Slashdot Mirror
Four New Unpatched Windows Vulnerabilities
peeon writes "Right before Christmas, four new Windows NT/2k/XP vulnerabilities were posted to the Bugtraq list. This story discusses two of the vulnerabilities in the LoadImage function (buffer overflow) and Windows Help program (heap overflow), but the Chinese company discovered two more exploits in the parsing of a specially crafted ANI file (causes DoS). A Bugtraq posting has more details."
Hmmm, so windows has bugs in it. Surprise surprise. Merry Christmas everyone. In Soviet Russia, Windows Exploits you...oh wait...
My Favourite Meme
Vulnerable:
Windows NT
Windows 2000 SP0
Windows 2000 SP1
Windows 2000 SP2
Windows 2000 SP3
Windows 2000 SP4
Windows XP SP0
Windows XP SP1
Windows 2003
Not vulnerable:
Windows XP SP2
They'll do anything to get you to upgrade.
GETPKG - Package Management for Slackware
when corporate computer use is at a minimum?
Not in my office... our mailserver just went down due to a large number of 'seasonal' flash attachments coming and going out and PHB OutOfOffice AutoReplies. I can just see the SysAdmin's tears shorting out the domain controller as we speak....
My Favourite Meme
so it's christmas eve 2004, i'm at the in-laws, just spent 3 hours adawaring, spybotting, esspee2ing from a cd burnt on the latest stage 1. go figure.
30 megs of critical/av signatures to be done over diallup another time
damn you micro$hite
$ strings FTP.EXE | grep Copyright
@(#) Copyright (c) 1983 The Regents of the University of California.
explorer? PSHAW! Everybody knows that the Great Satan's name in reverse Mesopotamian is inetinfo.exe. Don't you dare mod me down or I shall curse you with the following: May you be forced to plug a memory leak in a Visual Basic app sharing C++ structs over the Christmas Holidays....
My Favourite Meme
Demonstration of exploits:
c us/bugtraq/2004-12/0387.html c us/bugtraq/2004-12/0360.html c us/bugtraq/2004-12/0359.html
http://www.xfocus.net/flashsky/icoExp/index.html
http://www.derkeiler.com/Mailing-Lists/securityfo
http://www.derkeiler.com/Mailing-Lists/securityfo
http://www.derkeiler.com/Mailing-Lists/securityfo
(Source: http://www.heise.de/newsticker/meldung/54610 [German])
Sysadmins should have already fixed this problem. SP2 was available months ago. If you aren't patching your systems when the patches are out then you deserve everything you get.
...and that is all I have to say about that.
http://jessta.id.au
RTFA. Exploits have already been released. Exploits are enough.
XP SP2 is also vulnerable to at least one of the exploits. See..
Advisory: [AD_LAB-04006]Microsoft Windows winhlp32.exe Heap Overflow Vulnerability
I'll probably be modded down for this...
Will they allow me to install Linux once i 0wn the machine?
Please correct me if I got my facts wrong.
Knows where a person could find a pre-compiled, local only 2k/XP administrator access binary? Something that would just open a cmd.exe with the correct privileges, to say, install java on Firefox?
I'm not a script kiddy, just not patient enough to go through the 3 month process of maybe getting it approved to be installed by IT...
Nothing is more annoying about the holidays then going to visit family and friends and then being sucked into fixing their damn computers While everyone is drinking and having a good time we are the schmucks trying to figure out how to remove that damn proces from windows 98!
This year I wash my hands of it and am giving them a printout of a tutorial I found that has helped some friends. It is basic, but they do not bother me as much anymore:
Simple and easy ways to keep your computer safe and secure on the Internet
Merry Christmas... from all the people at Microsoft. Buffer overflows for everyone this year ;)
The OS itself should not be shout-down just by an user level privilege rights. If ie6 or any other application causes system crash under non-root privilege level, it is an OS fault, as the OS must guarant interprocess safetyness and security, etc.
remember that test someone did where garbage code was thrown at IE and firefox in order to see how they held up and find things like buffer overflows which could be potentially exploited?
What ever happened with that? Were the bugs in firefox fixed? I remember that IE did well in that test, but I dont remember any specifics.
Anyone know?
-- 'The' Lord and Master Bitman On High, Master Of All
Stupid question, but does the LoadImage() one affect images which are viewed in FireFox or Thunderbird?
Why do they have to release this stuff JUST BEFORE we actually get time off? Are they deliberately being bastards to us Bastards who have to herd Redmondware amongst the other less sucky things?
At least I won't have to spend Christmas removing viruses, trojans and spyware from my Dad's computer. I bought him a Mac. Worth every penny in reduced aggro.
