Slashdot Mirror
Image Handling Flaw Puts Windows At Risk
An anonymous reader writes "Microsoft has released word that several image handling flaws may open Windows PCs to Spyware or viruses. From the article: 'We will continue to see this type of vulnerabilities in every major application for the foreseeable future ... It is not just images, but any type of complex file format. This is something that security researchers and hackers have realized to be a weak point in many applications.'"
Windows wasn't open to spyware and viruses before?
This vulnerability is a dupe!
Windows has already had an image handling flaw!
Oh, it's Windows. False alarm.
Okay, so it is critical. The advisory contains the patch to correct the problem. This only becomes an issue if Windows users don't patch their machines.
What is the likelihood that users won't patch their machines? (cough!)
From TFA:
Mehta doesn't expect the latest Windows flaws to be exploited in a widespread attack. "We're not bracing for any major worm or malware outbreak, but we do expect them to be used in targeted attacks," Mehta said. "There is user interaction required, there has to be someone sitting at the other end in order to be compromised."
Yeah, like viewing an image from usenet. No one ever does that.
"Rocky Rococo, at your cervix!"
This is why we need more managed code.
again.....
Or your computer could get an STD (Screenally Transmitted Disease) from viewing pornographic images.
I Am My Own Worst Enemy
So now not only will looking at the goatse picture make you vommit, it will take over your Windoze PC!
Will the horrors ever stop?!!
DEAD DEAD DEAD DELETE ME
It's not really a fundamental flaw?
Both jpg and png was flawed in Windows, MSN Messenger, and even other image apps by a buffer overflow exploit where a specially crafted jpeg file with a virus "attachment" would crash the program and execute virus code. I have to agree that if they are still finding flaws, we'll be stuck with them for a while. Just imagine, every Windows 98 computer out there probably has this problem too, and there's no way it's going to be really fixed. It will never be safe to run even "safe" things like jpg and mp3 on old computers now. It's very, very disapointing news.
In a Messenger program that is always accepting new input in the form of pictures and messages, it's especially dangerous because anyone who's online will instantly become a zombie spewing out infection to their friends on their contact list. You really will get viruses through your personal contacts more than spamming-strangers in the future.
Saskboy's blog is good. 9 out of 10 dentists agree.
There's no such thing as vulnerabilities, all there's is Inteligent Bug. The exploits are there just to test your faith...
-- Por mais que eu ande no vale das trevas e da morte, meu PowerMac G4 Não Travará!!!
Of course, I think the developers who left these vulnerabilities open should be financially responsible for the damage this may cause.
"Derp de derp."
When writing a parser (for a graphical or non-graphical data file) it is advisable to sanity check the input data at every step.
Consider ASN.1 data (used, for instance, for digital certificates, certificate revocation lists, certificate requests and so on).
Each and every ASN.1 data element and each and every sub-element contains a length field. The ASN.1 parser should check whether the length field of a sub-element goes beyond the length of the enclosing data element, and so on ad infinitum.
If the parser detects a violation, parsing stops.
Dedicated Linux servers (root access) $45 p.M.
And I was that dude who told them (in an eMail) that their IExplorer should get the transparency in png's right! ...OR ELSE!
I love how Microsoft puts this... "We will continue to see this type of vulnerabilities in every major application for the foreseeable future..."
... for them. "... until we learn that integrating IE directly into the OS was the biggest fuckup we ever made."
Lemme finish off that
Seriously, why integrate something so seriously flawed into the OS? The only thing it'll do is make the system less stable and less secure.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
It's a tangental thought, but the debate around online security, including this one, seems to be paving a wide path for DRM, or more centrally-managed content distribution methods in commercial applications.
'We will continue to see this type of vulnerabilities in every major application for the foreseeable future ... It is not just images, but any type of complex file format. This is something that security researchers and hackers have realized to be a weak point in many applications.'
