thumb!" (a lie, of course, as the new thumb tries to emulate the old one but breaks the memory management).
-- "Makes Little Debbie look like a pile of puke!" - Moe Szyslak
Please stop the bs - the updates are already available at MICROSOFT.COM. Go check for yourself.
More of the same...next week it will be something else. The week after that, another thing. Regardless of the platform or the application, it never ends.
But the real question is.....
How long will it take Microsoft to fix it?
Tick, tock, tick, tock....XP has 60% of the market, W2K 24%. OS Platform Statistics These stats are probably weighted somewhat against XP, but it scarcely matters. People have moved and are moving to XP in very significant numbers, at some point, you have to let go the idea that it is a "forced upgrade" and not a perfectly normal migration to a newer O/S.
"Four New Unpatched Windows Vulnerabilities"
What a load of bull. This article is blatant Microsoft bashing.
Repeat after me: XP SP2 is not affected
Since when has "fixed in SP2" been the same as "unpatched"?
Shouldn't that be "their buffers runneth over"?
that just had to be an I.T Charlie speaking.
your sheer ignorance (and that of your employer)
is the sole reason Microsoft is still so successful.
OH, there's no doubt. The problem is that people (read: INTERNET SERVERS) that are...skiddish of installing patches. They are skiddish because in the past, with NT 4.0 and later 5.0, the system bluescreened after reboot. Just like that time when Billy plugged in a USB printer and the computer bluescreened on him in front of 300 people.
The problem isn't that a "patch is available". It's that "our fucking server didn't come back up in the past, until $1200 and 48 hours later, and as far as we know, no one has broken in just yet so we're going to risk it this time".
Kind of like speeding on the freeway. There's hundreds more sons of bitches, just like you. And the idea is that you'll see them getting pulled over before you are, so you'll have time to reduce your speed (or disconnect your internet connection like Gabe Newell walked around, telling his entire staff when a German kid tiptoed in).
When you are a gazelle, there is safety in numbers.
Or so the theory goes...
As this is a bug in a ms windows function I don't know how this could be ???? Maybe you're running firefox_win32 in wine ???
Microsoft releases 'Service Packs' because it's a break in the Operating System version that lets sys admins know what they're getting into when they upgrade. A Service Pack is an upgrade so large and significant that it's considered a new Operating System Version, kinda like going from Kernel 2.4 to 2.6. Try upgradeing XP Home to XP Pro with SP2 installed in Home using a Pro SP1 CD, it'll helpfully stop you before you do something dumb. Service Packs also help identify to a technician (which I am) what's on the computer, what tools we can expect to be available, how those tools will behave, and where they can be found.
Also, modularity doesn't work so well when you're pushing 800+ megs worth of updates to a user base that just wants the darn thing to work. With SP2, I can give a friend a copy of the network install and say "here, install this before your internet" and not worry nearly as much about spyware / viruses. I don't have to worry about them getting tired after double clicking 20 separate patches and missing an important one....
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Well, if you install Windows 2000 without it in the first place, that is.
None of the exploits worked on my machine when I tried them, including the fuxored help files that were apparently supposed to do something bad, but only gave me an invalid help file message...
Fred Vorck
(Running Windows 2000 without IE, per my instructions)
Download installer (under windows) to somewhere
Boot with fav live cd that has good ntfs (I assume that it what your Win box is using) write support.
Copy installer to admin startup directory (or link to installer with options you want set)
Reboot
The Singularity is closer than you think
Quant