Slashdot Mirror
Image Causes Exploitable Overflow in Microsoft Products
Em Adespoton writes "Core Security researchers discovered that by electing a specially-crafted graphic as the user's display picture in MSN Messenger, an attacker could trigger a buffer overflow vulnerability on the chat partner's computer. Through this, it is possible to covertly take over machines running instant messaging software. Windows Messenger and Windows Media Player are also affected by this vulnerability. The story is also available at Newsfactor.com and SearchSecurity.com."
Use the old security notification for image library overflows and do nothing new with it except use the image code running in messenger. WOW, that's news...
Loading...
MS Security Chief Says Windows is Safer Than Linux
Microsofts loss is my GAIM.
ha.
I think I heard of this method of attack in a security book I read once. Where the image of an avatar's identification turned out to be a computer-infecting virus. Oh, wait, it was a novel. "Snow Crash" by Neal Stephenson.
[
This Windows / OSS war is wearing thin... Could it just be decided once and for all who the victor of the security battle is???
Animated pictures of shiny pocketwatches moving back and forth were found to be the most effective at taking control of other people's computers.
I'm a big tall mofo.
The vonage ad on the page is fucking playing sound, VERY LOUDLY, over my computer speakers! Whoever did that is a fucking asshole!
it's safer using an OS which has less security updates per year than Linux?
After RTFMing, this was part of this week's Microsoft patches.
Simply cannot be, because Windows is more secure than Linux. So you see, there's nothing to worry about. Move along.
Tech, life, family, faith: Give me a visit
Hello? Didn't you get the memo?
MS Security Chief Says Windows is Safer Than Linux
Now stop trying to spread FUD.
- For the complete works of Shakespeare: cat
By spreading to everyone in your buddy list, a worm based on this exploit could infect 90% of the world in a couple hours.
I can't belive that.. but i love all my microsoft products.. they must be wrong, microsoft doesn't have security flaws!! and my MSN messanger is totally safe, and all my WMA and WMV files are so totally secure! /sarcasm
President Bush Supporter
If only I had Bill Gate's MSN . . .
Didn't MS's whatshisface JUST say that Windows is more secure than Linux? Hoo-hoo!
So, tell us again, just HOW is a system based on a more monolithic design more secure than a bunch discrete components interfacing through an open standard?
Thats why Microsoft put buffer overflow prevention measures in SP2. They realize that buffer overflows can happen in many many places. Jesus you people are stupid.
IT: MS Security Chief Says Windows is Safer Than Linux....
Mike Nash, Microsoft's Chief of Security was found dead in his Redmond, WA office. The cause of death is currently under investigation, but sources close to the investigation have suggested that both his feet were jammed firmly down his throat and he may have choked to death as a result.
who finds it funny that the Google ads for the article show an advert for MSN Messenger?
There is a huge difference.
Is this why today my MSN asked me to upgrade to a new version? Or is the new version still vulnerable to this? I'm using version 6.2.0205
http://blog.monkeymethods.org/images/billgates01.j pg
Enough to make any buffer quit really...
Just visit for a downloadable fix.
You have a constitutionally protected right to be wrong, and I the right to ignore you.
That is a funny-ass article. +5 for funniness!
Anyone ever done a study to determine the mean time between when MS claims their products are secure and when the next exploit is announced?
I'll bet the guy who used gets() is long gone, so they're still searching for each of his hidden calls to it. It's either that, or he won't admit to ever having used it.
OCO is Loco
Looks like the problem is with PNG handling. Could it be then exploited through web pages? Or is it only the use those applications make of the format?
The image that triggers it is an inverted picture of Bill Gates playing cards with Sadam, Satan, and Celine Dion.
Isn't this the same technique Geordie LaForge came up with for introducing a virus into the Borg collective? Remember Hugh?
Maybe the image of Bill Gates-as-Borg was a little more prophetic than we all realized.
If I got a penny for each redundant /. post...
there should be a RTFRPFYM (Read the F* Redundant posts first, you moron) acronym.
What do you think, guys?
