Slashdot Mirror

← Back to Stories (view on slashdot.org)

Four New Unpatched Windows Vulnerabilities

Posted by CowboyNeal on from the most-wonderful-time-of-the-year dept.

peeon writes "Right before Christmas, four new Windows NT/2k/XP vulnerabilities were posted to the Bugtraq list. This story discusses two of the vulnerabilities in the LoadImage function (buffer overflow) and Windows Help program (heap overflow), but the Chinese company discovered two more exploits in the parsing of a specially crafted ANI file (causes DoS). A Bugtraq posting has more details."

15 of 273 comments (clear)

  1. YAWN by tarunthegreat2 · · Score: 5, Funny

    Hmmm, so windows has bugs in it. Surprise surprise. Merry Christmas everyone. In Soviet Russia, Windows Exploits you...oh wait...

    --
    My Favourite Meme
  2. Forced Upgrade. by datadriven · · Score: 5, Interesting

    Vulnerable:
    Windows NT
    Windows 2000 SP0
    Windows 2000 SP1
    Windows 2000 SP2
    Windows 2000 SP3
    Windows 2000 SP4
    Windows XP SP0
    Windows XP SP1
    Windows 2003
    Not vulnerable:
    Windows XP SP2

    They'll do anything to get you to upgrade.

    --
    GETPKG - Package Management for Slackware
    1. Re:Forced Upgrade. by DrEvil · · Score: 4, Insightful

      It has to be a conspiracy. Anyone who claims that this might be a consequence of the year-long security push for SP2 and that a high-level fix made during this push might prevent certain classes of bugs from being exploitable is clearly evil and has been exposed to too much software engineering. I'd suspect such a person of spreading facts instead of FUD.

    2. Re:Forced Upgrade. by bryanp · · Score: 4, Insightful

      a) Nobody's forcing you to upgrade. I still haven't had Steve Ballmer show up on my doorstep with an Uzi yet.

      b) The list you give is mostly patches. There are four base OS' on that list and 6 patches, all of which are free.

      c) If it bothers you, feel free to run an unpatched OS of your choice, whether it be Windows, MacOS or one of the many *nix variants.

      --
      "An unarmed man can only flee from evil, and evil is not overcome by fleeing from it." Col. Jeff Cooper
  3. Re:Timing of the post by tarunthegreat2 · · Score: 4, Funny

    when corporate computer use is at a minimum?

    Not in my office... our mailserver just went down due to a large number of 'seasonal' flash attachments coming and going out and PHB OutOfOffice AutoReplies. I can just see the SysAdmin's tears shorting out the domain controller as we speak....

    --
    My Favourite Meme
  4. .. posted from newly esspee2d xp abomination by maharg · · Score: 4, Insightful

    so it's christmas eve 2004, i'm at the in-laws, just spent 3 hours adawaring, spybotting, esspee2ing from a cd burnt on the latest stage 1. go figure.

    30 megs of critical/av signatures to be done over diallup another time

    damn you micro$hite

    --

    $ strings FTP.EXE | grep Copyright
    @(#) Copyright (c) 1983 The Regents of the University of California.
  5. bugtraq links for the vulnerabilities / demo by tsager · · Score: 5, Informative

    Demonstration of exploits:
    http://www.xfocus.net/flashsky/icoExp/index.html

    http://www.derkeiler.com/Mailing-Lists/securityfoc us/bugtraq/2004-12/0387.html
    http://www.derkeiler.com/Mailing-Lists/securityfoc us/bugtraq/2004-12/0360.html
    http://www.derkeiler.com/Mailing-Lists/securityfoc us/bugtraq/2004-12/0359.html

    (Source: http://www.heise.de/newsticker/meldung/54610 [German])

  6. But... by RAMMS+EIN · · Score: 4, Funny

    Will they allow me to install Linux once i 0wn the machine?

    --
    Please correct me if I got my facts wrong.
  7. Give this as a gift for the holidays by Skalek · · Score: 4, Informative

    Nothing is more annoying about the holidays then going to visit family and friends and then being sucked into fixing their damn computers While everyone is drinking and having a good time we are the schmucks trying to figure out how to remove that damn proces from windows 98!

    This year I wash my hands of it and am giving them a printout of a tutorial I found that has helped some friends. It is basic, but they do not bother me as much anymore:

    Simple and easy ways to keep your computer safe and secure on the Internet

  8. Silent Night by Electronik · · Score: 4, Funny

    Silent night, holey night,
    All is calm, all is bright,
    Round yon virgin PC and screen,
    Holey computer, so exploitable and keen,
    Sleep with spyware downloading,
    Sleep with spyware downloading.

    --
    -=test-sig_0.1.5(NoWhitespaceVersion)=-
  9. Bah! by rubberband · · Score: 5, Insightful

    Hi, you've missed the point. I hope you're not trolling, because I'm going to bite.

    Every box at my workplace is patched with SP2. In this case, it doesn't matter - one of the exploits is still useable.

    The problem is not (this time, thankfully) the corporate enterprise deployment of windows. It's friends and family. Every time a new windows exploit like this comes out, jerk spyware/worm/virus writers are on it within 24 hours, populating their zombie networks with your mom's, friends' and families' computers. Manditory regular patching at work is easy. The same for people you see occaisionally who are not computer literate is not. These are the people who it really screws with - for example, all one of my buddies wants to do with his dell is play games, send email and surf. He knows nothing beyond that, and is certainly not going to run down to the basement on christmas eve to make sure his operating system is secure RIGHT NOW.