Oolite: Elite-like game. For Mac, Linux and Windows
And if you blindly install new patches on everything without testing them first, you deserve everything you get.
Y'know, you blow up one sun and suddenly everyone expects you to walk on water.
Silent night, holey night,
All is calm, all is bright,
Round yon virgin PC and screen,
Holey computer, so exploitable and keen,
Sleep with spyware downloading,
Sleep with spyware downloading.
-=test-sig_0.1.5(NoWhitespaceVersion)=-
Hi, you've missed the point. I hope you're not trolling, because I'm going to bite.
Every box at my workplace is patched with SP2. In this case, it doesn't matter - one of the exploits is still useable.
The problem is not (this time, thankfully) the corporate enterprise deployment of windows. It's friends and family. Every time a new windows exploit like this comes out, jerk spyware/worm/virus writers are on it within 24 hours, populating their zombie networks with your mom's, friends' and families' computers. Manditory regular patching at work is easy. The same for people you see occaisionally who are not computer literate is not. These are the people who it really screws with - for example, all one of my buddies wants to do with his dell is play games, send email and surf. He knows nothing beyond that, and is certainly not going to run down to the basement on christmas eve to make sure his operating system is secure RIGHT NOW.
This business of "patch or you deserve it" is utter BS. I maintain that virus writers should be dragged into the street and beaten with keyboards, followed shortly by geeks who empower them by putting any of the blame on the end user. If I paid thousands for an OS site license, I should not be spending my holidays fixing it. If I spend hundreds for an oem copy at home, the same applies. The only ones who deserve ANYTHING bad here are the exploiters and the providers of the crappy OS in question.
If you don't have any fancy admin rights, you shouldn't be able to anything in code to crash your machine, regardless of the OS.
One line blog. I hear that they're called Twitters now.
Nice try, but you should check the return code from malloc(). If it is -1 then there is a problem and you don't need to do the If statement. A lot of times the trouble comes not when allocating memory but when using a pointer to WRITE to memory. It's a C programmer trick to set up a pointer to a block of size X and write to it via the pointer, of course if you lose track of the pointer address you can easily go too far. Common errors are off by one in the count, assuming you are writing 8/16/32 bits without checking the underlying data type first,
or just writing to whatever address the pointer says w/o checking that *p > MAX_MEMORY_ADDRESS. These are errors a beginner programmer would make, and from the looks of how common these errors are in Windows that is the type of folks MS uses. It also says to me that they don't use any sort of Automated Code Analysis tools which can catch these sorts of errors. Or maybe they don't do any indpendant QA at all? It's pretty pathetic when the worlds most popular software is made by a company that probably doesn't meet SEI Level 2 criteria. I only wish that the laws allowed someone to sue for lost time/income from the "basic" errors that shouldn't have been present.
Most FOSS programs are the result of someone who really wants to write something good. Rarely have I seen someone being forced to write FOSS code to meet a release date schedule or to remain competitive. It's about It'll be done when it's done, sort of Code Poetry. Most of the code was written to run in a hostile environment where black hats can read the code (like the above peice) and screw everyone who runs bad code. The term security in obscurity as far as coding style does not even enter your mind.
Also vulnerabilities are easier to find when you have the source - like that professor who set his students to find vulnerabilities in FOSS. Unlike a corporate setup - you have a practically unlimited number of reviewers if your program is popular (and if it is not, a vulnerability is no big deal anyway, right). Also everyone runs a different binary, slightly different from what everyone else runs (security often needs you to recompile stuff with stack canaries)
So FOSS software evolves (yes, Natural Selection) to avoid these vulnerabilities by dying out or it "adapts" - Someone adds more good ideas and makes it better like.. (s/ideas/genes == Sexual reproduction) . Also the good ones read Wietse's papers.
Quidquid latine dictum sit, altum videtur
The LoadImage API is implemented in kernel-mode for speed so a bug in there can bring down a system.
Warning: If you are on Windows Don't download
www.xfocus.net/flashsky/icoExp/KERNELBLUE.ani
Instant Reboot. This is a very critical vulnerability. Reminds me of the old exploits that referenced "CON" in the file path inside a webpage to trigger a BSOD.
You managed to.
One line blog. I hear that they're called Twitters now.
Windows has been a known security hole for almost 10 years now. Until very recently, you could expect to spend $1000+ on a new computer - that's worth the investment of the amount of time it would take to find out that running Windows is dangerous.
-- The act of censorship is always worse than whatever is being censored. Always.
It sure is a good thing Microsoft digitally signs everything. Clearly they are lightyears ahead of open-source in terms of security.
Now that it takes less than 5 minutes connected to the Internet for a Windows box to be hijacked, I have gone back to dual-booting Linux with Windows 98 SE.
