Slashdot Mirror
Image Causes Exploitable Overflow in Microsoft Products
Em Adespoton writes "Core Security researchers discovered that by electing a specially-crafted graphic as the user's display picture in MSN Messenger, an attacker could trigger a buffer overflow vulnerability on the chat partner's computer. Through this, it is possible to covertly take over machines running instant messaging software. Windows Messenger and Windows Media Player are also affected by this vulnerability. The story is also available at Newsfactor.com and SearchSecurity.com."
Use the old security notification for image library overflows and do nothing new with it except use the image code running in messenger. WOW, that's news...
Loading...
Microsofts loss is my GAIM.
ha.
I think I heard of this method of attack in a security book I read once. Where the image of an avatar's identification turned out to be a computer-infecting virus. Oh, wait, it was a novel. "Snow Crash" by Neal Stephenson.
[
Animated pictures of shiny pocketwatches moving back and forth were found to be the most effective at taking control of other people's computers.
I'm a big tall mofo.
it's safer using an OS which has less security updates per year than Linux?
After RTFMing, this was part of this week's Microsoft patches.
Hello? Didn't you get the memo?
MS Security Chief Says Windows is Safer Than Linux
Now stop trying to spread FUD.
- For the complete works of Shakespeare: cat
I can't belive that.. but i love all my microsoft products.. they must be wrong, microsoft doesn't have security flaws!! and my MSN messanger is totally safe, and all my WMA and WMV files are so totally secure! /sarcasm
President Bush Supporter
If only I had Bill Gate's MSN . . .
By spreading to everyone in your buddy list, a worm based on this exploit could infect 90% of the world in a couple hours.
I'm doing my part. I don't have any friends.
IT: MS Security Chief Says Windows is Safer Than Linux....
who finds it funny that the Google ads for the article show an advert for MSN Messenger?
There is a huge difference.
Is this why today my MSN asked me to upgrade to a new version? Or is the new version still vulnerable to this? I'm using version 6.2.0205
http://blog.monkeymethods.org/images/billgates01.j pg
Enough to make any buffer quit really...
It was implied that it pertains to those having the things listed. Dumbass.
Anyone ever done a study to determine the mean time between when MS claims their products are secure and when the next exploit is announced?
The someone better hurry and write a "white-hat" worm that installs an update that patches the exploit. Then we could patch "90% of the world" in a couple hours.
I'll bet the guy who used gets() is long gone, so they're still searching for each of his hidden calls to it. It's either that, or he won't admit to ever having used it.
OCO is Loco
Looks like the problem is with PNG handling. Could it be then exploited through web pages? Or is it only the use those applications make of the format?
Right, you mean this buffer over-flow protection?
The image that triggers it is an inverted picture of Bill Gates playing cards with Sadam, Satan, and Celine Dion.
Isn't this the same technique Geordie LaForge came up with for introducing a virus into the Borg collective? Remember Hugh?
Maybe the image of Bill Gates-as-Borg was a little more prophetic than we all realized.
AAAAAAAAAAARGHHHHHHH! NSFW! Not safe for anything! That's way too scary. Dug
News Update: Woman Gives Birth
Breaking Story: Actor Turns Politician
Headline: Sun Rises in East...AGAIN!
*sigh*
What? I thought all this time they were *Portable* Network Graphics. Well, the article says "Proprietary" so they must be right.
lorem ipsum, dolor sit amet
That's because somebody else figured out a way to buffer overflow the Windows' WAV processing code.
Tyranny isn't the worst enemy of a democracy. Cynicism is.
They've said that PNG stands for "Proprietary Network Graphics". In fact, this is very wrong - it's not proprietary at all. The idea of the format is that it _ISN'T_ proprietary - it's free as in speech, free as in beer, free as in patents.
PNG really stands for Portable Network Graphics. And I hope that people don't get confused and start blaming the PNG file format for a bug that is MS's fault.
Perhaps one should take note that this overflow bug is not in MS code, but in the open-source LibPNG, which MS used.
And it's also included in most Linux distros.
If MS is to blame, it's for their lousy reaction speed. This vunerability has been known for months.
The Slashdot story blurb leaves out that this fix is already available. Certainly, if the fix hadn't already been made available you could count on that tidbit being mentioned....
I used to struggle with the "why do they keep using it, when there are so many (much better) alternatives" question. I see now how silly my confusion was. It's all so clear...
Windows... Is a video game!
Sure, think about it. Can you hack your friend Billy's computer before he hacks yours while you chat online? The suspense must be very exciting. Who has the better Script? Who has the better collection of vulnerabilities?
It must be almost like playing Magic: The Gathering, or one of the other card games kids are into now. "My hack trumps yours! I get all your pr0n!"
