Slashdot Mirror
Code Posted For New IE Exploit
PC World is reporting that two days ago hackers posted code for a new vulnerability in Internet Explorer that could allow drive-by takeover of a vulnerable PC. Security companies say that no exploits using the "daxctle" vulnerability have yet been found in the wild, but they are taking the new threat seriously. Symantec calls the bug "critical" and Secunia rates it highly critical, the most severe rating. The hackers who posted the sample code, xsec.org, refer to it as a "0day" exploit. The article quotes another security expert who calls this label "a stretch."
Update: 09/17 18:00 GMT by C :Fixed link to XSec. Thanks for pointing that one out, folks.
That's xsec.org not xsec.com
Or maybe not... in any case, here is the patch:
These ActiveX exploits are driving me nuts. I don't use IE (thank God), but I'm still willing to supply the feathers if someone else will get the tar.
Another ActiveX exploit. *yawn*
If you want to be safe in IE, turn off ActiveX from untrusted sites. Hasn't this been known since day one?
News would be if ActiveX was tested and found to be safe.
Have you read my journal today?
A '0day exploit' is remarking on how recent it is, not the security factor. If it's real recent then it's 0day. No idea why a 'security expert' would call that a 'stretch'.
why not post these:
Linux Kernel SMBFS CHRoot Security Restriction Bypass
Linux Kernel SCTP Multiple Remote Denial of Service
Apple Mac OS X KExtLoad Format String Weakness
Mozilla Firefox JavaScript Handler Race Condition Memory Corruption Vulnerability
Check the date on the xsec.org page referred to, daxctle2.c. milw0rm 2358 was a re-publication of this, also posted up on 09/13/2006. Republication happened at other exploit advisory sites as well, such as the SecuriTeam(TM) site, where, for some strange reason, the exploit was published twice, redundantly.
The formal vulnerability advisories SA21910 and FrSIRT/ADV-2006-3593, from Secunia and FrSIRT respectively, posted on 09/14/2006, confirmed and extended this, since both groups developed internal versions of daxctle2.c which were reliably effective in compromising fully patched instances of IE6.0 on WXPSP2.
However, both these advisories made it clear that the root cause flaw was in the ActiveX component that was so successfully and famously attacked by HD Moore in July.
Friday's MS advisory, Microsoft Security Advisory (925444), both clarified matters and proposed two workarounds that might be of more use than shutting down ActiveX or fervent prayer, namely:
- Disable just the DirectAnimation Path ActiveX Control in the Registry, or
- Modify the ACL of the actual file Daxctle.ocx to be more restrictive.
Assuming, of course, that one considers it wise to use MSIE at all, given a choice. But PHBs from coast to coast have left many millions of cube inmates with exactly that: no choice.Considering that Firefox is the more common browser on Slashdot, how about doing a story about Firefox 1.5.07 fixing four separate critical heap corruption exploits and an honest to god RSA signature spoofing exploit? These stories about IE exploits comes off as pure Microsoft-hate masturbation.
OK, I'll answer the question. About 75% of web users still use IE.
If you are a sys admin, or a web admin, Deal.
The more you regulate a company, the worse its products become.
The reason it's not a 0day exploit is because some other dude already discovered the vulnerability, but didn't disclose it to the public? And that second guy is sitting on another 3 or 4 vulnerabilities?
I'm sorry, what's the definition of 0day exploit these days? If not exploit code for which there is no patch available, then what?
Can we now use "responsible disclosure" to argue away the fact that actual computer systems are at risk of being exploited right here and now, by saying "yeah, well, you got rooted and all, but we knew about that bug, so it doesn't count, even though we don't have a patch yet."?
Can we now take comments that the programmers left in the code ("// does this work?" "/* coded while druk */" "//BUGBUG") as an excuse to completely ignore actual vulnerabilities?
And hey, if TWO researches come up with this vulnerability seemingly independently, what are the chances of the exploit already circulating in the black hat community? Close to 100%?
By my definition you've got your negative-day and your zero-day exploits. Negative-day exploits; no patch yet. Zero-day; the patch has just been issued, so might as well give your exploit to scriptkiddies and botnet operators to use on the systems that don't patch early/often enough. Obviously, a negative-day exploit usually isn't going to be used on a large scale, because your average blackhatter wants to keep it in his toolkit to attack well-patched systems; after all, it's what gives him (and his leet skillz) an edge. Once patchday arrives, you might as well give it to some noobs, because they might be interested in unpatched targets, while a leet blackhatter is not.
