Slashdot Mirror
Microsoft to Patch WMF Exploit Early
Chran writes "Microsoft has just announced that they will release a security update for the .WMF-exploit today at 2pm ET, instead of Tuesday, as originally planned.
Microsoft writes: "Microsoft originally planned to release the update on Tuesday, January 10, 2006 as part of its regular monthly release of security bulletins, once testing for quality and application compatibility was complete. However, testing has been completed earlier than anticipated and the update is ready for release. In addition, Microsoft is releasing the update early in response to strong customer sentiment that the release should be made available as soon as possible."
Microsoft is releasing the update early in response to strong customer sentiment that the release should be made available as soon as possible.
It would have been nicer if they make patches available as soon as possible with or without strong customer sentiment.
Virtual Betting on Facebook for non-geeks.
Thank you for your interest in obtaining updates from our site.
To use this site, you must be running Microsoft Internet Explorer 5 or later.
To upgrade to the latest version of the browser, go to the Internet Explorer Downloads website.
How Jaded Are You?
No problem... there's plenty of other exploits for windows.
testing has been completed earlier than anticipated
Sure.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
...only 10 days too late...
---
tis is not a FP
Maybe it is just me, but 8 days for a tested patch does not seem that long. However it was a 0 day which made this exploit special.
"in response to strong customer sentiment" Ie we look foolish that the community was able to fix it sooner than we were. Here you go, we're not that bad afterall, see?
Let's be friends again.
Slashdot # 199661 the number that's the same upside down and right side up
http://www.microsoft.com/technet/security/Bulletin /MS06-001.mspx
WSUS picks it up on synch so start deploying once you've tested it internally. 5 days early? Not bad. Not great, but an official patch is always welcome. Hats of to the SANS team for applying the pressure. It's unfortunate that they were not mentioned in the Acknowlegements section of the MS06-001 release notes.
They would have released it earlier, but their test machines kept getting hacked...
20 mil and I will! Learn Esperanto with 20M others.
Is really a problem of customer sentiment, or is actually the public embarassment of a third party releasing a patch quicker even without the source code of the libraries?
--
Superb hosting 20GB Storage, 1_TB_ bandwidth, ssh, $7.95
Let me guess, they've added a warning message that says you're about to download or open a WMF then let's you do it anyway? It took them all week to develop because they needed to translate "OK" and "Cancel" to 47 different languages.
"It appeared that there had even been demonstrations to thank Big Brother for raising the chocolate ration to twenty grammes a week. And only yesterday, he reflected, it had been announced that the ration was to be reduced to twenty grammes a week. "
Somebody within M$ finally awoke to the public outcry from the sysadmins and ISC. Leaving your customers swinging in the breeze for weeks to release such a critical patch is criminal.
"When will the patch for the patch be released?" asked Fox News correspondent Bubbles McConnifer, causing the press corps to giggle like schoolgirls in heat.
"Smile when you said that, bitch," growled a visibly angered Microsoft, who then motioned to two pinstripe suited thugs who escorted Ms. McConnifer from the press conference.
"Any other questions, whores?" asked Microsoft, placing fists on hips and allowing his 'MS Certified Otakus Rule!' T-Shirt to be seen. His query was greeted by silence. "Well alright, then."
Our customers are getting pwn3d.
Reality is defined by the maddest person in the room
Damned if they send out patches as they're made (too many, too confusing) and damned if they wait 'til Patch Tuesday (negligent, inconsiderate).
We can't have it both ways, and neither should they. I say send out patches as they're made and let the sysadmins be responsible for whether they can keep up or not. It may be difficult to admin many machines that have to be patched but I'd rather have fixes available ASAP and put the burden on IT to apply them.
Yeah, there are patches that will break stuff and ample testing should be done anyway...but does rolling them all into a Patch Tuesday really change that fact? Probably not.
With this sentiment, we can put more pressure on Patch Tuesday for what it really is -- a Trustworthy Computing PR stunt in which the number of fixes and vulnerabilities seems to be lower (since we're only patching once a month...maybe).
All that said, kudos to MS for reacting...but unkudos for taking this long...and major unkudos for being naive about the WMF design to begin with.
