Microsoft to Patch WMF Exploit Early

Chran writes "Microsoft has just announced that they will release a security update for the .WMF-exploit today at 2pm ET, instead of Tuesday, as originally planned. Microsoft writes: "Microsoft originally planned to release the update on Tuesday, January 10, 2006 as part of its regular monthly release of security bulletins, once testing for quality and application compatibility was complete. However, testing has been completed earlier than anticipated and the update is ready for release. In addition, Microsoft is releasing the update early in response to strong customer sentiment that the release should be made available as soon as possible."

Comments

Reactive vs Proactive

[biocute]

Microsoft is releasing the update early in response to strong customer sentiment that the release should be made available as soon as possible.

It would have been nicer if they make patches available as soon as possible with or without strong customer sentiment.

Re:Reactive vs Proactive

[Anonymous Coward]

Patch has been released.
Get it here http://www.microsoft.com/technet/security/Bulletin /ms06-001.mspx

According to the folks at F-secure, it co-exists well with Ilfak's unofficial patch as well as the REGSVR32 workaround. Read their blog here. http://www.f-secure.com/weblog/archives/archive-01 2006.html#00000771

Re:Reactive vs Proactive

[cnettel]

For an out-in-the-wild exploit, I would agree. For one that is currently, to their knowledge, not known among the script kiddies of the world, I'm not so sure. Releasing a patch will, generally, make those who are not yet prepared to implement it more vulnerable, if it means that knowledge of details is more wide-spread.

I think that some corporate users (especially) are quite thankful for patch Tuesdays; especially those that have been bitten by some compatibility issue previously and can't just run autoupdate of all desktops at night, but rather want to roll it out manually.

Again, this is not the case here, this exploit was discovered in the wild and it's spreading right now.

Re:Reactive vs Proactive

[targo]

It would have been nicer if they make patches available as soon as possible with or without strong customer sentiment.

This doesn't make any sense. All patch release dates are a function of:
1) impact of the problem
2) complexity of required testing
The idea being that the patch shouldn't cause more harm than the original flaw.
If the impact is huge, testing of more obscure cases can be deferred somewhat. If the impact is small, more time can be taken.
So if there hadn't been any customer sentiment (i.e. no one cared), it would make no sense to rush the patch and risk breaking something.

Re:Reactive vs Proactive

[grcumb]

"If the impact is huge, testing of more obscure cases can be deferred somewhat. If the impact is small, more time can be taken."

I'm with you so far....

"So if there hadn't been any customer sentiment (i.e. no one cared), it would make no sense to rush the patch and risk breaking something."

Err, that's a non-sequitur. Whether customers care or not has nothing to do with the cost/benefit analysis that decides the timing and scope of an initial patch. A software company should never rely on its customers to perform risk analysis. If it's serious (and the WMF flaw is egregiously so), then you find a way to protect your customers as quickly and effectively as you can. In some cases - though certainly not all - you can even accept shortcomings in the patch itself if significantly reduces the risk.

The third-party patch, for example, causes issues with the Windows printing subsystem. People voiced suspicions that this might be the case right from the start, though confirmation only came through earlier today. To my mind, that was an acceptable risk. A server that can't perform some print tasks and won't show pretty preview icons is worth a heck of a lot more to me than one that's 0wned by some random script kiddy.

And before some astroturfing twit spouts the simplistic, binary logic of 'MS is damned if they do and damned if they don't', I'd like to say from experience that deciding the timing of a security patch is a terribly difficult process. It requires the right amount of analytical skill, deep technical expertise, a healthy dose of horse sense and exactly the right measure of patience. Too much or too little of any of these can result in exactly the wrong kind of response.

Patching is not about being a nice guy. It's not about what your customers think of you. There should be no marketing or sales angle in the creation or timing of a security patch. You determine the scope and severity of the threat, be as thorough as you can reasonably hope to be (and that's never as thorough as you'd like), and deliver it as soon as you reasonably can.

I'm in complete agreement with this handler's diary from isc.sans.org concerning Microsoft's announcement that they would issue the patch at the regularly scheduled time. Given the severity of the flaw, it's unconscionable that they should leave their customers exposed for so long. The fact that they only decided to release the patch out of cycle in response to their users demonstrates that they're far more worried about their image than they are about their software. This does not bode well at all for them. Or for their customers, for that matter.

and millions of /.'ers groan...

[B00yah]

Thank you for your interest in obtaining updates from our site.

To use this site, you must be running Microsoft Internet Explorer 5 or later.

To upgrade to the latest version of the browser, go to the Internet Explorer Downloads website.

Re:and millions of /.'ers groan...

[ergo98]

Well the funny thing is that this exploit only affects Internet Explorer as well. So basically what they are saying is

They aren't "saying" anything. The Windows Update web app, as a requirement of the fact that it uses ActiveX, requires Internet Explorer. Nonetheless, not only is the patch rolling out right now via auto-updates, you can also download it directly.

In any case, even though I use Firefox and Opera for my day to day browsing, I really don't feel that threatened firing up Internet Explore for the purpose of connecting to Microsoft.