In a later interview:"Only one known product suite on the market can protect you from these ongoing threats. MS-AntiVirus and MS-AntiSpyware. Only these two programs are equipt with the proper image handling algorithims to detect these known flaws inherent in all programs."
This seems like a big scheme to get people on their proprietary AV and AntiSpyware programs. Lets see... Find hole, fix hole, release press release about hole, plug product, patch hole for product users.
eesh.we will see.
Microsoft's .NET platform, which is supposed to be managed code, has built-in support for rendering WMF and EMF images (the image formats that are affected by this security vulnerability). So are applications written in .NET still vulnerable to the buffer overflow exploit, or was the underlying rendering code rewritten for the managed environment?
Writing managed applications won't protect you (completely) if the underlying framework isn't also managed.
Doubtful. Intelligent bug would be a byproduct of intelligent design and I've never heard anyone accuse them of practicing that.
1) To avoid the the new goatse image backdoor
2) Please type the word in this image.... doh!
does it work in Linux?
The WMF and EMF formats are just basically little programs full of GDI instructions. When you create one, you execute a bunch of GDI calls, with the WMF file as your Device Context. So essentially it's a shortcut-- an "easy" way to create a file format, based on the structure of the operating system's drawing code. I don't know about how the potential exploit works, but at first glance it seems like this is a typical case of designing a file format for "code convenience". Loading the file basically consists of loading a series of instructions and executing them. Now THAT sounds like a good idea! Easy to code for, but also easy to take advantage of. In other words, it's a lazy approach to coding. Lesson to be learned: File formats can be complicated! They must be designed to be a good *format*, not just to make coding easier. The more Microsoft designs its own file formats for each new technology it comes up with, the more we'll see this kind of thing. Better to find out what file formats are already out there, finding one that suits your needs, and supporting THAT, instead of coming up with one on your own. This is a case of re-inventing the wheel, badly.
While I hold no place in my heart for microsoft. Quicktime appears to be having a very similar problem. But also remember that the libjpeg and libz also had similar problems exploitable on Linux patched in the last year. Expecting an OS, ANY OS to save you is a bigger security threat than some exploitable jpeg code.
"We will continue to see this type of vulnerabilities in every major application for the foreseeable future ... It is not just images, but any type of complex file format. This is something that security researchers and hackers have realized to be a weak point in many applications."
If a programmer is taking the time and effort to interpret a complex file format, why can't he also take the time to validate it.
"Eve of Destruction", it's not just for old hippies anymore...
Now Sony will be able to put a rootkit on your computer without you even putting in a CD!
Internet Security Systems != Microsoft.
This has nothing really to do with IE. IE here just happens to be a vector. If FF on windows was depending on those libraries to display those image formats they would be vulnerable as well.
And similarly you do the same for encoding. First detect the length the data will be, then check, then encode. When testing make sure your "get_length" and "encode" functions return the same length. [if at all possible use the same code].
But that would be asking MSFT engineers to use "if" statements... that would be ill-advised as it means THEY WOULD HAVE TO KNOW WHAT THEY ARE DOING FIRST.
Tom
Someday, I'll have a real sig.
OS X just seems to be bulletproof : no major hacks yet.
The answer is XML.
No, seriously. Write your XML processor once, do a seriously thorough code audit to prove that no unguarded buffers or pointers are used, and then use XML for all document formats and network protocols where it is at all feasible. Obviously not MPEG, but SVG and OpenDocument and their ilk. Write your file-processing apps in Java or Python or C++ (but with NO pointers, use only iostream libraries and STL objects. No pointers PERIOD!) and the problem will be alleviated for all practical cases.
imho there are two issues.
1: when coding with pointers/unchecked length arrays all it takes is one screwup even if you are trying to be carefull. Higher level structures and/or managed code can prevent this but at a cost in performance bloat and in the case of managed code ease of integration with traditional code.
2: the wmf/emf code is probablly very old from long long before the internet was commonplace. The idea of people deliberately creating image files to bypass security probablly didn't even occour to anyone.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Ironic.