The exploit writers have had the exploit ready for quite a while now.
While MS was 'testing' everyone has been installing 'fixes' from other sites..
Even IF their patch was not 100% it wouldn't really have mattered in this case.
There was a gaping security hole in their OS and they still needed 12 days to come up with a fix!
For such a large company whose software is being used by *millions* of people worldwide and 7 billion a quarter profit, they've sure taken their sweet time!
Why don't they take some 0.01 procent of that 7 billion and test/release it sooner?
... meaning all us east coast admins will be staying late tonight. Joy.
"Powers. I have them."
Intrigued with the broo-haha surrounding WMFs, I did a search for them on my machine. The only WMFs I found were Microsoft's clip art. Which begs the question: is there anyone out there who isn't Microsoft who commonly uses this file type?
Telling everyone that they are going to wait till Tuesday to patch the problem, then releasing a patch 5 days earlier might actually be quite a neat trick.
I'm sure a lot of people out there who were planning to taking advantage of this problem have been thinking that they have till Tuesday to write a really good exploit, and therefore not hurrying too much.
Now Microsoft come along and patch it early.
I don't know about anyone else but I was expecting Monday do be a day from hell...
Does this mean I can't have an image file that creates bouncing pictures hopping around on my screen with some guy screaming that I am looking at gay porno?
srsly, fuck u miKKKro$haft
Actually they are doing this to save face. The reason it is being put out "early" is because someone else wrote a fix for it already. People apparently flowed to this other site for the patch, and people started wondering what the problem was. Here was a person who without the Windows source fixed the bug, while Microsoft itself with full access to the code was delaying. In order to save face they had to rapidly deploy it rather than sit on it as they normally do.
Microsoft Sucks, F/OSS Rocks. I get mod points now right?
I'm only getting hits on 2000, XP, and 2003: According to the Financial Times article highlighted at Drudge, Hyppönen said the vulnerability is supposed to hit "every Windows operating system since 1990".
So is there a patch for older versions of Windows?
I think that by this point Microsoft is pretty much numbed when it comes to public embarrassment.
All movements for social change begin as missions, evolve into businesses, and end up as rackets.
Funny, yes, but not true. The patch is available here:
http://www.microsoft.com/technet/security/Bulletin /MS06-001.mspx
Just downloaded it with Firefox. It's just Windows Update that requires IE.
They just blocked the execution of the vulnerable function. This to me a mitigation method not a patch. Think of it as, there is a vulnerability in mod_rewrite within apache, and a third party "patch", just disables it, to secure apache.
This wouldn't have anything to do with the fact that the fix got leaked early, would it?
http://grc.com/sn/notes-020.htm
Insert Sig Here
Boy, all those guys running web servers under DOS 5 must be pissing their pants!
The world's burning. Moped Jesus spotted on I50. Details at 11.
Use the exploit to their advantage? Just change their logo to a WMF and use the exploit to push the patch out?
Prove it.
They had it ready, if by ready you mean a version had been compiled and 'tested' once on the developer's machine.
Trust me, right now in Redmond there's a whole team of Quality Assurance Engineers who are looking at their test plans, scratching their heads, and once again calling into question the actual value of their work, given that some manager can arbitrarily decide when it's time to rush a release regardless of what the schedule said or what the impact of a patch was or which cases remain un-tested. That, and they're really, really tired after pulling a couple of all-nighters.
Have fun testing that patch.
Here is the FAQ from the KB
-----
Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME) were previously listed as affected, but are no longer listed. Why is that?
Although Windows 98, Windows 98 Second Edition, and Windows Millennium Edition do contain the affected component, at this point in the investigation, an exploitable attack vector has not been identified that would yield a Critical severity rating for these versions. Per the support life cycle of these versions, only vulnerabilities of Critical severity would receive security updates. For more information about the security update support policy for these versions of Windows, visit the following Web site.
-----
Although I do believe they should be patching this.
