Slashdot Mirror
Image Handling Flaw Puts Windows At Risk
An anonymous reader writes "Microsoft has released word that several image handling flaws may open Windows PCs to Spyware or viruses. From the article: 'We will continue to see this type of vulnerabilities in every major application for the foreseeable future ... It is not just images, but any type of complex file format. This is something that security researchers and hackers have realized to be a weak point in many applications.'"
Windows wasn't open to spyware and viruses before?
This vulnerability is a dupe!
Windows has already had an image handling flaw!
Oh, it's Windows. False alarm.
Okay, so it is critical. The advisory contains the patch to correct the problem. This only becomes an issue if Windows users don't patch their machines.
What is the likelihood that users won't patch their machines? (cough!)
From TFA:
Mehta doesn't expect the latest Windows flaws to be exploited in a widespread attack. "We're not bracing for any major worm or malware outbreak, but we do expect them to be used in targeted attacks," Mehta said. "There is user interaction required, there has to be someone sitting at the other end in order to be compromised."
Yeah, like viewing an image from usenet. No one ever does that.
"Rocky Rococo, at your cervix!"
This is why we need more managed code.
Or your computer could get an STD (Screenally Transmitted Disease) from viewing pornographic images.
I Am My Own Worst Enemy
So now not only will looking at the goatse picture make you vommit, it will take over your Windoze PC!
Will the horrors ever stop?!!
DEAD DEAD DEAD DELETE ME
It's not really a fundamental flaw?
Both jpg and png was flawed in Windows, MSN Messenger, and even other image apps by a buffer overflow exploit where a specially crafted jpeg file with a virus "attachment" would crash the program and execute virus code. I have to agree that if they are still finding flaws, we'll be stuck with them for a while. Just imagine, every Windows 98 computer out there probably has this problem too, and there's no way it's going to be really fixed. It will never be safe to run even "safe" things like jpg and mp3 on old computers now. It's very, very disapointing news.
In a Messenger program that is always accepting new input in the form of pictures and messages, it's especially dangerous because anyone who's online will instantly become a zombie spewing out infection to their friends on their contact list. You really will get viruses through your personal contacts more than spamming-strangers in the future.
Saskboy's blog is good. 9 out of 10 dentists agree.
There's no such thing as vulnerabilities, all there's is Inteligent Bug. The exploits are there just to test your faith...
-- Por mais que eu ande no vale das trevas e da morte, meu PowerMac G4 Não Travará!!!
Of course, I think the developers who left these vulnerabilities open should be financially responsible for the damage this may cause.
"Derp de derp."
When writing a parser (for a graphical or non-graphical data file) it is advisable to sanity check the input data at every step.
Consider ASN.1 data (used, for instance, for digital certificates, certificate revocation lists, certificate requests and so on).
Each and every ASN.1 data element and each and every sub-element contains a length field. The ASN.1 parser should check whether the length field of a sub-element goes beyond the length of the enclosing data element, and so on ad infinitum.
If the parser detects a violation, parsing stops.
Dedicated Linux servers (root access) $45 p.M.
I love how Microsoft puts this... "We will continue to see this type of vulnerabilities in every major application for the foreseeable future..."
... for them. "... until we learn that integrating IE directly into the OS was the biggest fuckup we ever made."
Lemme finish off that
Seriously, why integrate something so seriously flawed into the OS? The only thing it'll do is make the system less stable and less secure.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
It's a tangental thought, but the debate around online security, including this one, seems to be paving a wide path for DRM, or more centrally-managed content distribution methods in commercial applications.
'We will continue to see this type of vulnerabilities in every major application for the foreseeable future ... It is not just images, but any type of complex file format. This is something that security researchers and hackers have realized to be a weak point in many applications.'
In a later interview:"Only one known product suite on the market can protect you from these ongoing threats. MS-AntiVirus and MS-AntiSpyware. Only these two programs are equipt with the proper image handling algorithims to detect these known flaws inherent in all programs."
This seems like a big scheme to get people on their proprietary AV and AntiSpyware programs. Lets see... Find hole, fix hole, release press release about hole, plug product, patch hole for product users.
eesh.we will see.