Re:and millions of /.'ers groan...

[l1_wulf]

Actually, the only reason IE is vulnerable but FF & Opera is not, is because the other big name browsers associate WMF files with Media Player instead of Picture and Fax viewer. WMP does nothing with WMF files, therefore nothing happens when exposed to the vulnerability. On the other hand, should the offending graphic actually get on your hard drive and you use Google Desktop, you will be vulnerable due to the indexing done immediately after download (obviously, if you have indexing turned off for graphics, this won't happen).

Re:and millions of /.'ers groan...

[cnettel]

I'm not so sure about that. Yes, some picture loading libraries provided in Windows will do this. No, LoadBitmap won't (it's not a bitmap!). IIRC, Firefox doesn't use the same high-level libraries, as they are rolling their own code on all platforms. So, no, it won't happen. You can easily try this if you have a valid WMF file lying around. Rename it to JPG and open in FF. It won't render, complaining about an invalid header. Rename a valid PNG to JPG or a valid JPG to PNG, though, and it renders just fine. Firefox does auto-detection of image type, but not autodetection of WMF.

Feh !

[witte]

No problem... there's plenty of other exploits for windows.

whatever

[TheRealMindChild]

testing has been completed earlier than anticipated

Sure.

Splendid...

[Hymer]

...only 10 days too late...
---
tis is not a FP

3rd person

[kennygraham]

Microsoft writes: "Microsoft originally planned...

kennygraham is glad that they're patching it early.

8 Days to patch

[badriram]

Maybe it is just me, but 8 days for a tested patch does not seem that long. However it was a 0 day which made this exploit special.

Re:8 Days to patch

[Anonymous Coward]

ProTip : If a third party can patch it faster than you, without access to the original source code - you suck.

Re:8 Days to patch

[MatD]

I'm a third party, and I can patch it right now without even touching the code. Just beat your hard drive with a hammer, and you will be immune to the exploit.

I have no idea what the side effects of this will be for your other applications (because I didn't do any regression testing), but I'm not MS, so I don't really care. Mat

Re:8 Days to patch

[croddy]

1. Release patch 8 days late
2. Describe it as an "early" release
3. ???
4. Profit!!!

Re:8 Days to patch

[TubeSteak]

Your method sounds pretty easy.

Do I have to reboot afterwards?

is their face red

[zietlow]

"in response to strong customer sentiment" Ie we look foolish that the community was able to fix it sooner than we were. Here you go, we're not that bad afterall, see?

Let's be friends again.

So early?

[flicken]

They would have released it earlier, but their test machines kept getting hacked...

Thank you, Big Brother

[Gadren]

"It appeared that there had even been demonstrations to thank Big Brother for raising the chocolate ration to twenty grammes a week. And only yesterday, he reflected, it had been announced that the ration was to be reduced to twenty grammes a week. "

MS Gets Up Early To Issue Patch!

[Quiet_Desperation]

"I usually sleep in to a reasonable hour for a Thursday, like, noon," said Microsoft, appearing at 8am at a press conference outside a Hardee's in Iowa, dressed in slippers and a blue bathrobe with the words 'Sexy Grandpa' emblazoned on the back. "But all you whiiiiiiiiners wouldn't let me get my rest. So I'll crank this thing out and have it on Windows Update by 11am."

"When will the patch for the patch be released?" asked Fox News correspondent Bubbles McConnifer, causing the press corps to giggle like schoolgirls in heat.

"Smile when you said that, bitch," growled a visibly angered Microsoft, who then motioned to two pinstripe suited thugs who escorted Ms. McConnifer from the press conference.

"Any other questions, whores?" asked Microsoft, placing fists on hips and allowing his 'MS Certified Otakus Rule!' T-Shirt to be seen. His query was greeted by silence. "Well alright, then."

Rough translation

[ctid]

testing has been completed earlier than anticipated

Our customers are getting pwn3d.

I know, I know...

[Eberlin]

Damned if they send out patches as they're made (too many, too confusing) and damned if they wait 'til Patch Tuesday (negligent, inconsiderate).

We can't have it both ways, and neither should they. I say send out patches as they're made and let the sysadmins be responsible for whether they can keep up or not. It may be difficult to admin many machines that have to be patched but I'd rather have fixes available ASAP and put the burden on IT to apply them.

Yeah, there are patches that will break stuff and ample testing should be done anyway...but does rolling them all into a Patch Tuesday really change that fact? Probably not.

With this sentiment, we can put more pressure on Patch Tuesday for what it really is -- a Trustworthy Computing PR stunt in which the number of fixes and vulnerabilities seems to be lower (since we're only patching once a month...maybe).

All that said, kudos to MS for reacting...but unkudos for taking this long...and major unkudos for being naive about the WMF design to begin with.

It still took a long time!

[LinuxDon]

The exploit writers have had the exploit ready for quite a while now.
While MS was 'testing' everyone has been installing 'fixes' from other sites..
Even IF their patch was not 100% it wouldn't really have mattered in this case.