AAAAAAAAAAARGHHHHHHH! NSFW! Not safe for anything! That's way too scary. Dug
News Update: Woman Gives Birth
Breaking Story: Actor Turns Politician
Headline: Sun Rises in East...AGAIN!
*sigh*
What? I thought all this time they were *Portable* Network Graphics. Well, the article says "Proprietary" so they must be right.
lorem ipsum, dolor sit amet
They've said that PNG stands for "Proprietary Network Graphics". In fact, this is very wrong - it's not proprietary at all. The idea of the format is that it _ISN'T_ proprietary - it's free as in speech, free as in beer, free as in patents.
PNG really stands for Portable Network Graphics. And I hope that people don't get confused and start blaming the PNG file format for a bug that is MS's fault.
Perhaps one should take note that this overflow bug is not in MS code, but in the open-source LibPNG, which MS used.
And it's also included in most Linux distros.
If MS is to blame, it's for their lousy reaction speed. This vunerability has been known for months.
The Slashdot story blurb leaves out that this fix is already available. Certainly, if the fix hadn't already been made available you could count on that tidbit being mentioned....
PNG stands for proprietary network graphics.
On the same day that we have a story about a Microsoft security chief spouting on about how Windows is safer than Linux. How fitting!
I used to struggle with the "why do they keep using it, when there are so many (much better) alternatives" question. I see now how silly my confusion was. It's all so clear...
Windows... Is a video game!
Sure, think about it. Can you hack your friend Billy's computer before he hacks yours while you chat online? The suspense must be very exciting. Who has the better Script? Who has the better collection of vulnerabilities?
It must be almost like playing Magic: The Gathering, or one of the other card games kids are into now. "My hack trumps yours! I get all your pr0n!"
Suddenly I feel very boring. Sigh... It's okay, Slackware, I love you even IF you're secure. I'll just have to settle for being Rudolph, and not play in any Reindeer Games.
Oh! Look! My Microwave just beeped! Pea Soup!
Mmmm!
Farewell! It's been a fine buncha years!
.....is already out.
This space intentionally left blank.
Am I reading this wrong, or are these exploits for vulnerabilities that are already patched? As much as I love to hate Microsoft, you can't really hold it against them once they've released a patch (even if it is only a number of days after the patch was released.)
I just need more solid ammunition if I'm going to get in arguments with my Cult-Of-Microsoft coworker zealots.
-Arthur
Cave ne ante ullas catapultas ambules
Use Microsoft's simple instructions to remove messenger. Glad they made it so point-and-click for those end users!</sarcasm>They obfuscated it because Messenger is such an important part of the lock-i... er operating system. Never mind that editing your registry may void your tech support, destroy your install, burn your clothes, hit your dog. I guess I'll be getting more calls from my family if disabling Messenger gets recommended in the press. Whenever they see that "Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk." they ask me to fix it. I guess I should put together a .reg and a.vbs file for them now.
US Democracy:The best person for the job (among These pre-selected choices...)
... the attacker can tell the victim that their computer is being taken over, since this uses MSN messenger.
ATTENTION: This is your captain speaking, please remain seated...
God damned stupid people!
It's Portable Network Graphics
http://en.wikipedia.org/wiki/Png
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
This is a prime reason that i will not run windows on my machines that connect directly to the net..
IT's just not safe!
You should type "All your base are belong to us" before you take over the other person's computer.
Ah, see and die. Check out the Wikipedia article on harmful sensation motif.
Sheesh, evil *and* a jerk. -- Jade
Remember Microsoft produces LESS security patches than Linux distros so Windows is safer!!! You can not deny the facts! [/extreme sarcasm]
Hero of Allacrost, a FOSS RPG for *NIX/*BSD/OS X/Win
hmm. What picture could possibly cause a program to crash and burn and the computer to be PWNT?
Does goatse strike again? *grin*
Liberty.
The vulnerability is described in MS05-009 which refers to CAN-2004-0597. This is a buffer overflow in libpng which was fixed in early August last year. So Microsoft needed six months to fix a publicly known vulnerability.