Microsoft's .NET platform, which is supposed to be managed code, has built-in support for rendering WMF and EMF images (the image formats that are affected by this security vulnerability). So are applications written in .NET still vulnerable to the buffer overflow exploit, or was the underlying rendering code rewritten for the managed environment?
Writing managed applications won't protect you (completely) if the underlying framework isn't also managed.
The WMF and EMF formats are just basically little programs full of GDI instructions. When you create one, you execute a bunch of GDI calls, with the WMF file as your Device Context. So essentially it's a shortcut-- an "easy" way to create a file format, based on the structure of the operating system's drawing code. I don't know about how the potential exploit works, but at first glance it seems like this is a typical case of designing a file format for "code convenience". Loading the file basically consists of loading a series of instructions and executing them. Now THAT sounds like a good idea! Easy to code for, but also easy to take advantage of. In other words, it's a lazy approach to coding. Lesson to be learned: File formats can be complicated! They must be designed to be a good *format*, not just to make coding easier. The more Microsoft designs its own file formats for each new technology it comes up with, the more we'll see this kind of thing. Better to find out what file formats are already out there, finding one that suits your needs, and supporting THAT, instead of coming up with one on your own. This is a case of re-inventing the wheel, badly.
While I hold no place in my heart for microsoft. Quicktime appears to be having a very similar problem. But also remember that the libjpeg and libz also had similar problems exploitable on Linux patched in the last year. Expecting an OS, ANY OS to save you is a bigger security threat than some exploitable jpeg code.
"We will continue to see this type of vulnerabilities in every major application for the foreseeable future ... It is not just images, but any type of complex file format. This is something that security researchers and hackers have realized to be a weak point in many applications."
If a programmer is taking the time and effort to interpret a complex file format, why can't he also take the time to validate it.
"Eve of Destruction", it's not just for old hippies anymore...
Internet Security Systems != Microsoft.
This has nothing really to do with IE. IE here just happens to be a vector. If FF on windows was depending on those libraries to display those image formats they would be vulnerable as well.
OS X just seems to be bulletproof : no major hacks yet.
imho there are two issues.
1: when coding with pointers/unchecked length arrays all it takes is one screwup even if you are trying to be carefull. Higher level structures and/or managed code can prevent this but at a cost in performance bloat and in the case of managed code ease of integration with traditional code.
2: the wmf/emf code is probablly very old from long long before the internet was commonplace. The idea of people deliberately creating image files to bypass security probablly didn't even occour to anyone.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Ironic.
The usual MS obfuscation for "because we don't support 9x anymore, by definition there are no critical updates for 9x" is to state that 9x is "Not Critically Affected", with a URL to a page that defines "critically affected" in such a way as to exclude 9x.
"Not Affected", as claimed in MS05-053, is a stronger claim. That's not to say there aren't similar bugs in image-handling in 9x; only that the hole in this notice probably doesn't affect 9x.
Sounds like we need to go back to when your OS was mostly in ROM ( like the Ataris for example ).
At least then if you get exploited, the next time you reboot the exploit goes away.
---- Booth was a patriot ----
That's because it's not accepted as a valid theory in most circles. I think most /.ers believe in Evolution anyway.
Every file format becomes a programming language in the long run.
OK, maybe not *every* file format, but most of them. Think about that, and design accordingly from the start. Parse into a VM from the start and write a verifier from the start.
And no, there isn't a magic bullet. Even the XML advocate who posted before me admitted that wouldn't be an appropriate solution for something like MPEG due to performance concerns. I'm even willing to admit that what I'm suggesting is no magic bullet either; but have some control. Don't wake up one day and realize that somebody can program a 4-function calculator, or something more malicious, in your config file format that started out as... just a config file. Plan for it.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Yet I bet that new code will continue to suffer from well-know old vulnerabilities. Perhaps these type vulnerabilities wouldn't occur if anyone who wrote code that is vulnerable to an overflow had their mouse-hand severed from their body. Until truly negligent errors in code carry penalties (for programmer and company), these types of dumb programming errors will continue to create vulnerabilities. Perhaps an analogous code of professional and legal sanctions that governs civil engineering should also govern software. We don't let just anyone build public physical structures, yet we do let anybody build public code structures.