Suddenly I feel very boring. Sigh... It's okay, Slackware, I love you even IF you're secure. I'll just have to settle for being Rudolph, and not play in any Reindeer Games.
Oh! Look! My Microwave just beeped! Pea Soup!
Mmmm!
Farewell! It's been a fine buncha years!
.....is already out.
This space intentionally left blank.
Am I reading this wrong, or are these exploits for vulnerabilities that are already patched? As much as I love to hate Microsoft, you can't really hold it against them once they've released a patch (even if it is only a number of days after the patch was released.)
I just need more solid ammunition if I'm going to get in arguments with my Cult-Of-Microsoft coworker zealots.
-Arthur
Cave ne ante ullas catapultas ambules
Use Microsoft's simple instructions to remove messenger. Glad they made it so point-and-click for those end users!</sarcasm>They obfuscated it because Messenger is such an important part of the lock-i... er operating system. Never mind that editing your registry may void your tech support, destroy your install, burn your clothes, hit your dog. I guess I'll be getting more calls from my family if disabling Messenger gets recommended in the press. Whenever they see that "Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk." they ask me to fix it. I guess I should put together a .reg and a.vbs file for them now.
US Democracy:The best person for the job (among These pre-selected choices...)
God damned stupid people!
It's Portable Network Graphics
http://en.wikipedia.org/wiki/Png
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Ah, see and die. Check out the Wikipedia article on harmful sensation motif.
Sheesh, evil *and* a jerk. -- Jade
Remember Microsoft produces LESS security patches than Linux distros so Windows is safer!!! You can not deny the facts! [/extreme sarcasm]
Hero of Allacrost, a FOSS RPG for *NIX/*BSD/OS X/Win
hmm. What picture could possibly cause a program to crash and burn and the computer to be PWNT?
Does goatse strike again? *grin*
Liberty.
1. This has been patched. /.
2. GAIM has had exploits patched.
3. Linux has had exploits patched.
4. I remember reading people defending Linux by saying that a lot of the distribution patches are not for the OS but instead for tools/apps... Yet you don't hold the same true for Microsoft?
5. People need to be a little more objective, even on
6. This is old news.
The vulnerability is described in MS05-009 which refers to CAN-2004-0597. This is a buffer overflow in libpng which was fixed in early August last year. So Microsoft needed six months to fix a publicly known vulnerability.
OS Reviews: Free and Open Source Software
US Democracy:The best person for the job (among These pre-selected choices...)
Exploitable Overflows Cause Bad Image
(A day like every day in Redmond)
And here he is on TV telling everyone how much more secure Windows is.
It's all fun and games until someone loses the key to the handcuffs.
This one seems to be one of the few level headed persons posting on this article.
Yes, it's bad that there is a flaw in MSFT software, but they have released a patch, now move on.
Help Brendan pay off his student loans
But, have you ever tried to uninstall MS Messenger? http://www.theregister.co.uk/2002/04/02/windows_me ssenger_trojan_update/
Those not blessed with geekiness cannot do it, so are stuck.
Ignorance is curable, stupid is forever.
Until things start getting fixed at the tool and OS level we're going to continue having these types of exploits once a month for the NEXT twenty years. If we don't switch from using C this is going to be the Slashdot headline in 2025: "Vulnerability on Microsoft HoloChat allows attackers to take over your nervous system."
you have a lot of buddies, i have more contact in the address book than buddies online in my msn, it think that the mail is still more dangerous than the IM
\n.\n
there should be a RTFRPFYM (Read the F* Redundant posts first, you moron) acronym.
What do you think, guys?
IMHO, WADR, STFU.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
You mean there are people using MSN Messenger?
Not since Marie-Antoinette played milkmaid has looking simple and honest been so fake and complicated.
a friend of mine used to work for MS on a version of IE... one bug they were trying to track down involved jpg (or was it gif) images of a certain--very large--dimension that could in some circumstances cause boot-block overwrite on the boot drive as it was being cached... (this was a few years back...)
when this bug was being discussed in a meeting, the first thing that was said was something to the effect of "oh, and if you tell anybody--anybody--about this, you might as well look for a new job at the same time, and a good lawyer."
of course, this was a few years ago, and from what i understand it was fixed right away, but still...
m-
You catch enchiladas by picking them up behind the head and holding them underwater until they don't kick anymore -VeGas
Against Windows, because Messenger isn't part of the "core" functionality of Windows.
However...
The mailman exploit counts against Redhat Enterprise, because it ships with the distribution.
(just squint really hard, and you'll be able to clearly see what I'm talking about)
Many people in the UK certainly do. I believe it's the main IM program here.
On the same day as slashdot reports Mike Nash, Microsoft's Chief Security Executive, has made claims that Windows is more secure than Linux
When all is said and done, nothing changes...