So no, it's not a "stretch" to call it 0day. It's negative day, even.
SCO employee? Check out the bounty
...otherwise the Microsoft appologists will have to do it.
This does not affect IE7:6 .aspx
;-))
http://blogs.msdn.com/ie/archive/2006/09/15/75673
(Just for edification.
-- "I never gave these stories much credence." - HAL 9000
Slashdot has done stories on bugs in Firefox. See ..
Slashdot | 611 Defects, 71 Vulnerabilities Found In Firefox
Firefox Analyzed for Bugs by Software
Spyware Disguises Itself as Firefox Extension
I'v also noticed how the same kind of comments from the Winpologists get modded up very quickly.
was Re:Firefox 1.5.07?
davecb5620@gmail.com
do people still use IE? I thought that was a thing that went out with all your base and peanut butter jelly time!
They're using their grammar skills there.
90% actually. Yeah, mod redundant please
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
I'm new here. Just want to add my comment about vulnerability. I think most of the user world wide doesnt even care about vulnerability in IE. Only some of the user that are really care about this are taking action such as patching or reporting of the velnerability. All their know is just the IE can run as it suppose to be. Some says that using Firefoq is good but if the user dont even updated, there are also vulnerability there. I still remember one of my friend doesnt even know that his pc has already been take over by someone else. I think the most important think is all the user must alert. That all..
"if you want to be safe in IE, turn off ActiveX from untrusted sites"
How do you know what is or is not an untrusted site.
How in any way is that comment "insightful".
davecb5620@gmail.com
The codes posed by the hacker will not affect the IE Version 7. The 'Oday' meaning an exploit for a previously undisclosed vulnerability. According to HD Moore, the head of the Metasploit project, he wrote an automated ActiveX testing tool called AxMan that uncovered a handful of IE bugs, including the one exploited by on xsec.org. The trouble affects users running IE 6 with Service Pack 1 on the Windows XP operating system running Service Pack 1 or the Windows 2000 operating system with Service Pack 4. The problem occurs when visiting a Web site that uses a Web coding standard, HTTP 1.1, and compression according to Micorsoft. The details are shown below: *Vulnerability Identifier: CVE-2006-4777 *Risk: Critical *Affected Software: 1)Microsoft Internet Explorer 6 (Microsoft Windows XP Service Pack 2) 2)Microsoft Internet Explorer 6 Service Pack 1 (Microsoft Windows 2000 Service Pack 4) *Description: The attack on the IE is due to because there has been memory corruption error occured when processing a specially crafted HTML file containing an out-of-bounds value passed to the KeyFrame() method of a DirectAnimation.PathControl ActiveX object (daxctle.ocx). It can be exploited by a remote malicious user to either crash a vulnerable browser through denial of service (DoS) attacks or take complete control of an affected system through arbitrary code execution. This attack on IE vulnerability is due to ONE thing only which is the ActiveX again....Previously the big issues was the IE Version 6 that was suddenly crash. So, now the worst nightmare comes to haunt us back..
In capitalist America, your computer can have 'safe sex' by using the Firefox condom and taking the 'NoScript' pill.
what ever happened to exploits ( be it virus, trojan, whatever ) that cased some REAL damage?
All this whimy-ass 'botnet' garbage needs to end. We need something that totally kills windows when you get infected. Get the people pissed off enough to force microsoft into doing something.
---- Booth was a patriot ----
Your link points out that IE7 is vulnerable but it will prompt you to run the ActiveX control before hosing your system. From the average user's point of view, they get a message asking to run something created and signed by Microsoft for the page to load. Tell me how many average users, even the relatively computer saavy, will allow the control to run?
Throwing a constant barrage of OS/browser security pop-ups on the screen does not make it secure. Making it so that at exploitable control can be completely removed and not just "effectively removed" from the system helps make the system more secure but this is just a workaround. If the control was designed to be able to grant system level privileges to a web page than it's time to go back to the proverbial drawing board.
If it wasn't designed that way, then patch it when you first hear about it over a month ago and stop complaining about people releasing it to the public. I would rather have everyone know about it than have just Microsoft, a few security people, and several black hats knowing.
Comment removed based on user account deletion
Either they released the exploit code before the hole was patched or not.