Two wrongs don't make a right, but three lefts do.
Not trying to spread FUD, but couldn't similar exploits can be crafted for mp3 meta-data (ID3) and certain mp3 playing software *cough* iTunes *cough* ?
Mongrel News all the news that fits and froths
Accept it for inner peace.......
It very easy to get a certificate to sign online applets/pix/...
...)
(There are even of account of people havving managed to buy a certificated with "microsoft" in it's name !!!)
Be sure that, if DRM becomes widespread, the malware creators will be the first to digitally sign everything with such buggy certificate.
(Just like what is already happenning with ActiveX applets...)
And meanwhile, lot's of legitimate content will fail, because of lack of signing. (Opensource software that cannot afford DRM certificate,
No, DRM alone can't bring security, only a false sense of security.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"Microsoft has released Word"
That is the real threat, my friend.
It's more than just length checking. Anywhere where an offset is generated that will be added to a pointer the offset must be tested for being in range of the target data. That becomes onerous very quickly.
Yeah, like viewing an image from usenet.
Usenet? Is that like a web browser?
No one ever does that.
Not since 1998, really.
ahh... the horror... *goes crazy* *writes a shell script to delete all .doc*
"MY APOCALYPTIC TENOR HAS NOT BEEN DISPELLED!" - T-Rex, qwantz.com
I remember people back in 1998 smugly telling me as they surfed the net over my shoulder:
"You know if you view an image with a virus, it'll infect your computer"
I vividly remember openly scoffing at their remarks and explaining in detail why what they were proposing was completely impossible.
And now they were right all along. Do I have to email out apologies?
May the Maths Be with you!
I wonder if they'll "fix" any of these the same way they "fixed" the xbm overflow in IE -- by removing support for the format completely.
Oh well, because of that smooth move, I managed to convert someone to firefox who otherwise would have never considered it...
If they can't code it right then maybe they should be serving french fries.
fast as fast can be. you'll never catch me.
the main reason is that there is a huge ammount of code written in C there are a variety of (good) reaons for writing code in C but one of its downsides is it makes handling variable length data structures a buisness that can only be done safely by taking great care.
Since not all programmers care about security (they may have assumed thier lib would only be used with trusted data) and even those that do are imperfect this leads to lots of buffer overflows in C code.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
...I've been trying to get porn flash ads off MSNBC and Yahoo for weeks now, at home, when at work the sites are just fine. Spyware, right? Well, Spybot, Norton, and AdAware say... a resounding "No". Nothing there. Yet the front page of MSNBC and my Yahoo mail still have ads for some guitar software, daBoink.com, and some fucked-up screensaver rotating with nauseating frequency.
/. port-scans me every time I freakin' post!
......."
Oh, and before you ask... twice a week virus scans, two noted spyware blockers, and a reliable firewall. How reliable? Shit,
Okay, now go on and say it... all together now... "Serves... YOU...
When the going gets weird, the weird turn pro. ~~ Hunter S. Thompson
Only use plain text email and turn off all image loading in Internet Explorer!
Not only will this stop the spread of viruses, it will drive hundreds of thousands of noobs off the internet. Usenet will be stored to it's former glory and AOL will go out of business. Marketshare of Linux and MacOSX will skyrocket and peace and balance will be restored to the Force!
Believe me, you don't need to get *THAT* hardcore with imaging flaws to take over a Windows machine.
Add *.wmf and *.emf to your adblock filters (I presume if you browse with Windows you're using Firefox and Adblock, otherwise...) These formats hardly ever appear on the web. If you see one, it's probably an exploit.