The usual MS obfuscation for "because we don't support 9x anymore, by definition there are no critical updates for 9x" is to state that 9x is "Not Critically Affected", with a URL to a page that defines "critically affected" in such a way as to exclude 9x.
"Not Affected", as claimed in MS05-053, is a stronger claim. That's not to say there aren't similar bugs in image-handling in 9x; only that the hole in this notice probably doesn't affect 9x.
Sounds like we need to go back to when your OS was mostly in ROM ( like the Ataris for example ).
At least then if you get exploited, the next time you reboot the exploit goes away.
---- Booth was a patriot ----
Ok, it's 2005, and we still can't handle buffers properly?
Do you see square wheels on formula 1 cars? Are our aircraft pulled by horses? Do we fuel our powerplants with phlogiston?
I stand in speechless awe at the inexorable march of computer technology.
In fact, I give up. I'm going to get a buggy whip to hit my computer with every time it misbehaves.
Every file format becomes a programming language in the long run.
OK, maybe not *every* file format, but most of them. Think about that, and design accordingly from the start. Parse into a VM from the start and write a verifier from the start.
And no, there isn't a magic bullet. Even the XML advocate who posted before me admitted that wouldn't be an appropriate solution for something like MPEG due to performance concerns. I'm even willing to admit that what I'm suggesting is no magic bullet either; but have some control. Don't wake up one day and realize that somebody can program a 4-function calculator, or something more malicious, in your config file format that started out as... just a config file. Plan for it.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Can someone explain to why, out of all possible bugs, buffer overflows seem to be the common cold of security holes?
Furthermore, What the Hell is so hard about handling this kind of exception that they keep causing such havoc?
Relatively kowledgeable non-programmers want to know...
Yet I bet that new code will continue to suffer from well-know old vulnerabilities. Perhaps these type vulnerabilities wouldn't occur if anyone who wrote code that is vulnerable to an overflow had their mouse-hand severed from their body. Until truly negligent errors in code carry penalties (for programmer and company), these types of dumb programming errors will continue to create vulnerabilities. Perhaps an analogous code of professional and legal sanctions that governs civil engineering should also govern software. We don't let just anyone build public physical structures, yet we do let anybody build public code structures.
Two wrongs don't make a right, but three lefts do.
Not trying to spread FUD, but couldn't similar exploits can be crafted for mp3 meta-data (ID3) and certain mp3 playing software *cough* iTunes *cough* ?
Mongrel News all the news that fits and froths
It's a big nerd energy black hole! Quick, somebody get the Linux statue so we can make some good use of it!
Hi,
did still someone believe that MS will change ever?
CU
Anonymous Coward
Accept it for inner peace.......
OTOH XP is once again a total cluster-fuck hosed by a simple vulnerability.
Yet another reason to move to Linux once Win98SE support is terminated.
It very easy to get a certificate to sign online applets/pix/...
...)
(There are even of account of people havving managed to buy a certificated with "microsoft" in it's name !!!)
Be sure that, if DRM becomes widespread, the malware creators will be the first to digitally sign everything with such buggy certificate.
(Just like what is already happenning with ActiveX applets...)
And meanwhile, lot's of legitimate content will fail, because of lack of signing. (Opensource software that cannot afford DRM certificate,
No, DRM alone can't bring security, only a false sense of security.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"Microsoft has released Word"
That is the real threat, my friend.
It's more than just length checking. Anywhere where an offset is generated that will be added to a pointer the offset must be tested for being in range of the target data. That becomes onerous very quickly.
Just stop alowing code to be executed willy nilly off the net. But I forget this is a feature....the real easy fix if to just switch to a real operating system and stop letting others run you. Microsoft will not change the fundimental way in which activeX and their .net nightmare run. In the long run it will be their undoing, especially considering the fact that tax departments and essential services everywhere could be at serious risk. Good for keeping a load of sys admins, and poor joeboy tech staff in jobs for now though. Very soon though something really serious is going to happen and there will be severe financial consequences, now is the time to hone the good old unix and linux skills, the demand will be huge.
one of the marsrovers found yet another rock on mars!
