Slashdot Mirror
Image Causes Exploitable Overflow in Microsoft Products
Em Adespoton writes "Core Security researchers discovered that by electing a specially-crafted graphic as the user's display picture in MSN Messenger, an attacker could trigger a buffer overflow vulnerability on the chat partner's computer. Through this, it is possible to covertly take over machines running instant messaging software. Windows Messenger and Windows Media Player are also affected by this vulnerability. The story is also available at Newsfactor.com and SearchSecurity.com."
Microsofts loss is my GAIM.
ha.
I think I heard of this method of attack in a security book I read once. Where the image of an avatar's identification turned out to be a computer-infecting virus. Oh, wait, it was a novel. "Snow Crash" by Neal Stephenson.
[
Animated pictures of shiny pocketwatches moving back and forth were found to be the most effective at taking control of other people's computers.
I'm a big tall mofo.
After RTFMing, this was part of this week's Microsoft patches.
Hello? Didn't you get the memo?
MS Security Chief Says Windows is Safer Than Linux
Now stop trying to spread FUD.
- For the complete works of Shakespeare: cat
By spreading to everyone in your buddy list, a worm based on this exploit could infect 90% of the world in a couple hours.
I'm doing my part. I don't have any friends.
Is this one at all related to the previous image library flaws (the vulnerability for which the GDI detection tool was released to identify any Windows apps that were affected)?
Oh, wait, I think I found it! A patch was released for PNG processing flaws on Tuesday this week; among the affected software: Microsoft MSN Messenger.
A friend of mine used the goatse image for his MSN person icon and I had a buffer overflow of my own.
When did I ever eat corn?
More
The image that triggers it is an inverted picture of Bill Gates playing cards with Sadam, Satan, and Celine Dion.
Isn't this the same technique Geordie LaForge came up with for introducing a virus into the Borg collective? Remember Hugh?
Maybe the image of Bill Gates-as-Borg was a little more prophetic than we all realized.
What? I thought all this time they were *Portable* Network Graphics. Well, the article says "Proprietary" so they must be right.
lorem ipsum, dolor sit amet
They've said that PNG stands for "Proprietary Network Graphics". In fact, this is very wrong - it's not proprietary at all. The idea of the format is that it _ISN'T_ proprietary - it's free as in speech, free as in beer, free as in patents.
PNG really stands for Portable Network Graphics. And I hope that people don't get confused and start blaming the PNG file format for a bug that is MS's fault.
Perhaps one should take note that this overflow bug is not in MS code, but in the open-source LibPNG, which MS used.
And it's also included in most Linux distros.
If MS is to blame, it's for their lousy reaction speed. This vunerability has been known for months.
The Slashdot story blurb leaves out that this fix is already available. Certainly, if the fix hadn't already been made available you could count on that tidbit being mentioned....
I used to struggle with the "why do they keep using it, when there are so many (much better) alternatives" question. I see now how silly my confusion was. It's all so clear...
Windows... Is a video game!
Sure, think about it. Can you hack your friend Billy's computer before he hacks yours while you chat online? The suspense must be very exciting. Who has the better Script? Who has the better collection of vulnerabilities?
It must be almost like playing Magic: The Gathering, or one of the other card games kids are into now. "My hack trumps yours! I get all your pr0n!"
Suddenly I feel very boring. Sigh... It's okay, Slackware, I love you even IF you're secure. I'll just have to settle for being Rudolph, and not play in any Reindeer Games.
Oh! Look! My Microwave just beeped! Pea Soup!
Mmmm!
Farewell! It's been a fine buncha years!
.....is already out.
This space intentionally left blank.
Phwew. I was about to go BALLISTIC on your post... but then thank goodness I saw the '/sarcasm' at the end. I mean, I was stoked up to spew some hellfire on you for your outrageous statements. They seemed... almost... too extreme to believe. Now that I see you clearly labelled it as 'sarcasm' I took a step back, and I'm cooling off. Shaking my arms, letting the anger go.
Good thing you clearly labelled it as sarcasm.
'cause otherwise I wouldn't have known.
Really good sarcasm, too.
Got me, there.
Phwew.
- For the complete works of Shakespeare: cat
The patch was released on Feb 8, the story comes out on Feb 11. Right, not much to see here.
Maybe the RAF has a big PowerPoint that's of interest on web server somewhere...
Imagine how much harder physics would be if electrons had feelings! -Feynman, maybe
The vulnerability is described in MS05-009 which refers to CAN-2004-0597. This is a buffer overflow in libpng which was fixed in early August last year. So Microsoft needed six months to fix a publicly known vulnerability.
OS Reviews: Free and Open Source Software
no, it's Pornographic Network Graphics, your definition is just a smoke screen so the religious right doesn't get all fired up
US Democracy:The best person for the job (among These pre-selected choices...)
But, have you ever tried to uninstall MS Messenger? http://www.theregister.co.uk/2002/04/02/windows_me ssenger_trojan_update/
Those not blessed with geekiness cannot do it, so are stuck.
Ignorance is curable, stupid is forever.
a friend of mine used to work for MS on a version of IE... one bug they were trying to track down involved jpg (or was it gif) images of a certain--very large--dimension that could in some circumstances cause boot-block overwrite on the boot drive as it was being cached... (this was a few years back...)
when this bug was being discussed in a meeting, the first thing that was said was something to the effect of "oh, and if you tell anybody--anybody--about this, you might as well look for a new job at the same time, and a good lawyer."
of course, this was a few years ago, and from what i understand it was fixed right away, but still...
m-
You catch enchiladas by picking them up behind the head and holding them underwater until they don't kick anymore -VeGas
So anyone else notice that if you remove MSN Messenger and Outlook Express via the Control Panel's "Add/Remove Programs", the programs aren't actually removed from "C:\Program Files\Messenger" and "C:\Program Files\Outlook Express" ?
WindowsUpdate still asks you to install patches for Messenger and OE, even though they are supposedly "uninstalled".
IE still somtimes shows a Messenger icon on one of the toolbars.
I still occasionally find the the MSN Messenger icon in the status tray, even though it is supposedly "uninstalled", and the users on my network aren't smart enough to run MSN Messenger from the commandline.
What gives?
94% of Repubs and 21% of Dems voted to renew the Patriot Act
You have to manually call the uninstall section of the msn messenger INF file.. ive done it so many times i type it from memory..
go to start>run, and typemake sure msn messenger is closed first so it wont error when it unregisters the dll files
[an error occurred while processing this directive]