Lurking at the bottom of the gravity well, getting old
I can never figure out what sort of blind machismo animates C programmers that they *know* pointers are inevitably insecure and feel this makes them Manly Men for overcoming the difficulty ("well, most of the time"). The best C coders in the world get bitten in the hindquarters by pointer math, on a regular basis (see the flaw in the libpng, which was old, stable, open-source, well-tested, written by experts, everything you could want for secure software). You wouldn't go to a doctor who said "Screw the diagnostic protocol that relies on wasting fifteen minutes performing checks to verify that you indeed have tuberculosis instead of silicosis of the lungs, I am a MANLY MAN and n00b doctors who don't immediately notice your lack of dialated pupils don't deserve to be in this profession!"
Thumbs up for "silly languages" that protect ME from the dumbness of the Manly Men who are writing my applications.
Help poke pirates in the eyepatch, arr.
Which IS what ALL M$ libraries are... they only open if you provide re$ource$ to Micro$oft... and sadly, not all of us have... ummm... the "re$ource$" to donate to the not so gentle giant...
~D
" What luck for rulers that men do not think" - Adolf Hitler
You might hit unwritable (possibly unmapped or kernel) memory before your uninitialized pointer overflows the stack. This makes the backdoor very unreliable. Also, on a 64-bit machine, you might have to transfer many terabytes of data.
Fixed code:
void echo(void) { char S; char *s= gets(s); puts(s); putchar('\n'); }
Note that the fixed code neatly avoids many stack protection mechanisms by not using a normal array. An improvement would be to use a more interesting struct to hold the data, with enough room to hide the backdoor from testers.
Uh, this was intended to be a backdoor, right? You didn't say what the code was expected to do.
Running out of stack space?
Good thing SquirrelMail removes all inline images from my email!
"1984" was ment to be a warning, not a guidebook. You hear that Kim Jong-il!? BushCo?!
Maybe it's a bit ironic that sometimes exploits like this can be considered "good" - for example, just recently a buffer overflow vulnerability in libtiff opened up the way to running homebrew code on the PSP 2.0 firmware. Of course, Sony patched up the hole in the next update.
:)
Fortunately, PSPs aren't getting remmotely compromised over the internet (yet?...) Windows boxes are a whole different story, though
Use mozilla firefox and install adblock and flash blocks. They will get rid of all flash and ads, which you don't want.
Creativity uninhibited www.kreeti.com
...is in booting up your machine.
GetOuttaMySpace - The Anti-Social Network
I received an automatic update notification for this very issue just a couple of hours ago. Applied and restarted. Until the next update...
XML == Big fat files.
Binary == Little compact files.
Plus add the parser, schema, etc. and you got yourself a big chunk of bloat. A simple RIFF style binary file with GOOD coding practices will be much smaller and more efficient.
Good example: At a past employer, we wrote software that would generate output data files. They used to be binary, and were roughly 25 to 30 KB in size. Then the whole XML hype set in and our customers just had to have it all in XML. Now output files are between 1 and 2 MB, plus roughly 8 MB of support files (Xalan/Xerces), and they're slower to load. We could have rolled our own, but try justifying the extra cost to the customer.
Don't get me wrong, XML has its uses. But fast, efficient data storage isn't one of them.
BTW, there is nothing wrong with using pointers. You just need to know what you're doing. Programmers who write shoddy code with pointers says more about the programmer than the concept.
~X~
~X~
I've always said surfing the web with IE is like going around sticking your dick in people without a rubber... eventually you are going to get something.
(off-topic, forgive me...)
Nothing is safe anymore. Sex became scary and now looking at porn is going to give me a virus or some other sort of infection that isn't easy to clear up.
Sheese
Get your Unix fortune now!
Well, okay, what's the alternative? Either an interpreted language which does all the checking real time, which is painfully slow, or a language with a compiler that compiles the safty pads into the final product, which is also slow. The reason pointers are used so often is because they are very useful (sometimes references can be used instead, but not all the time) C++ is the most bare-bones high level language. Compilers are good enough to beat any human writing assembly code now (just read disasembled code, scary) yet the language is OO (but not over the top OO like some languages *cough*java*cough*) and for the most part very human readable (once you get used to it of course) with a clear and extremly flexible syntax (see: the obfustication contest article on the front page ATM)
Pointers are part of the reason. Pointers are insecure themselves, but their implementation can be. Most (like, 99.9999%) of the time its not a security risk, but sometimes, in complicated code, there's an insecure bit, and it can go unnoticed for forever, until some bitch finds it and your forced to fix it.
