Unpatched IE Flaw Extremely Critical

Durinthal writes "The biggest blip on the security radar over the Thanksgiving holiday was the realization by the security community that an Internet Explorer problem first identified six months ago was a lot worse than it appeared, as what appeared to be only a DoS vulnerability also allows for execution of arbitrary code. The realization caused Secunia to issue a rare 'Extremely Critical' advisory."

Comments

Extremely Dupical

[A beautiful mind]

The biggest blip on the slashdot radar over the Thanksgiving holiday was the realization by the editorial community that a slow news problem first identified six months ago was a lot worse than it appeared, as what appeared to be only a short blip of news vulnerability now also allows for execution of arbitrary stories as portraid by Beatles Beatles. The realization caused CmdrTaco to issue a rare 'Extremely Dupical' advisory.

Re:Extremely Dupical

[Anonymous Coward]

OK, now I know Slashdot's biased, but posting this twice and not posting this at all?

All your OS are belong to Sun!

Scummy eweek popup alert

[david.given]

...pops up a dialogue asking whether you want to be spammed and then spams you anyway when you hit CANCEL.

Does anyone think that a very handy Firefox add-on would be a button attached to this kind of dialogue that would instantly kill all Javascript scripts stone dead for the page? Once an OK/Cancel dialogue is up, you can't interact with Firefox's UI until you've responded to the dialogue and let the Javascript do something, which I think is poor design.

Re:Scummy eweek popup alert

[BattleRat]

The extention you are looking for is called NoScript. It works awesome.

Re:Scummy eweek popup alert

[HoosierPeschke]

Try this NoScript. It's a whitelist so you can allow only certain sites to use javascript.

Re:Scummy eweek popup alert

[NickFitz]

IIRC, the JavaScript confirm() function returns three values -- true, false, or null, depending on whether you hit ok, cancel, or x.

Unfortunately not. I can see that it would be useful to have, but a quick test shows that both Cancel and the Close button return false (on Windows 2000, IE 6 and Firefox 1.0.7). IIRC this is in line with the expected behaviour for such dialogs, although that may vary per operating system.

Try it: type

javascript:alert(confirm("blah"))

in your browser location bar.

For the paranoid/justifiably cautious: the "javascript:" causes the browser to pass the rest of the line to the JS interpreter, "alert(expr1)" pops up an alert (surprise!) containing the string value of expr1, and "confirm(expr2)" does the OK/Cancel box containing the string value of expr2. So first you get the OK/Cancel box, which returns a boolean value, which is then converted to a string, which is displayed in the alert box.

is IE the sound that ....

[Anonymous Coward]

is "IE" the shortented version of the screaming sound that I make when I realize my machine has been compromized?
"iiiieeeeEEEEEEEEE!"

Re:is IE the sound that ....

[BushCheney08]

Is that like the Windows user's equivalent of KHAAAAAAANNNNNN?

Re:is IE the sound that ....

[jonadab]

> the screaming sound that I make when I realize my machine has been compromized? "iiiieeeeEEEEEEEEE!"

No, real Geeks scream, "Kaaaaaaahn!"

Re:is IE the sound that ....

[Foofoobar]

I thought they just threw chairs? No wait... that's management.

Wow

[gcnaddict]

Its so rare that most other things never see the light (or lack thereof) of this rating... I dont think firefox ever got an Extremely Critical rating for any of its bugs :P

Firefox v1.5

[Space_Soldier]

This makes Slashdot exactly on the day Firefox v1.5 is supposed to be released. Apparently, Mozilla want to create a huge marketing campaign, better and larger than the one for v1.0. This is a perfect time to capitalize on this horrible security hole to promote Firefox.

Re:Firefox v1.5

[m0i]

This makes Slashdot exactly on the day Firefox v1.5 is supposed to be released. Apparently, Mozilla want to create a huge marketing campaign, better and larger than the one for v1.0. This is a perfect time to capitalize on this horrible security hole to promote Firefox.

Hrm, did you notice that Firefox 1.5 is crashing as well on this exploit? It's not a security risk but a big annoyance nonetheless.

Proof of Concept

[Motherfucking Shit]

Here is a link to the Proof of Concept page, which will launch an instance of calc.exe if you're vulnerable. AVG Free caught the exploit in the cached page, but calc.exe ran anyway, even after I deleted the file.

Re:Proof of Concept

[Anonymous Coward]

I'm really sick of my mac, nothing works right on here. Why wont it bring up my calculator!

Re:Proof of Concept

[Sawbones]

Oddly enough it didn't work for me. IE 6 on a windows machine, it spawned a small dialog window and then a javascript "prompt" box with what I would assume was unicode characters. But after that it just sat there. not crashing nor using a tremendous amount of resources. I would assume that the exploit doesn't require a user to click buttons since the advisory mentioned "just visiting a webpage". So what "should have" happened?

Re:Proof of Concept

[Pxtl]

Hm. I get a "Script Prompt" window over a tiny IE window, with the name of your site in a textbox. A few seconds later (or when I touch it) it snaps and then I get the windows "close-details" app crash window.