:)
are we really gonna waste a newspost on every flaw found in windows???
perhaps put a counter somewhere with the number of flaws found so far, and when you click on it you can see the latest one, would be a lot more convenient
Yeah, like viewing an image from usenet.
Usenet? Is that like a web browser?
No one ever does that.
Not since 1998, really.
ahh... the horror... *goes crazy* *writes a shell script to delete all .doc*
"MY APOCALYPTIC TENOR HAS NOT BEEN DISPELLED!" - T-Rex, qwantz.com
I remember people back in 1998 smugly telling me as they surfed the net over my shoulder:
"You know if you view an image with a virus, it'll infect your computer"
I vividly remember openly scoffing at their remarks and explaining in detail why what they were proposing was completely impossible.
And now they were right all along. Do I have to email out apologies?
May the Maths Be with you!
I wonder if they'll "fix" any of these the same way they "fixed" the xbm overflow in IE -- by removing support for the format completely.
Oh well, because of that smooth move, I managed to convert someone to firefox who otherwise would have never considered it...
And oddly enough, the obvious recursive function to do this is EXACTLY what caused the ASN.1 parsing vulnerabilities in Windows, pretty much demonstrating why ASN.1 is a How Not To Design Your Format format.
You can create a gif in a folder, and upload the file to someone's php forums or game. Then you back delete the gif in that folder. In it's you write some code and change the extension back to gif. Now, when they look at that lil booger bam your code is running. Welcome to the internet. This will effect Linux and Windows alike.
Once this virus gets into pr0n sites, it could be the end of the world as we know it. =O
If they can't code it right then maybe they should be serving french fries.
fast as fast can be. you'll never catch me.
...I've been trying to get porn flash ads off MSNBC and Yahoo for weeks now, at home, when at work the sites are just fine. Spyware, right? Well, Spybot, Norton, and AdAware say... a resounding "No". Nothing there. Yet the front page of MSNBC and my Yahoo mail still have ads for some guitar software, daBoink.com, and some fucked-up screensaver rotating with nauseating frequency.
/. port-scans me every time I freakin' post!
......."
Oh, and before you ask... twice a week virus scans, two noted spyware blockers, and a reliable firewall. How reliable? Shit,
Okay, now go on and say it... all together now... "Serves... YOU...
When the going gets weird, the weird turn pro. ~~ Hunter S. Thompson
Only use plain text email and turn off all image loading in Internet Explorer!
Not only will this stop the spread of viruses, it will drive hundreds of thousands of noobs off the internet. Usenet will be stored to it's former glory and AOL will go out of business. Marketshare of Linux and MacOSX will skyrocket and peace and balance will be restored to the Force!
Believe me, you don't need to get *THAT* hardcore with imaging flaws to take over a Windows machine.
...length does not matter! :(
Add *.wmf and *.emf to your adblock filters (I presume if you browse with Windows you're using Firefox and Adblock, otherwise...) These formats hardly ever appear on the web. If you see one, it's probably an exploit.
Lurking at the bottom of the gravity well, getting old
Having written ASN.1 parsers/emitters, I'd have to say this isn't the best example to illustrate an otherwise valid point about sanity-checks.
...
The ASN.1 format is entirely dependent on accurate data-length values - if the length attribute of an element doesn't match the actual element size, the parser will collapse, since it will attempt to interpret the byte at tag+length-word+data-length as the next 'tag'.
As a consequence of this, ASN.1 reader/writer code tends to be very 'length-aware' by nature. Buffer overflow exploits are the least of your problems if you get the lengths wrong on ASN elements - the larger problem will be that your ASN.1 file will be unreadable by any ASN.1 parser.
I wish I could come up with a better example than ASN.1
Which IS what ALL M$ libraries are... they only open if you provide re$ource$ to Micro$oft... and sadly, not all of us have... ummm... the "re$ource$" to donate to the not so gentle giant...