    This business of "patch or you deserve it" is utter BS. I maintain that virus writers should be dragged into the street and beaten with keyboards, followed shortly by geeks who empower them by putting any of the blame on the end user. If I paid thousands for an OS site license, I should not be spending my holidays fixing it. If I spend hundreds for an oem copy at home, the same applies. The only ones who deserve ANYTHING bad here are the exploiters and the providers of the crappy OS in question.

    1. Re:Bah! by rubberband · · Score: 5, Insightful

      I still think the point is valid. Consider that a) That means that the vendor has had 7 years to secure their product. I any other industry they would have litigated into oblivion by now. It is *NOT* the end user's fault that the current world standard for personal computer operating systems is frequently bugged.

      Sure, carrying $1000 in cash is dumb, but there are easily accessible alternatives. Credit cards, debit cards, traveller's cheques, travel wallets, etc are all viable alternatives. Carrying cash is like opening attachments from unknown senders. Getting your windows box 0wned without your action because a new exploit came out 8 hours ago is like the jacket manufacturer attaching a big red "steal from me!" sign to the back and cutting a pickpockt access hole out, too. (Except then they take over the world jacket manufacturing business and force you to wear one unless you want to freeze or learn to sew).

      To use the token comparison to a vehicle - yes, when you buy a car you should be responsible enough to get it serviced from time to time, and act on any critical recall issues that might arise. You shouldn't however have to open the hood and check the internals 3 times per day to ensuire it doesn't explode and require expensive maintenance the next time you turn the key in the ignition.

      Don't get me wrong - I'm not saying sysadmins should have no responsability whatsoever. They are after all paid to deal with systems. But when was the last time you head of a dell salesperson telling an unexperienced buyer that if they wish to have their computer on regularly they'll need to spend 5 minutes every single day, and an hour of two each week making sure they're machine doesn't get destroyed?

  10. Re:Is it really this hard... by Gopal.V · · Score: 4, Interesting
    Vulnerabilities are not hard to write - they are hard to detect and often easy to fix.

    Most FOSS programs are the result of someone who really wants to write something good. Rarely have I seen someone being forced to write FOSS code to meet a release date schedule or to remain competitive. It's about It'll be done when it's done, sort of Code Poetry. Most of the code was written to run in a hostile environment where black hats can read the code (like the above peice) and screw everyone who runs bad code. The term security in obscurity as far as coding style does not even enter your mind.

    Also vulnerabilities are easier to find when you have the source - like that professor who set his students to find vulnerabilities in FOSS. Unlike a corporate setup - you have a practically unlimited number of reviewers if your program is popular (and if it is not, a vulnerability is no big deal anyway, right). Also everyone runs a different binary, slightly different from what everyone else runs (security often needs you to recompile stuff with stack canaries)

    So FOSS software evolves (yes, Natural Selection) to avoid these vulnerabilities by dying out or it "adapts" - Someone adds more good ideas and makes it better like.. (s/ideas/genes == Sexual reproduction) . Also the good ones read Wietse's papers.

    --
    Quidquid latine dictum sit, altum videtur
  11. Twas the morn before christmas by killerface · · Score: 4, Funny

    Twas the morn be for Christmas and all through the cage.
    Not a creature was stirring not even a 10th level mage.
    Then Flash, i look at my bookmarks and what did appear!?
    A story on slashdot spreading with fear.
    "Peril Peril", It screamed with fervor and fight.
    "What shall we do about this vulnerability tonight?"

    It's christmas eve and in the story lay more,
    For this affected Santa and hurt him to the core.
    His Server Used Exchange to give and recieve,
    a malicious cracker got in to make Santa Grieve.

    The clean cut elves said format and reinstall, while the ones with long beards solved it in no time at all.

    "There will be no Christmas this year" Santa Said with dismay.
    The naughty and nice list was lost in the fray.

    And yet with precision and care the elves brought out from back,
    santas new gift! a blade server rack!

    "It runs Linux in fact!" said the elves in unison
    "cron jobs too, back up that old piece of Sh.."
    one interupted "Stop it Sam",

    So christmas would go on with ease and ablitity, that is until santa went on his killing spree.

    The End

  12. Re:I don't get it.... by cnettel · · Score: 5, Informative

    This doesn't have to apply to kernel stuff. A lot of Windows apps rely on for example the "common controls" API. It handles toolbars, tooltips, listviews and so on. Quite a lot of UI goodies. Most of those are implemented without any kernel side, they're normal user mode controls/"windows" with their own drawing.

    Now to the point: This DLL was updated quite a few times with Internet Explorer 3, 4 and 5. The versions in Windows 98, 2000 and XP are/were directly related to the matching (sub-)version of Internet Explorer. If you wrote an app for Win-95 and wanted to use one of those common controls, the recommended redistribution scenario was redistributing IE.

    If they simply ripped out anything that is officially part of the "IE codebase", it's completely true that quite a few apps would fail.

    This is of course even more true of some of other APIs with a more apparent connection to Internet Explorer, like WinInet for interacting with HTTP/FTP without doing sockets yourself (and using the IE cache and other stuff) or employing the IE HTML/XML parsing and possibly rendering hosted in another application. I chose common controls because they're very frequently used, and some quite significant updates were introduced through IE. These updates are still there in "Win98 lite" and whatever you would do to a Windows system to rip out IE, but retain a reasonable level of compatibility. Just because it's part of the OS and a frequently used API doesn't mean it's kernel mode. And very little IE related code is *in the kernel*.

    Now to the point: LoadImage is quite a low level function. Display drivers are allowed to use it on their own and modify its functionality. That makes it belong in kernel mode. Even if they moved back some more UI stuff from the kernel, stuff like this probably belongs there, if you buy the concept of placing display drivers in kernel mode at all.