So it disturbs the browser, but it doesn't hack it for me.

Re:Proof of Concept

[Spy der Mann]

I suppose that's because a buffer overflow makes IE6 execute code directly. The scanner (in my case, VShield) noticed there's an exploit in the webpage, but there's nothing else it could do. It's like some security guards saying "hey, a thief opened this door!" and they close the door, but don't catch the thief.

Yes, this is a very dangerous problem.

Re:Proof of Concept

[TheSpoom]

Slightly offtopic, but if you're wondering, NAV calls anything it considers suspicious enough to stop but doesn't have a name for yet "Bloodhound" because that's the component that detects buffer overflows and the like. Just something rather interesting I found when I was doing tech support.

Re:Proof of Concept

[TheSpoom]

Proof of concept crashed (or at least, froze to the point of me having to kill the process) my Firefox, but did not open calc.exe. So technically, it could be used as a DoS attack on other browsers as well, though not nearly as badly as on IE.

Re:Proof of Concept

[PlusFiveTroll]

Firefox didnt crash, if you waited long enough (like I did) it opens up a popup dialog full of ??????'s, you can then close the window. But it did take a full 3 minutes on a Athlon64 300+ with a gig of ram. calc.exe does not run.

Re:Proof of Concept

[Hrungnir]

Odd, My Symantec Antivirus didn't catch it. launced calc and IE closed.

Opera just opens another little window with nothing in it, doesn't open calc or show any odd behavior

Re:Proof of Concept

[jpop32]

So technically, it could be used as a DoS attack on other browsers as well, though not nearly as badly as on IE.

Well, Opera just opened a small window which just sat there and did nothing. I closed it, and continued on my merry way. Score one for Opera. :-)

Temp Fix

[Manip]

Turn on "Data Execution Protection" for all programs and services. Instead of allowing full execution it will limit it to a DOS (crack IE).

Control Panel -> System -> Advanced [Tab] -> Performance Settings -> Data Execution Protection [Tab] -> Turn on DEP for all programs and services except those I select -> Ok -> OK.

Re:Temp Fix

[_Shorty-dammit]

I believe DEP is on by default for IE anyways, so I'm not sure this is even necessary. I just tried the proof-of-concept test on my machine, and all it did was bring up some script prompt, didn't launch calc.exe as it should have. This is with the IE7 beta, btw.

Re:Temp Fix

[Ron Bennett]

Turned DEP on, shutdown/restarted, and still no good - the exploit (calculator comes up) still works :(

Perhaps hardware based DEP would make a difference, but again, for folks relying on software-based DEP, it's not effective - the exploit still works anyways.

Ron

It affects Firefox, too.

[Mitchell Mebane]

Although it's not as severe.

https://bugzilla.mozilla.org/show_bug.cgi?id=31733 4

ISC got counter of vulnerable systems

[UnderAttack]

The SANS Internet Storm Center has a counter on their home page showing how many visitors to their site are vulnerable to this particular problem. At this time, looks like it is 43%! (and I assume that people checking the site are more security concious then the average). Also see MSIE 0day exploit.

McAfee Fails It

[Orrin Bloquy]

On my W2K box, McAfee warns me of a threat, then as soon as I close the window, the code executes anyway.

Am I the only one?

[LaughingCoder]

I read the article, and there was a link to a page that demonstrates the exploit. Now, am I the only one who is afraid to click such a link? There is something about seeing a link that basically says "click here to see how we can take over your machine" that sends chills down my spine. I don't know about you, but I never click those demonstration links on *MY* machine.

Re:Am I the only one?

[m50d]

Anyone else could be doing it. The fact that they're nice enough to give you a link rather than just doing it suggests they're not out to get you.

Worthless eWeek

[TubeSteak]

They just copied half the story from this site:

http://www.security.ithub.com

The Proof of Concept didn't load calc.exe for me. Instead, it crashed my IE windows on WindowsXP SP1.

I run Ad Muncher, so that might have caught and foiled the malicious javascript.

McAfee Catches it

[borawjm]

My virus scanner seemed to stop it on the proof of concept page. McAfee sees it as JS/Exploit-BO.gen

Please stop accepting stories from Spammers

[Billly Gates]

His name points to an url and he is trying to use slashdot to boast his google pagemark. Move the cursor over the name? His site pops right up.

  Just yesterday a famous spammer did the same thing and posted here. The slashdot editors should stop accepting such stories that are fabricated in order to boast his advertising revenue.

Re:You mean to say I can be up to date

[Enigma_Man]

Sarcasm aside, yes they should be responsible for what they wrote, even though it's a lot of code, and there are going to be bugs (human nature). It is shoddy software.

-Jesse

Re:Slashdot is loosing its edge.

[SComps]

Not to start a flamefest here, but why is it that most of the time any IE article is mentioned, the firefox folks have to come out in force to claim it's some kind of conspiracy by microsoft?

come on guys... could it possibly be that the "browser wars" are fought by the users far more than the developers?