So Microsoft's use of FOSS directly led to this problem? The mind boggles at the interpertations people will draw from that!!!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
"Now stop trying to spread FUD."
So, if a single security problem turns up in Linux, can I cry FUD when it's claimed that Linux is more secure?
"Derp de derp."
So anyone else notice that if you remove MSN Messenger and Outlook Express via the Control Panel's "Add/Remove Programs", the programs aren't actually removed from "C:\Program Files\Messenger" and "C:\Program Files\Outlook Express" ?
WindowsUpdate still asks you to install patches for Messenger and OE, even though they are supposedly "uninstalled".
IE still somtimes shows a Messenger icon on one of the toolbars.
I still occasionally find the the MSN Messenger icon in the status tray, even though it is supposedly "uninstalled", and the users on my network aren't smart enough to run MSN Messenger from the commandline.
What gives?
94% of Repubs and 21% of Dems voted to renew the Patriot Act
Hey that is boring. Everybody knows that MS is the incarnation of a security flaw. No need to repeat that again and again.
Roman Kennke
You have to manually call the uninstall section of the msn messenger INF file.. ive done it so many times i type it from memory..
go to start>run, and typemake sure msn messenger is closed first so it wont error when it unregisters the dll files
[an error occurred while processing this directive]
But you gotta admit, Microsoft is more secure than Linux...
1 3208&threshold=1&tid=109&tid=218&tid=106
At least according to that fool from this morning...
Mike Nash at http://it.slashdot.org/article.pl?sid=05/02/11/14
--E--
...the guys who wrote TFA at Techtree are from the JPEG. They might be jealous since PNG is Turbo-Studly(tm).
(Side note: Why doesn't Slashdot show character entities like ™ in "HTML Formatted" comments?
You can hold down the "B" button for continuous firing.
This is not the only MS security flaw under review, at the moment. It was shown recently that MS Office documents are weakly encrypted using the password directly. It has been shown that there is a way of recovering the key in a relatively short timeframe if you have two versions of the same file. (This isn't actually too hard to achieve, as most people keep backups.)
Instead of boasting how they've "only" released a few mega-patches over the last year, Microsoft really needs to sit down and do a thorough code audit. Hell, if that would be too expensive, just run the standard libraries through "splint" or the Stanford Code Validator. Even if Microsoft were to just fix those bugs one of those code auditing tools reported, I flat-out guarantee confidence in the security of their products will increase far beyond their wildest imagination.
The problem is neither inevitable nor insoluble. And boasting about Windows over Linux eliminates neither the problem nor the growing awareness of it. Addressing the problem, with a firm determination, would.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
By spreading to everyone in your buddy list, a worm based on this exploit could infect 90% of the world in a couple hours.
:D So now 90% of the world uses MSN Messenger :)
ROTFLMAO
That should be on the front page up ahead
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
Does that imply that 90% of the world is using MSN Messenger?
Enjoy an e-piphany
You're mostly right about MacOS. Where did you get the 'ties with openBSD' bit from, though?
"A language that doesn't affect the way you think about programming, is not worth knowing" - Alan Perlis
I remember years ago I had the idea of embedding viruses in gif and jpg's. I just couldn't figure out how I would get it to execute the code.
Thanks Microsoft.
Well, I think it's ironic (funny ironic and sad ironic at the same time) that this article appears the same day as this one. It's difficult to be taken seriously about security when you're getting busted like this all the time.
I might know what I'm talkin' about, but then again, this is Slashdot...
Mod parent up, this is actually useful.... Or is it really true that NOBODY here uses Windows?
I refreshed a few times and saw a few vonage ads, but none played sound for me...
"A language that doesn't affect the way you think about programming, is not worth knowing" - Alan Perlis
Really? Removing MSN messenger is simple go, to add/remove files click uninstall. Simple and easy. Maybe if you were smart enough to realize that you're actually trying to remove Windows Messenger not MSN messenger, you wouldn't have have issues. Next are you going to complain about not being able to remove Oulook Express by trying to uninstall Outlook XP?
Have you ever been to a turkish prison?
I don't think you understand.
1. Claim Linux is more secure than windows.
2. Someone finds exploit in Linux
3. Cry FUD
4. Profit
One of those 12 security patches was for... wait for it... this problem! You can stop your clock now.
...which was patched on Tuesday. IMHO, that qualifies old news.
"C:\Program Files\Messenger" contains the 'Windows Messenger' product, which is the IM client that is part of Windows XP... MSN Messenger is a different program altogether, and is installed in a different directory. You can run Windows Messenger and MSN Messenger at the same time.
ok fine, I screwed up the names. I don't actually use the program.