Your doctor-hospital analogy is kind of exaggerated. I don't care if a diagnosis, which my life depends on, takes 15 minutes more to ensure security. However, given the choice of playing BrandNewFPS XVII in C++ and getting a good frame rate, or playing a port of it to some kiddie language that holds your hands and makes every array resizable (aka a linked list), every pointer type thing unoverflowable etc etc etc etc (I'm looking at you, VB and Java) and getting like a tenth of a frame a second (i dont want any Java Isn't Really That Slow, You're Just Imagining It posts, at least I'm slighty on topic) I'd choose the potential risk (see: small potential, pointers are used like crazy and the usage:exploit ratio is very insignificantly tiny) in exchange for the better frame rate.
Back on topic slightly. What about, in this example, libpng and rendering images? You want your images to load and display very fast, but like EVERYTHING uses libpng and libjpeg etc (at least from the nix perspective) and that is a big bitch if theres an exploit in the code. However, these projects are very open to the public, and exploits won't last long. The last one was a fluke, I bet it was in a very confusing complicated all over the place bit of code and that's why it went unnoticed for so long.
I called it.
[If] current attitudes and results about development continue, within 10 years new coders will be hearing that "It is impossible to write complex software that isn't subject to running arbitrary code."
Sadly, this came true sooner than I thought.
Abolish Copyright. Restore Freedom.
The main cause is the C string operators, which traditionally use Null terminated strings. So the potential length of a string is unlimited. In Linux, functions like gets() are (have been) phased out in favour of getsn(), which has an explicit length:
int getsn(char *cp, int size);
This has been a huge effort executed using automated search methods and hand coding, to vet enormous amounts of Free code. Consequently the quality of GNU systems have improved dramatically, while the same cannot be said for MS code.
The problem is that if you overflow a buffer defined on the processor stack, then you can force a new return address into the Program Counter when a routine exits, thus giving the attacker control over the next piece of code to execute. This pice of code is typically part of the string that was used to overflow the buffer.
Oh well, what the hell...
Firefox adblock *.swf La voila, hamba flash...
Oh well, what the hell...
Has always been badly handled!
Did the kernel buffer overflow in the .BMP/.RLE decoder ever get fixed? I was amazed to find that code in the NT/Win2K kernel.
I count 41 in the last month for instance at http://www.us.debian.org/security/. Feel free to check other distros.
I just don't get it. How does a data format have the ability to execute code? I know that they cause a buffer overflow, but why isn't all the buffer overflows fixed by now? I mean, it's been years now that we all have been told about them. You would think that by now everything has been sanitized...
The above is not worth reading.
you're going through a proxy filter at work... that's removing the crap before it gets to your machine...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
It did occur to people. But the mindset was just not there to fix it. People are generally happy if things are working. To go the extra mile of paranoid security-checks, requires a mindset and to put security high on the agenda.
I remember back in the early 90's I was curious if pictures could actually contain viruses. I always assumed people would code in checks to prevent overflows, so I didn't think more about it. Assumptions is ignorance, that was my fault.
http://www.debunkingskeptics.com/
Actually, the same can since some time be said for MS code since they simply deprecated every string handling function of the CRT and introduced the new and improved "Secure CRT" which includes a length parameter on every function, and with more predictable behaviour than the old CRT. Since this is in the latest compiler I assume that any software from MS from now on should be sanitized this way. Of course there are other exploits like integer overflows but they are considerably harder to find and exploit.
you're going through a proxy filter at work... that's removing the crap before it gets to your machine...
Actually, no. The ads just change. At work, we're back to the peacock with the 50 state names rippling all over its annoying ass. Actually, I think I prefer the blonde with the big wazooms. I'm not buying from either company, so why not have an attractive ad for a change?
When the going gets weird, the weird turn pro. ~~ Hunter S. Thompson
Indeed, it's easier to write code without testing all the invalid cases.