~D
" What luck for rulers that men do not think" - Adolf Hitler
..."Windows flaws puts image handling at risk."
You might hit unwritable (possibly unmapped or kernel) memory before your uninitialized pointer overflows the stack. This makes the backdoor very unreliable. Also, on a 64-bit machine, you might have to transfer many terabytes of data.
Fixed code:
void echo(void) { char S; char *s= gets(s); puts(s); putchar('\n'); }
Note that the fixed code neatly avoids many stack protection mechanisms by not using a normal array. An improvement would be to use a more interesting struct to hold the data, with enough room to hide the backdoor from testers.
Uh, this was intended to be a backdoor, right? You didn't say what the code was expected to do.
Running out of stack space?
Good thing SquirrelMail removes all inline images from my email!
"1984" was ment to be a warning, not a guidebook. You hear that Kim Jong-il!? BushCo?!
Maybe it's a bit ironic that sometimes exploits like this can be considered "good" - for example, just recently a buffer overflow vulnerability in libtiff opened up the way to running homebrew code on the PSP 2.0 firmware. Of course, Sony patched up the hole in the next update.
:)
Fortunately, PSPs aren't getting remmotely compromised over the internet (yet?...) Windows boxes are a whole different story, though
Use mozilla firefox and install adblock and flash blocks. They will get rid of all flash and ads, which you don't want.
Creativity uninhibited www.kreeti.com
...is in booting up your machine.
GetOuttaMySpace - The Anti-Social Network
I am curious: how about Linux graphics-handling libraries? Has anyone seen any vulnerabilities to this issue in them?
I received an automatic update notification for this very issue just a couple of hours ago. Applied and restarted. Until the next update...
I've always said surfing the web with IE is like going around sticking your dick in people without a rubber... eventually you are going to get something.
(off-topic, forgive me...)
Nothing is safe anymore. Sex became scary and now looking at porn is going to give me a virus or some other sort of infection that isn't easy to clear up.
Sheese
Get your Unix fortune now!
I called it.
[If] current attitudes and results about development continue, within 10 years new coders will be hearing that "It is impossible to write complex software that isn't subject to running arbitrary code."
Sadly, this came true sooner than I thought.
Abolish Copyright. Restore Freedom.
Firefox adblock *.swf La voila, hamba flash...
Oh well, what the hell...
When will Slashdot report on Linux's security problems?
Has always been badly handled!
That's why you use a databuffer class. Leave the pointer arithmetic alone.
Did the kernel buffer overflow in the .BMP/.RLE decoder ever get fixed? I was amazed to find that code in the NT/Win2K kernel.
I count 41 in the last month for instance at http://www.us.debian.org/security/. Feel free to check other distros.
I just don't get it. How does a data format have the ability to execute code? I know that they cause a buffer overflow, but why isn't all the buffer overflows fixed by now? I mean, it's been years now that we all have been told about them. You would think that by now everything has been sanitized...
The above is not worth reading.
you're going through a proxy filter at work... that's removing the crap before it gets to your machine...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
It did occur to people. But the mindset was just not there to fix it. People are generally happy if things are working. To go the extra mile of paranoid security-checks, requires a mindset and to put security high on the agenda.
I remember back in the early 90's I was curious if pictures could actually contain viruses. I always assumed people would code in checks to prevent overflows, so I didn't think more about it. Assumptions is ignorance, that was my fault.
http://www.debunkingskeptics.com/
you're going through a proxy filter at work... that's removing the crap before it gets to your machine...
Actually, no. The ads just change. At work, we're back to the peacock with the 50 state names rippling all over its annoying ass. Actually, I think I prefer the blonde with the big wazooms. I'm not buying from either company, so why not have an attractive ad for a change?
