Slashdot Mirror
Microsoft Patches VML Vulnerability
Uncle Rummy writes, "Microsoft has quietly released an official patch for the zero-day VML vulnerability. The patch was publicly available yesterday, But Microsoft has just added it to the Security Bulletin Index." Eight days from time of first report to patch is pretty fast for Microsoft, and is almost two weeks ahead of their normal patch schedule. This security flaw was being aggressively exploited out in the wild.
How did it affect DRM such that it encouraged MS to do this?
34486853790
Connection too slow for X forwarding? Try "ssh -CX user@host"
Now to see how long it takes my vendors to say "OK, you can safely apply this patch."
Sometimes, I feel like security researchers are intentionally disclosing their new vulnerability information as close to the "Patch Tuesday" as possible in an attempt to force Microsoft to release an out of cycle patch. This time they were successful.
"Give up hope, dreams are for suckers."
I had no idea what VML was, so I did a little digging and found the following links.
a ult.asp
W3C's introduction to VML: http://www.w3.org/TR/NOTE-VML
Microsoft's brief introduction to VML: http://msdn.microsoft.com/workshop/author/vml/def
Interestingly, the MS page includes a demo "oval with red background" which doesn't work in my Firefox browser.
Of course it didn't work in Firefox. MS is not interested in creating webpages that will work in other people's browsers.
...the unofficial patch that was release by independant security specialits? A bit of a black eye for MS, no?
VML is a standard from almost a decade ago. Firefox wasn't even on their radar in 1998.
Interestingly, the MS page includes a demo "oval with red background" which doesn't work in my Firefox browser.
VML isn't a standard, it was rejected by the W3C.
Given how Firefox ignores things like MNG and SVG, not surprised they didn't implement VML.
Your hair look like poop, Bob! - Wanker.
Wow your so cool.. you throw in those nice alternate browser references nice and early on - sure to be modded insightful. Your comment was a waste of energy - it was an IE fix - and everyone here.. even the editors know that you don't have that problem unless your running windows.. idiot.
Thanks for that information. From just the brief search I ran, I was under the impression it was already approved (and simply unimplemented).
Do you have a link?
and only if tyou use IE6. If you have IE7 beta installed, you're safe.
Installing the patch crashes svchost on my system.
What's even cooler is that one of the browsers he mentions (Koqueror) is just as much "embedded into the OS" (i.e. uses shared libraries that if removed affect other userland programs) and IE.
Ten bucks says he still gets modded up for it.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
The Internet Explorer patch was released early because Microsoft was concerned of the critical risk to users. The vulnerability involves the way that the browser handles Vector Markup Language (VML) graphics. Malicious hackers can exploit the flaw by creating a Web page that can download spyware or keyloggers onto a user's system.
Flame on, if you like, but having something more useful or amusing to add to the conversation would be great -- instead of the bitter rantings of an idiot with a superiority complex.
Now, if you'll excuse me, I've got to figure out where I put my Hypocrasy Merit Badge.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
A good move from Microsoft.I guess it's time to kill the Cyber criminals that are known to be using the bug to install keyloggers, adware and spyware and take over Windows PCs. Thank You Microsoft.
SVG is not ignored by Firefox nor by Mozilla as a whole.
HTH
Burns: We're building a casino!
McAllister: Arrr. Give me 5 minutes.
Good for them, doing the right thing here and all.
It's kind of funny how the security bulleting reads "Vulnerability in Vector Markup Language Could Allow Remote Code Execution". We're not saying that it does, but we think it's possible.
Gee. Ya think?
Laws do not persuade just because they threaten. --Seneca
I need a break from this place.
It's like a when your Commodore 64 locked up, and it keept making that same horrible floppy drive noise over and over and over again..
They release patches for critical, out in the wild, flaws as soon as they get them certified. You have to realise that they can't just release a patch right off, by their own policy and as a matter of practise. They have to go through a rather extensive certification procedure to make sure it won't cause computers to blow up. It's similar to patches you see for other OSes like Solaris. You'll hear of a bug and they'll be a patch out, but not one form Sun. That comes a bit later, after they've had time to test it.
You might not agree with the policy but that's how it is, and there are reasons for doing it that way. People already whine about patches breaking systems when at present it's an extremely rare occurrence (in all the cases I've encountered, said system was spywared and that was the problem). If they rushed patches out without testing and they ended up breaking things, it could easily get to a state where people refused to patch because they were more scared of the patch than the problem.
We are dealing with non-technical users here, remember. A patch can't include a page of instructions of things you need to check first, nor can it be assumed that if it causes a problem the user can troubleshoot and fix it. It pretty much has to work straight off, and has to do so on literally tens of millions of permutations of software and hardware configurations.