But it is mostly the fault of the programming language used that discourages programmers for testing the invalid states of the program.
Take C, for example: there is no way to specify a logical type consisting of certain float values, for example. There is no way to specify a subtype of short that takes values 0, 1 and 2. There is no way to specify that a bitmap file is a header, followed by a 2d array of bytes with dimensions specified in the header. There is no way to make the GDI command Ids used in the WMF files a type!
C++ and Java continue this trend by sacrifising type correctness for language simplification. At least C++ gives you the means to manually code strong value types...
"With 3.0+GHz machines, what does it matter anymore?"
Coders like you are the reason we now NEED 3ghz machines to do anything
useful with bloatware like windows. You accuse other programmers of
being lazy then say that making a program efficient is unimportant.
Hello??! Pot , this is kettle calling!
"for why they've violated strict logic flow is always,"
Most bugs are nothing to do with violated logic flow and everything
to do with simple human error. Until The Perfect Human is invented
then bugs (if still written by humans) will always be with us.
Just not old PCs (unless they're running Linux, BSD etc). Still, you
pays your money , you takes your choice. Want Windows? Then put up
with the bugs,
Either an interpreted language which does all the checking real time, which is painfully slow
You don't know what Java does, do you? Modern JVMs use JIT compiling. Think of it like compiling the parts that keep happening. Java is a match for C++ generated code now, and in certain circumstances - such as database business logic - Java usually wins the optimization race, because it can use profiling to figure out how to optimize (unlike something that optimizes at compile-time).
It does it all inside a sandbox, too. Don't get me wrong: I'm a big fan of C++. It does startup faster, and C++ code is necessarily smaller than java code. But this "its slower" FUD needs to go away.
Mod me down and I will become more powerful than you can possibly imagine!
Given the fact that there have been major parsing errors in common ASN.1 libraries I'd say that it's a very good example.
Ah, you're commiting the classic error of "it handles valid input properly, so it must be ok".
just handling windows is a flaw!!!
Spyware that tracks & reports surfing habits. The marketing data is worth millions. Not that they're interested in where you, specifically, are going, but rather what sites are popular.
Slashdot entertains. Windows pays the mortgage.
Why is it every time I read something like this I am convinced that the writer is little more than a child themselves?
Give it a while, and you will learn that while it is very useful to understand pointers, it isn't big or clever to use them.
Justin.
You're only jealous cos the little penguins are talking to me.
Apache hosts vastly outnumber everything else combined. Postfix/Sendmail/Qmail/Exim probably have 90% of the email server market. There are many more installations of MySQL than MSSQL. And yet, how many worms have you seen roaring through the Internet unstopped that affect those applications? By any count, relatively very few.
And yet the bad guys, who even have the full source code to each of those, haven't had as much luck attacking Unix-based systems as Windows, even though Unix basically owns the Internet server market. So much for the "market share == vulnerability idea", even though the prize for owning a Unix server on a fat pipe is much greater than owning a Win95 box on a dialup.
This hypothesis gets trotted out every time the subject comes up, but it really needs to die. The overwhelming amount of evidence supports the theory that solid design is the path to good security - obscurity doesn't seem to have much to do with it.
Dewey, what part of this looks like authorities should be involved?
It really irks me that supposedly professional companies sell software that doesn't follow basic lessons like that, especially for the standard libraries they provide so everybody's programs can avoid writing special file format parsers from scratch.
Some of this is because too many people still write in C when they're not good enough to do it competently, and the companies they work for aren't making sure their code is properly reviewed, and they're letting them use a language that lets you shoot yourself in the foot. Don't get me wrong - C is still my favorite programming language, small, clean, elegant, and obvious, but most people shouldn't be allowed to use it.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
In practice, you need to do more than that - even if it's just printing a more informative error message or (more typically) rejecting the bad input file and asking the user for another one.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
If debian has 1 vulnerability per day
considering the fact that debian has 17,000+ packages
that would average 1 vulnerability per package every 46.5 years.
Most users only use a small subset of these packages.
Yes, debian has relatively low occurance of vulnerabilities
considering the volume of software involved.