Posted by CmdrTaco on Thursday January 05, @12:56PM (3:56PM EST)
.WMF-exploit today at 2pm EST
Chran writes "Microsoft has just announced that they will release a security update for the
talk about releasing the news late.. the patch was already out by the time slashdot had the "news" that microsoft would be releasing the patch.
It they're still running Windows 95/98, it already sucked to be them...bug, patch, or no...
There is no God, and Dirac is his prophet.
His wife could not be reached to comment on this!
***rimshot***
Thanks folks! I'll be here all week. Don't forget to tip the wait staff.
Translation: "Our ass needed covering even earlier than anticipated."
Tag lost or not installed.
By your logic, Microsoft also has not patched the vulnerability. From the MS006-001 FAQ:
So, they basically used exactly the same workaround as the 3rd party patch that's been out for a week.
Causation can cause correlation
Early would have been before the original flawed release, surely?
Do you see what I did there?
Where are the patches for Win 98, Win 98 SE, and Win 98 ME? Microsoft rates this as a critical exploit and is supposed to release patches for critical exploits so where are they? Millions of people still use these operating systems.
-- SKYKING, SKYKING, DO NOT ANSWER.
I never thought back then that memory leak could mean buffer overflow which could mean security vulnerability
In this case, its not a buffer overflow bug. In fact, its not even a bug, per say. Its a feature, or at least a really bad design flaw that no one has stumbled upon/abused up until now. See F-Secure's writeup.
#include <signature.h>
Microsoft's policy is that they will only release critical patches for 9X/ME systems because they have EOLed them. Their study of the vulnerability found that while those systems are vulnerable, that it is not critical because no attack vector has been identified. Whether or not you trust their assessment is another question, but that's why there's no patch for them. See questions 2, 3, and 4 in the FAQ.
n /MS06-001.mspx
http://www.microsoft.com/technet/security/Bulleti
I suspect 3.x is the same, but really, if you're using 3.10 as a desktop...
Ilfak's patch required a reboot to start applying to new processes, rtffaq.
This is "Less late".
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
So, they basically used exactly the same workaround as the 3rd party patch that's been out for a week.
The MS patch removes the call in the WMF rendering engine that calls the gdi32 Escape() function with the SETABORTPROC parameter. The 3rd party runtime patch thats been around 'for a week' killed the Escape() function's ability to receive the SETABORTPROC procedure in _all user32.dll bound applications_ called by _anything_ for _any purpose_, 'breaking' more than just the WMF rendering caller.
Microsoft couldn't have done any better because this wasn't a coding error like a buffer overflow, it was an ancient long forgotten genuine feature.
1. People like to b*tch about everything no matter how good they have it.
2. Most of the people here would still hate Microsoft even if Bill gave up 75% of Microsoft's yearly profit to fund cancer research. You'd all whine "Why can't Billy give 90%, that evil, crooked b@stard."
All you Billy-bashing knuckle-draggers can't even fathom the fact that if Mac OSX or RedHat were the top dog in enterprise sales and Microsoft was the undercapitalized weakling, viruses, worms, and spyware would no longer exist for the Win32 platform. Why would the hackers and script kiddies spend all time and effort trying to target only 20% of the market?
You also don't have the mental capacity to appreciate Microsoft's innovative contributions to the IT industry, either directly or indirectly. Many of our current technologies were spurned directly from the spirit of competition against Microsoft. So MS buys someone out. Why hate MS? Why don't you hate the seller for selling out? You are all just looking for something to whine about.
Yes this was also in another post, but here you go:n /MS06-001.mspx
http://www.microsoft.com/technet/security/Bulleti
I was able to download the XP and 2000 patches just fine with Firefox from that link.
Thank you for your interest in obtaining updates from our site.
..... I use firefox so I don't have to use their crap any more than I have to, but I have to use their crap in order to fix another piece of their crap .....
To use this site, you must be running Microsoft Internet Explorer 5 or later.
To upgrade to the latest version of the browser, go to the Internet Explorer Downloads website.
How bloody typical
Has anyone else noticed that after installing the "WMF Patch" you now have a "My Websites on MSN" site in your "My Network Places" and that Firefox v1.0.7 now hangs on load? That's a good way to win the browser war. Great job Microsoft!