The fact still remains that removing "Windows Messenger" via "Control Panel: Add/remove programs: Add/remove Windows components" doesn't remove C:\Program Files\Messenger .
94% of Repubs and 21% of Dems voted to renew the Patriot Act
...he was right when he said "There are no weapons of mass destruction in Baghdad"--when we checked, anyway.
You can hold down the "B" button for continuous firing.
Anyone ever done a study to determine the mean time between when OSS camp claims Linux is secure (which is constant and at every opportunity) and when the next security patch is released?
or was this already fixed in last round of bugfixes, this tuesday?
Privacy is terrorism.
Maybe that was added in SP2, though, since I remember having to execute a file (got the instructions from annoyances.org) in the command prompt to uninstall it last time I had installed XP (about a year ago, IIRC). The uninstaller was there, just that there was no shortcut to go to it.
as long as solitare remains safe
What?
Control Panel | Add/Remove Programs | Add/Remove Windows Components
Uncheck Windows Messenger
Click Next
Click Finish
To add some sanity to this discussion, here's some facts:
n /MS05-009.mspx
The MS bulletin and patch: http://www.microsoft.com/technet/security/Bulleti
It's a vulnerability in libpng that was just patched by MS Tuesday, but was fixed by everyone else when it was discovered last June.
WeRelate.org - wiki-based genealogy
You're not making any sense. The issue was with libpng, which is used by pretty much every image-capable platform in existance. Everyone else patched it when it was discovered last summer, though.
The real question to ask is "Why did it take MS so long to remember it had used a vulnerable version in MSN Messenger?"
WeRelate.org - wiki-based genealogy
Is that you michael? Oh wait...he has piquepaille.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
To confuse you even more, there is a Windows Messenger and MSN Messenger. When you install MSN Messenger it simply disables start-up of Windows Messenger.
So when you uninstall MSN Messenger, it may be automatically enabled Windows Messenger. I don't know if that's what you are seeing.
Kashif
I got to this phrase in the article
"Proprietary Network Graphics (PNG)"
and decided that if there was any substance to the story, I wasn't going to find it in this guy's writing.
So, is the Microsoft policy of "embrace and extend" now being applied to common acronyms? Or is the writer too out of touch with the technology he is reporting about to know how to use dictionary.com or google to check a key definition in his story? And where were his editors??
Actually, no, it does not necessarily take any CPU time. Modern CPUs have some very fancy methods of doing branch prediction, which means they can estimate what the likely outcome of an IF statement is, and if they guess correctly, that statement ends up taking no additional time; it just disappears from the loop. And if you are looping through a million values, the branch prediction performed on the array bounds check will probably be correct every time during normal use of the loop, so in fact, the array bounds check ends up being for free!
And, a simple bounds check like: if(pointer > limit) is a single CPU instruction. How long does a single CPU instruction take to execute these days? How much does a faster CPU cost? How much does a security hole cost?
Don't you think that the idea of data being able to be executed is daft? It shouldn't be able to happen. Now I know how it can happen, overlapping code areas etc. etc., but shouldn't we be looking at whole architectures that stop this? (Is this what that new flag in the AMD processors does, I'm not up to speed on those). Can't we say "don't execute PNGs, they never contain executable code" at the lowest level possible in the system? Why not?
It was added in SP2. I remember reading it in the release notes.
Before, following the add-remove programs procedure would only remove shortcuts, it wouldn't even take it out of the RUN section of the registry.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Dude, that rocks. I'm looking for a comprable section in msoe50.inf, for Outlook Express, but I don't see it. Any clues here?
Thanks.
-molo
Using your sig line to advertise for friends is lame.
Problem has been fixed. Its a non-issue.
But what a great chance to re-iterate how much we all hate MS! hate hate hate! hate hate hate! woohhhh!
Get a frickin life!
George Bush + Linux = "I will not let information get in the way of the fight against Windows"
Reboot the robot, then.
This post written under Gentoo-linux with an SCO IP license.
In the meantime, I had it disabled in the registry, and installing the newest patches actually re-enabled it. It popped up and jacked the connection away from Gaim. I ended up setting a security policy to prevent it from running, we'll see if that works.
This was part of the anti-trust settlement between the government and Microsoft. Microsoft broke the law repeatedly and the government nailed their ass to the wall in court for it, so the punishment against Microsoft was a settlement that they had to create an "uninstall" system that merely "hides" certain abusive Microsoft components from the owner, but still activates those "hidden" components whenever Microsoft wants to activate them.
The primary items that this applies to are the webbrowser and mediaplayer, but as you've noticed it applies to pretty much anything Microsoft wants it to apply to.
Just imagine how bad things would be if the government hadn't given Microsoft the smackdown for antitrust violations! We'd be in pretty much the exact same boat we're in now.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Comment removed based on user account deletion