When the going gets weird, the weird turn pro. ~~ Hunter S. Thompson
This was patched for, yesterday 11/08/2005, here:
n /ms05-nov.mspx
/ 140203&tid=220&tid=106
http://www.microsoft.com/technet/security/bulleti
Get with it, slashdot article submitters, & RTFA!!!
APK
P.S.=> Enough "anti-microsoft" F.U.D. already, @ least print the 'flaw' was patched for, & read the damn article... One for the Linux crew, here:
http://linux.slashdot.org/article.pl?sid=05/11/08
"Linux Lupper.Worm In the Wild"
And yes, the flaw for this worm having an opening is unique to Linux & its variants (in an app that runs on it)... apk
Indeed, it's easier to write code without testing all the invalid cases.
But it is mostly the fault of the programming language used that discourages programmers for testing the invalid states of the program.
Take C, for example: there is no way to specify a logical type consisting of certain float values, for example. There is no way to specify a subtype of short that takes values 0, 1 and 2. There is no way to specify that a bitmap file is a header, followed by a 2d array of bytes with dimensions specified in the header. There is no way to make the GDI command Ids used in the WMF files a type!
C++ and Java continue this trend by sacrifising type correctness for language simplification. At least C++ gives you the means to manually code strong value types...
"With 3.0+GHz machines, what does it matter anymore?"
Coders like you are the reason we now NEED 3ghz machines to do anything
useful with bloatware like windows. You accuse other programmers of
being lazy then say that making a program efficient is unimportant.
Hello??! Pot , this is kettle calling!
"for why they've violated strict logic flow is always,"
Most bugs are nothing to do with violated logic flow and everything
to do with simple human error. Until The Perfect Human is invented
then bugs (if still written by humans) will always be with us.
Just not old PCs (unless they're running Linux, BSD etc). Still, you
pays your money , you takes your choice. Want Windows? Then put up
with the bugs,
Given the fact that there have been major parsing errors in common ASN.1 libraries I'd say that it's a very good example.
Ah, you're commiting the classic error of "it handles valid input properly, so it must be ok".
just handling windows is a flaw!!!
Spyware that tracks & reports surfing habits. The marketing data is worth millions. Not that they're interested in where you, specifically, are going, but rather what sites are popular.
Slashdot entertains. Windows pays the mortgage.
Apache hosts vastly outnumber everything else combined. Postfix/Sendmail/Qmail/Exim probably have 90% of the email server market. There are many more installations of MySQL than MSSQL. And yet, how many worms have you seen roaring through the Internet unstopped that affect those applications? By any count, relatively very few.
And yet the bad guys, who even have the full source code to each of those, haven't had as much luck attacking Unix-based systems as Windows, even though Unix basically owns the Internet server market. So much for the "market share == vulnerability idea", even though the prize for owning a Unix server on a fat pipe is much greater than owning a Win95 box on a dialup.
This hypothesis gets trotted out every time the subject comes up, but it really needs to die. The overwhelming amount of evidence supports the theory that solid design is the path to good security - obscurity doesn't seem to have much to do with it.
Dewey, what part of this looks like authorities should be involved?
http://sylvana.net/test/AP4.jpg , which would crash IE.
It really irks me that supposedly professional companies sell software that doesn't follow basic lessons like that, especially for the standard libraries they provide so everybody's programs can avoid writing special file format parsers from scratch.
Some of this is because too many people still write in C when they're not good enough to do it competently, and the companies they work for aren't making sure their code is properly reviewed, and they're letting them use a language that lets you shoot yourself in the foot. Don't get me wrong - C is still my favorite programming language, small, clean, elegant, and obvious, but most people shouldn't be allowed to use it.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
In practice, you need to do more than that - even if it's just printing a more informative error message or (more typically) rejecting the bad input file and asking the user for another one.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
If debian has 1 vulnerability per day
considering the fact that debian has 17,000+ packages
that would average 1 vulnerability per package every 46.5 years.
Most users only use a small subset of these packages.
Yes, debian has relatively low occurance of vulnerabilities
considering the volume of software involved.