There was a gaping security hole in their OS and they still needed 12 days to come up with a fix!
For such a large company whose software is being used by *millions* of people worldwide and 7 billion a quarter profit, they've sure taken their sweet time!

Why don't they take some 0.01 procent of that 7 billion and test/release it sooner?

Error in the summary...

[Ransak]

The security update will be available at 2:00 pm PT as MS06-001.

... meaning all us east coast admins will be staying late tonight. Joy.

Early release to catch out the hackers

[briqui]

Telling everyone that they are going to wait till Tuesday to patch the problem, then releasing a patch 5 days earlier might actually be quite a neat trick.

I'm sure a lot of people out there who were planning to taking advantage of this problem have been thinking that they have till Tuesday to write a really good exploit, and therefore not hurrying too much.

Now Microsoft come along and patch it early.

I don't know about anyone else but I was expecting Monday do be a day from hell...

Does *not* require Internet Explorer...

[SenorCitizen]

Thank you for your interest in obtaining updates from our site. To use this site, you must be running Microsoft Internet Explorer 5 or later.

Funny, yes, but not true. The patch is available here:

http://www.microsoft.com/technet/security/Bulletin /MS06-001.mspx

Just downloaded it with Firefox. It's just Windows Update that requires IE.

3rd party did not patch vulnerability

[badriram]

They just blocked the execution of the vulnerable function. This to me a mitigation method not a patch. Think of it as, there is a vulnerability in mod_rewrite within apache, and a third party "patch", just disables it, to secure apache.

Re:early my eye

[javaxman]

It's the old "SCOTTIE" trick. They say they need until the 10th to test and patch and make sure it works and then they WOW us by being able to release it early. They had it ready before now, they are just trying to salvage what little they have out of this fiasco.

They had it ready, if by ready you mean a version had been compiled and 'tested' once on the developer's machine.

Trust me, right now in Redmond there's a whole team of Quality Assurance Engineers who are looking at their test plans, scratching their heads, and once again calling into question the actual value of their work, given that some manager can arbitrarily decide when it's time to rush a release regardless of what the schedule said or what the impact of a patch was or which cases remain un-tested. That, and they're really, really tired after pulling a couple of all-nighters.

Have fun testing that patch.

will? or did..

[mottie]

Posted by CmdrTaco on Thursday January 05, @12:56PM (3:56PM EST)

Chran writes "Microsoft has just announced that they will release a security update for the .WMF-exploit today at 2pm EST

talk about releasing the news late.. the patch was already out by the time slashdot had the "news" that microsoft would be releasing the patch.

Re:The Real Reason

[TubeSteak]

The other guy didn't fix the bug.

he did not fix it

All the 3rd party patch did was implement a workaround.

"testing ... completed earlier than anticipated"

[antispam_ben]

Translation: "Our ass needed covering even earlier than anticipated."

Re:Sadly no

[Tony Hoyle]

No, they're just companies that can't spend half a million dollars upgrading hardware and software just to run the latest whizz-bang eye candy from microsoft, when what they have works just fine.

Over 40% of our customers are NT4 shops. Some of them are *big*.

Re:2000, XP, 2003, but no 3.10, 3.11, 95, 98, or M

[Mercano]

I never thought back then that memory leak could mean buffer overflow which could mean security vulnerability

In this case, its not a buffer overflow bug. In fact, its not even a bug, per say. Its a feature, or at least a really bad design flaw that no one has stumbled upon/abused up until now. See F-Secure's writeup.

Re:2000, XP, 2003, but no 3.10, 3.11, 95, 98, or M

[jschottm]

Microsoft's policy is that they will only release critical patches for 9X/ME systems because they have EOLed them. Their study of the vulnerability found that while those systems are vulnerable, that it is not critical because no attack vector has been identified. Whether or not you trust their assessment is another question, but that's why there's no patch for them. See questions 2, 3, and 4 in the FAQ.

http://www.microsoft.com/technet/security/Bulletin /MS06-001.mspx

I suspect 3.x is the same, but really, if you're using 3.10 as a desktop...

NO!

[baadger]

So, they basically used exactly the same workaround as the 3rd party patch that's been out for a week.

The MS patch removes the call in the WMF rendering engine that calls the gdi32 Escape() function with the SETABORTPROC parameter. The 3rd party runtime patch thats been around 'for a week' killed the Escape() function's ability to receive the SETABORTPROC procedure in _all user32.dll bound applications_ called by _anything_ for _any purpose_, 'breaking' more than just the WMF rendering caller.

Microsoft couldn't have done any better because this wasn't a coding error like a buffer overflow, it was an ancient long forgotten genuine feature.

Re:Sadly no

[Pii]

Actually, the reason there's no attack vector is because while the same vulnerability on older versions of Windows, older versions of Windows don't have the Microsoft Picture and Fax Viewer configured as the default file handler for .wmf files.

Ironic, as the older operating systems come from a time when that format may have been relevant. It's kind of funny that only after the Windows Metafile became obsolete did MS choose to create a default program association.