A lot of Windows viruses simply won't run on it.
All I need is Office, so it's good enough.
We must be alert to the danger that public policy could become captive to a scientific-technological elite. - Eisenhower
Twas the morn be for Christmas and all through the cage.
Not a creature was stirring not even a 10th level mage.
Then Flash, i look at my bookmarks and what did appear!?
A story on slashdot spreading with fear.
"Peril Peril", It screamed with fervor and fight.
"What shall we do about this vulnerability tonight?"
It's christmas eve and in the story lay more,
For this affected Santa and hurt him to the core.
His Server Used Exchange to give and recieve,
a malicious cracker got in to make Santa Grieve.
The clean cut elves said format and reinstall, while the ones with long beards solved it in no time at all.
"There will be no Christmas this year" Santa Said with dismay.
The naughty and nice list was lost in the fray.
And yet with precision and care the elves brought out from back,
santas new gift! a blade server rack!
"It runs Linux in fact!" said the elves in unison
"cron jobs too, back up that old piece of Sh.."
one interupted "Stop it Sam",
So christmas would go on with ease and ablitity, that is until santa went on his killing spree.
The End
why in this day and age, 99%-100% of automated exploits still happens to be some kind of overflow. why do we keep thinking that we dont have to check the sizes when moveing data about as its defined by a standard anyways? its like not checking to see if you have room for something in your house or car before buying it at the very least.
comment first, facts later. http://chem.tufts.edu/AnswersInScience/RelativityofWrong.htm
A quick search of the source code seems to show that the native OS LoadImage function is only used to set Mozilla icons (system tray, window icons, etc) and the splash screen (and the cck). Since none of these images come from untrusted sources*, it seems that the LoadImage hole is not exploitable via Mozilla.
*without major user intervention, like installing an XPI or messing with the JAR files that make up Mozilla
My server
Slashdot has made subtle changes to the definitions of Patched and Unpatched.
Patched Open Source: A vulnerability has been identified and someone is thinking about fixing it. Because the time between discovery and fix is vanishingly small, there are no unpatched open source vulnerabilities.
Patched Windows/Proprietary: A patch has been available for not less than 12 months and is installed on not less than 99% of affected systems. It will be several months, if not years, before vulnerabilities fixed by Windows XP SP2 will be considered patched.
This doesn't have to apply to kernel stuff. A lot of Windows apps rely on for example the "common controls" API. It handles toolbars, tooltips, listviews and so on. Quite a lot of UI goodies. Most of those are implemented without any kernel side, they're normal user mode controls/"windows" with their own drawing.
Now to the point: This DLL was updated quite a few times with Internet Explorer 3, 4 and 5. The versions in Windows 98, 2000 and XP are/were directly related to the matching (sub-)version of Internet Explorer. If you wrote an app for Win-95 and wanted to use one of those common controls, the recommended redistribution scenario was redistributing IE.
If they simply ripped out anything that is officially part of the "IE codebase", it's completely true that quite a few apps would fail.
This is of course even more true of some of other APIs with a more apparent connection to Internet Explorer, like WinInet for interacting with HTTP/FTP without doing sockets yourself (and using the IE cache and other stuff) or employing the IE HTML/XML parsing and possibly rendering hosted in another application. I chose common controls because they're very frequently used, and some quite significant updates were introduced through IE. These updates are still there in "Win98 lite" and whatever you would do to a Windows system to rip out IE, but retain a reasonable level of compatibility. Just because it's part of the OS and a frequently used API doesn't mean it's kernel mode. And very little IE related code is *in the kernel*.
Now to the point: LoadImage is quite a low level function. Display drivers are allowed to use it on their own and modify its functionality. That makes it belong in kernel mode. Even if they moved back some more UI stuff from the kernel, stuff like this probably belongs there, if you buy the concept of placing display drivers in kernel mode at all.
SP2 is vulnerable to the winhlp32.exe Heap Overflow Vulnerability, according to xfocus. Buqtraq posting They dont know if LoadImage is vulnerable in SP2.
For calloc() and malloc(), the value returned is a pointer
to the allocated memory, which is suitably aligned for any
kind of variable, or NULL if the request fails.
emt 377 emt 4
Nice try but if malloc(3) is not too buggy (if it is, you have other problems) it will only return NULL or a valid pointer. If it never supposed to return -1 (unless -1 is a valid pointer) or some value larger than MAX_MEMORY_ADDRESS (from where does this macro come anyway?).
No GNU has been Hurd during the making of this comment.
Repeat after me: Microsoft still officially supports windows 2000 and other operating systems besides XP SP2, so the vulnerabilities are still unpatched on those OS's
The AACS key is NOT 0xF606EEFD628B1CA427BEA93A9CA9773F