Extremely Critical Firefox Vulnerability

[MarkByers]

From 2005-09-20: Firefox Command Line URL Shell Command Injection

An (extremely) critical IE vulnerability?

[GroeFaZ]

I call dupe :)

AVG detects it

[bogie]

When I loaded up IE to test it, AVG detects the virus in IE's temp files. Then IE hangs a while and then finally calc loads. But if you kill IE while your waiting it doesn't get a chance to execute. Not a solution but at least it buys you some time to possibily stop it.

Either way MS needs to get off their ass and fix the problem. Oh and as if everyone didn't already know, you should be using anything but IE for web surfing.

Snow Crash

[alienmole]

Funny how so many of the responses in this thread mirror the response of someone who's just been exposed to Snow Crash: "weird - the screen just went all static-y. But I'm fine... aren't I???"

Reaction Time More Important

[MarkByers]

The fact that there are lots of critical bugs wouldn't be an issue, if the vendor patched the bugs *before* the exploits are made public. They were aware of the bug for a long time, long before this exploit was developed.

Simmer down

[TubeSteak]

The URL is http://www.ocremix.org/
And here's the submitter's user page http://slashdot.org/~Durinthal

I think you mistook the submitter for **Beatles-Beatles
This Beatles guy is really getting out of hand.
He manages to taint stories he isn't even submitting. ...or maybe /.'ers need to stop being so effing hyper sensitive about certain things.

Re:Yawn...

[Scarblac]

I don't agree at all. Let's look at the post that got downmodded:

Yawn... IE is vulnerable and this is news, why? Seriously, people, if you're using IE to actually surf the Web I would argue you're probably already vulnerable because your system is running Windows, all your settings are probably default, and you probably don't care.

The post adds nothing to the discussion, says this article isn't newsworthy and does a broad ad hominem attack on all users of IE. How is that not flamebait?

I probably wouldn't have wasted a mod point on it, but -1 flamebait is fair. If you want to think critically, don't just believe someone who says the downmod was only about the sig.

Firefox is better why?

[PodissRT]

On the proof of concept site, my Internet Explorer blocked a pop-up and did nothing else. Firefox launched another window and then crashed. Why am I supposed to be switching again?

Re:You mean to say I can be up to date

[Phisbut]

I am shocked and appalled. As is well known, any reputable software vendor would release flaw free code that could not possibly cause hidden attacks such as this.

Although it can be "accepted" that code be released with unknown bugs (because we all make mistakes), the problem here is that the bug report is over 5 months old. It is one thing to ship buggy code, it is another thing to ignore bug reports and not fix your product once the bugs have been found. It is no longer unknown, Secunia has a release date of 2005-05-31 for that bug.

Re:Don't fret!

[Lord Bitman]

That's just Firefox crashing as it does normally, unrelated to this issue ;)

Excerpt from email my credit union sent

[smchris]

"Currently, the only work-around is to temporarily discontinue the use of Microsoft Internet Explorer and use another browser, such as FireFox, (this can be downloaded for free at www.mozilla.com) until Microsoft can issue a patch."

Anyone else's bank send out a warning like this bluntly stating that if you use IE, there is nothing the bank can do to protect you?

Re:Excerpt from email my credit union sent

[Anonymous Coward]

I tried checking my banks website from Firefox but I got "Sorry but you must use Microsoft Internet Explorer 5.0 or later to access this site."

Re:Excerpt from email my credit union sent

[Cro Magnon]

Anyone else's bank send out a warning like this bluntly stating that if you use IE, there is nothing the bank can do to protect you?

No, but I got an email from my bank stating that there is a problem with my account and they need my account info.

Firefox vulnerable too

[iambarry]

The proof of concept crashes firefox 1.0.7 (as reported in this thread by numerous others).

I'm not surprised that IE hasn't been patched, but as this vulnerability has been known for some time (this post is a dupe - not that there's anything wrong with that), but why hasn't firefox been patched yet?

Re:Firefox vulnerable too

[FooAtWFU]

It doesn't crash firefox. It hangs Firefox because it's trying to display a prompt() wherein it must reflow zillions of interesting Unicode characters. Eventually it'll display.

if you interrupt the busy state in a debugger we're busy in layout trying to
display the prompt(). Usually in some form of Reflow(), sometimes in font
stuff, sometimes in Bidi (nsBidiPresUtils::RemoveBidiContinuation?).

The bugzilla title for this bug is 'hang when long wrappable string is passed to prompt()'.

Re:Firefox isn't perfect...

[TheRaven64]

Many of the security provisions in OpenBSD cause code to crash when a security hole is encountered. I would much rather have the minor inconvenience of restarting an application than having to re-build a compromised machine. Of course, ideally it should do neither, but given the choice I'd take a crash over being 'pwned' any day.

Patch here

[6Yankee]

Rename calc.exe. Job done!

Comment removed

[account_deleted]

Comment removed based on user account deletion