OS Reviews: Free and Open Source Software
Great, I just finally got the WiMP player working in firefox! I guess I will just have to use only trusted media content on windows....Or just stop booting hda1. Maybe this crap will finally convince great content providers to explore other options. The CBC archives are a great site and one of the only reasons I still have win98 on hda1. Check out this site http://archives.cbc.ca/
Too bad that it uses a windows only format!
....when MS addresses the problem
Ok..as you all know, MS just released like..12 security patches. I think they relized they need to keep up otherwise they'll lose more market share. Well...let's see how good they have become. 2/11/05...the clock is ticking
US Democracy:The best person for the job (among These pre-selected choices...)
Exploitable Overflows Cause Bad Image
(A day like every day in Redmond)
. 2004-08-23: Notification to vendor
...as you can see here
. 2004-08-23: Notification acknowledgment received from vendor
. 2005-02-08: Publication of fixes and advisories
Now I can understand why only 15 patch... they wait (need?) 6 months to patch only one...
How is this a troll? It's funny given the context. I wish people who actually read slashdot regularly were given (and used) mod points.
This one seems to be one of the few level headed persons posting on this article.
Yes, it's bad that there is a flaw in MSFT software, but they have released a patch, now move on.
Help Brendan pay off his student loans
Don't let the door hit you on the way out.
:-)
Until things start getting fixed at the tool and OS level we're going to continue having these types of exploits once a month for the NEXT twenty years. If we don't switch from using C this is going to be the Slashdot headline in 2025: "Vulnerability on Microsoft HoloChat allows attackers to take over your nervous system."
Because if it's porn, that certainly does cause overflow in something alright...
a friend of mine used to work for MS on a version of IE... one bug they were trying to track down involved jpg (or was it gif) images of a certain--very large--dimension that could in some circumstances cause boot-block overwrite on the boot drive as it was being cached... (this was a few years back...)
when this bug was being discussed in a meeting, the first thing that was said was something to the effect of "oh, and if you tell anybody--anybody--about this, you might as well look for a new job at the same time, and a good lawyer."
of course, this was a few years ago, and from what i understand it was fixed right away, but still...
m-
You catch enchiladas by picking them up behind the head and holding them underwater until they don't kick anymore -VeGas
Against Windows, because Messenger isn't part of the "core" functionality of Windows.
However...
The mailman exploit counts against Redhat Enterprise, because it ships with the distribution.
(just squint really hard, and you'll be able to clearly see what I'm talking about)
... when I see a nudie pic of Brooke Burke, I buffer overflow everywhere.
On the same day as slashdot reports Mike Nash, Microsoft's Chief Security Executive, has made claims that Windows is more secure than Linux
When all is said and done, nothing changes...
So Microsoft's use of FOSS directly led to this problem? The mind boggles at the interpertations people will draw from that!!!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I think you mean classic MacOS. By numbers deployed versus vulns, it wins hands down over any other in common useage OS. And if you factor in ease of use for the end user,from guru to raw noob, with a default install, it still comes out on top. Beats linux, windows and even OSX. As a server, it ties with open BSD. It may have flaws like memory use, but as to internet security, it was pretty darn good.
"Now stop trying to spread FUD."
So, if a single security problem turns up in Linux, can I cry FUD when it's claimed that Linux is more secure?
"Derp de derp."
So anyone else notice that if you remove MSN Messenger and Outlook Express via the Control Panel's "Add/Remove Programs", the programs aren't actually removed from "C:\Program Files\Messenger" and "C:\Program Files\Outlook Express" ?
WindowsUpdate still asks you to install patches for Messenger and OE, even though they are supposedly "uninstalled".
IE still somtimes shows a Messenger icon on one of the toolbars.
I still occasionally find the the MSN Messenger icon in the status tray, even though it is supposedly "uninstalled", and the users on my network aren't smart enough to run MSN Messenger from the commandline.
What gives?