All this whimy-ass 'botnet' garbage needs to end. We need something that totally kills windows when you get infected. Get the people pissed off enough to force microsoft into doing something.
I for one am actually surprised this hasn't happened yet. Say a worm that infects 20 others then formats the hard drive. Or perhaps break into a botnet (they are not that secure) and wipe some millions of Windows PCs at once. It would not be hard to do, let your Windows get infected, figure out how they control it and go off and get control. Time will tell, but I suspect sooner or later someone is going to do it.
I expect the performance of the internet will be greatly improved the next day.
...Is why these exploits and vulnerabilities are labelled "new".
They aren't new. Maybe they have just been found, but on a product that's been out so long, the exploits have been too (unless of course they were introduced by a fix or update recently). I know it's just improper usage of the English language - kinda like the "new" planets we've found (that have been around for billions of years).
The problem is, this creates a misconception in the casual user's mind as they think the exploit is new instead of just discovered.
StarTrekPhase2 - The Five Year Mission Continues!
If you are interested in the work on RSA signatures, check out this OpenPGP posting. The chances are that there are other RSA signature implementations out there that are vulnerable to this sort of subversion and it will be interesting to see what other products actually publish fixes and acknowledge the flaw.
Cheers,
Toby Haynes
Anything I post is strictly my own thoughts and doesn't necessarily have anything to do with the opinions of IBM.
There has to be some evil person out there that hasnt sold out to the man... In my day, it was the challenge of doing someting that drove us, not the recognition.. ( be it money or peers )
---- Booth was a patriot ----
They're here: http://malfy.org/
Security companies say that no exploits using the "daxctle" vulnerability have yet been found in the wild
But code that could be used to create an exploit has been posted, which is what I think GP was referring to.
I'll probably be modded down for this...
Yeah homies let's go pop them unsuspecting computer users with da intratubes! Show 'em what bangin' is about.
I call dupe! Slashdot just reported on an IE exploit, and before that, had another IE exploit post. They do this every month, in fact. Why don't these editors do their jobs and stop reporting the same story repeatedly?!
"Sufferin' succotash."
If that's what they're calling a vulnerability that requires user interaction, what would they rate something like a modern day Sapphire or Blaster? Give be a break. It's just another browser hole with exploit code in the wild. Medium severity at best.
If you look at Firefox security bugs and IE security bugs, you'll see that there are more Firefox bugs than MSIE bugs in the exploit lists. There is, however, a big difference.
When Microsoft finds a security hole themselves, they don't tell anyone, and they don't release a patch. They fix it in the tree for the next release of the OS. The only time they release a patch is when someone else finds the bug. The reason they do this is because if they release a patch, people will "bindiff" it against the previous version and find what is changed so that they can make exploits to use against unpatched users. You can't realistically "bindiff" XP vs. Vista, so they can obscure their security updates inside Vista.
Firefox instead will issue patches no matter who finds them. This is why Firefox appears to have more bugs - you always see them get fixed.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Or whatever they are called.
Why do people use IE? Mostly because of Intranet sites which server up IE only content and work badly or not-at-all with other browsers. How 'bout an IE plugin which opens only Intranet/trusted sites in IE and opens all else in an external safe browser? Or is this unlikely to be useful?
All bow to his Noodliness!! His Noodle Appendage has touched me!
Me saying that Windows, the worlds most used, sold and deployed user-focused OS, can be used relatively securely, and that people should choose the tool/OS that does the job that needs doing best, I get modded troll, while a Linux fanboy claiming that Linux solves all problems in the world, regardless of what the actual job at hand is (without any actual backing ofcourse) doesn't.
Great job, mods! Now you can mod this offtopic, trolling flamebait. I'm sure that the burning karma will fit right into your crackpipe.
Not Buzzword 2.0 compliant. Please speak english.
I for one am actually surprised this hasn't happened yet. Say a worm that infects 20 others then formats the hard drive. Or perhaps break into a botnet (they are not that secure) and wipe some millions of Windows PCs at once. It would not be hard to do, let your Windows get infected, figure out how they control it and go off and get control. Time will tell, but I suspect sooner or later someone is going to do it.
Yeah but who will notice? Windows is hosed and won't boot? Well, time for a re-install. Honeypots would probably be how people found out about such a thing.
IE does not safe anymore.
why hacker were borned in this world?
why they do not do anything else than hack?