94% of Repubs and 21% of Dems voted to renew the Patriot Act
I just started up MSN Messenger right before I came to slashdot for the day.. and it told me about an update that had to be run before I could continue. Could Microsoft actually care for once about security? Of course, maybe it means they knew about and how to fix this long ago and were just waiting for someone to notify the public before they released it.
This sig left blank for page turns.
Hey that is boring. Everybody knows that MS is the incarnation of a security flaw. No need to repeat that again and again.
Roman Kennke
You have to manually call the uninstall section of the msn messenger INF file.. ive done it so many times i type it from memory..
go to start>run, and typemake sure msn messenger is closed first so it wont error when it unregisters the dll files
[an error occurred while processing this directive]
But you gotta admit, Microsoft is more secure than Linux...
1 3208&threshold=1&tid=109&tid=218&tid=106
At least according to that fool from this morning...
Mike Nash at http://it.slashdot.org/article.pl?sid=05/02/11/14
--E--
...the guys who wrote TFA at Techtree are from the JPEG. They might be jealous since PNG is Turbo-Studly(tm).
(Side note: Why doesn't Slashdot show character entities like ™ in "HTML Formatted" comments?
You can hold down the "B" button for continuous firing.
This is not the only MS security flaw under review, at the moment. It was shown recently that MS Office documents are weakly encrypted using the password directly. It has been shown that there is a way of recovering the key in a relatively short timeframe if you have two versions of the same file. (This isn't actually too hard to achieve, as most people keep backups.)
Instead of boasting how they've "only" released a few mega-patches over the last year, Microsoft really needs to sit down and do a thorough code audit. Hell, if that would be too expensive, just run the standard libraries through "splint" or the Stanford Code Validator. Even if Microsoft were to just fix those bugs one of those code auditing tools reported, I flat-out guarantee confidence in the security of their products will increase far beyond their wildest imagination.
The problem is neither inevitable nor insoluble. And boasting about Windows over Linux eliminates neither the problem nor the growing awareness of it. Addressing the problem, with a firm determination, would.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
This sort of vulnerability is nothing new - a "proof of concept" has already been described using PicoJava on an 8255 system. I've lost my link to that paper, maybe someone could repost that link?
I remember years ago I had the idea of embedding viruses in gif and jpg's. I just couldn't figure out how I would get it to execute the code.
Thanks Microsoft.
Pretty funny typo, if it wasn't M$'s first step in taking over the format, so they can collect rolayties from everyone using PNG's, kinda like the whole .gif thing...
Well, I think it's ironic (funny ironic and sad ironic at the same time) that this article appears the same day as this one. It's difficult to be taken seriously about security when you're getting busted like this all the time.
I might know what I'm talkin' about, but then again, this is Slashdot...
oh and just wanted to point out.. %windir% is a system environment variable, windows will automatically replace it with your windows directory name, no need to manually type c:\windows or whatever
mrp-
Mod parent up, this is actually useful.... Or is it really true that NOBODY here uses Windows?
Really? Removing MSN messenger is simple go, to add/remove files click uninstall. Simple and easy. Maybe if you were smart enough to realize that you're actually trying to remove Windows Messenger not MSN messenger, you wouldn't have have issues. Next are you going to complain about not being able to remove Oulook Express by trying to uninstall Outlook XP?
Have you ever been to a turkish prison?
I don't think you understand.
1. Claim Linux is more secure than windows.
2. Someone finds exploit in Linux
3. Cry FUD
4. Profit
"C:\Program Files\Messenger" contains the 'Windows Messenger' product, which is the IM client that is part of Windows XP... MSN Messenger is a different program altogether, and is installed in a different directory. You can run Windows Messenger and MSN Messenger at the same time.
ok fine, I screwed up the names. I don't actually use the program.
The fact still remains that removing "Windows Messenger" via "Control Panel: Add/remove programs: Add/remove Windows components" doesn't remove C:\Program Files\Messenger .
94% of Repubs and 21% of Dems voted to renew the Patriot Act
...he was right when he said "There are no weapons of mass destruction in Baghdad"--when we checked, anyway.
You can hold down the "B" button for continuous firing.
Anyone ever done a study to determine the mean time between when OSS camp claims Linux is secure (which is constant and at every opportunity) and when the next security patch is released?
or was this already fixed in last round of bugfixes, this tuesday?
Privacy is terrorism.
as long as solitare remains safe
What?
Control Panel | Add/Remove Programs | Add/Remove Windows Components
Uncheck Windows Messenger
Click Next
Click Finish
Yeah, but MS-DOS v1.0 is even safer; no security updates ever! That's right folks, DOS 1.0 has never had a single security related patch released!
There has never been a need for a patch to DOS 1.0. There has never been a remote expoit of any kind for DOS 1.0.
There has never been a BSOD on DOS 1.0 either! How cool is that?
To confuse you even more, there is a Windows Messenger and MSN Messenger. When you install MSN Messenger it simply disables start-up of Windows Messenger.
So when you uninstall MSN Messenger, it may be automatically enabled Windows Messenger. I don't know if that's what you are seeing.
Kashif
It's been patched already. Move along zealot.
I got to this phrase in the article
"Proprietary Network Graphics (PNG)"
and decided that if there was any substance to the story, I wasn't going to find it in this guy's writing.
So, is the Microsoft policy of "embrace and extend" now being applied to common acronyms? Or is the writer too out of touch with the technology he is reporting about to know how to use dictionary.com or google to check a key definition in his story? And where were his editors??
Actually, no, it does not necessarily take any CPU time. Modern CPUs have some very fancy methods of doing branch prediction, which means they can estimate what the likely outcome of an IF statement is, and if they guess correctly, that statement ends up taking no additional time; it just disappears from the loop. And if you are looping through a million values, the branch prediction performed on the array bounds check will probably be correct every time during normal use of the loop, so in fact, the array bounds check ends up being for free!
And, a simple bounds check like: if(pointer > limit) is a single CPU instruction. How long does a single CPU instruction take to execute these days? How much does a faster CPU cost? How much does a security hole cost?
Don't you think that the idea of data being able to be executed is daft? It shouldn't be able to happen. Now I know how it can happen, overlapping code areas etc. etc., but shouldn't we be looking at whole architectures that stop this? (Is this what that new flag in the AMD processors does, I'm not up to speed on those). Can't we say "don't execute PNGs, they never contain executable code" at the lowest level possible in the system? Why not?
And give them an excuse not to make IE friendly with four channel pngs.. it's not in the spec. what can they say! ;)
The reality is that if you do something enough times mistakes will creep in. Either that or you have to do it in such a rigorous and methodical way that mistakes are prevented... but that means that it will take years for the product to get to market, which is not acceptable for commercial software.
Can this happen with Linux? Can a similar buffer overflow occur and arbitrary code execute? I assume not, but why not?
http://shit.slashdot.org/article.pl?sid=05/02/11/1 926227
Dude, that rocks. I'm looking for a comprable section in msoe50.inf, for Outlook Express, but I don't see it. Any clues here?
Thanks.
-molo
Using your sig line to advertise for friends is lame.
Oops, I broke my combobulator again :(
Problem has been fixed. Its a non-issue.
But what a great chance to re-iterate how much we all hate MS! hate hate hate! hate hate hate! woohhhh!
Get a frickin life!
George Bush + Linux = "I will not let information get in the way of the fight against Windows"
Reboot the robot, then.
This post written under Gentoo-linux with an SCO IP license.
This was part of the anti-trust settlement between the government and Microsoft. Microsoft broke the law repeatedly and the government nailed their ass to the wall in court for it, so the punishment against Microsoft was a settlement that they had to create an "uninstall" system that merely "hides" certain abusive Microsoft components from the owner, but still activates those "hidden" components whenever Microsoft wants to activate them.
The primary items that this applies to are the webbrowser and mediaplayer, but as you've noticed it applies to pretty much anything Microsoft wants it to apply to.
Just imagine how bad things would be if the government hadn't given Microsoft the smackdown for antitrust violations! We'd be in pretty much the exact same boat we're in now.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Comment removed based on user account deletion