Personally I'd like to see a compromise where they'd release an unofficial, untested patch for power users as soon as they could and the full patch later after testing. However the likely problem would be the unofficial patch would get in the wild, people would tout it as the official MS patch, something would go wrong, and they'd get blamed anyhow.
Just what I found on WikiPedia, that and there doesn't seem to be any followup on the W3C site past the initial submission for consideration.
Your hair look like poop, Bob! - Wanker.
I'd be willing to bet that Mac OS X/Linux users would have a lot more security problems if we used "SoftwareUpdate.app" (in the case of OS X) or "sudo apt-get" (in the case of Linux) as our default web browser.
Thankfully, only Microsoft has been daft enough to use a single piece of software to both browse the web and tinker w/ the core of the operating system.
Until somebody in Redmond decides to develop a standalone app for system updates and limits IE to being a web browser ONLY, Windows users will continue to be plagued by this crap.
Actually, the patch is NOT yet in the Security Bulletin Index as of this time. The patch is out there, but the link in the bulletin index isn't there right now. Hopefully, that web page will be updated soon.
From what I understand, being embedded into the OS is not a matter of shared libraries in this case. Some of the IE code is actaully running in kernel mode. The Konqueror broswer runs entirely in user mode from what I understand. Konqueror does call external libraries and those external libraries may enter kernel mode for a few well-defined tasks, but nothing on the level of what IE does if what I've read about IE's internals is true.
I work in a large organization that push-deployed the patch asap. The result is that any XP machine sitting at Service Pack 1 level for the OS can no longer be successfully updated to SP2 without first deleting a file (c:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll on our image). Then we can install SP2, then re-install the 0-day.
What a pain in the ass. Is everybody seeing the same trouble?
FAQ document here: http://blogs.securiteam.com/?p=640
And you still aren't! ZOMGROFLAMOWTFBBQLOL!!!111one
MSFT fixes a bug. Then it fixes the patch. Patches the patch. So is that dead bug a good choice as an icon? Please change it to phoenix bird. It is supposed to die and come back alive from its ashes.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Some of the IE code is actaully running in kernel mode.
Reference please?
"Some of the IE code is actaully running in kernel mode"
Can you define "Kernel Mode". Googling, I see this, which if is what you are talking about, tells me that you are wrong, because exploits in IE have no ability to gain priviledge higher than the user's.
These are the things I know from experience:
* Exploits that hit IE gain the priviledges of the user. Since most Windows users run as administrator, the priviledges are generally unlimited, but if the user is running as a restricted user, the exploit can not doing anything that the user can't do. This is standard for any userland program.
* IE can be completely neutered by denying access to a few key dlls. This will break certain other components of the OS, but contrary to many claims, will not cause Windows to be unusable, or unstable. Things that break when you neuter IE in this way are the help and support center (which is a glorified IE shell), and certain functionality in explorer.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
It isn't a standard, it was a submission to the W3C for consideration, by Microsoft and some of its useful idiots (HP, Macromedia, Autodesk, Visio). Submissions don't automagically get the thumbs up from the W3C. According to Wikipedia, Adobe, Sun and others submitted a proposal for a competing technology called PGML. Best features of the two technologies were then merged and improved upon to produce:
SVG: http://www.w3.org/TR/SVG10/
SVG became a W3C recommendation on September 4, 2001. Later versions of Opera, Firefox and some other browsers implement at least limited support for SVG. It's also a standard vector graphics creation/exchange format for many open source graphic apps like Inkscape and Scribus. Adobe Illustrator and CorelDraw also support SVG fairly capably. Guess whose browser pointedly doesn't support SVG?
http://en.wikipedia.org/wiki/Vector_Markup_Languag e Check out the code samples. The SVG code is quite a bit more compact than its VML equivalent.
Folks on SVG-rendering browsers (Firefox 1.5.x, Opera 8 and above) will possibly enjoy this little demonstration: http://isthis4real.com/orbit.xml
* * * * *
It's a small world, but I wouldn't want to have to paint it.
—Stephen Wright
No, IE does not run in kernel mode in any way shape or form, its a common misconception. khtml is a lot more like mshtml.dll than people would like to admit.
If you want to be helpfull rather than biatching and moaing, you could tell the configuration of the system that's having the problem.
Seeing as how I've applied this patch to about 20 machines running Win2K, XP Home, XP Pro, Win2k Svr, Win 2k3 Svr 32-b, and Win 2k3 Svr 64-b, all without any ill effects...
The "integration into the OS" is that Internet Explorer is tied to Explorer, the Windows Shell. Absolutely nothing of Internet Explorer is running in kernelspace.
Thanks to these folks: http://isotf.org/zert/
Get up!
"Interestingly, the MS page includes a demo "oval with red background" which doesn't work in my Firefox browser
Interesting enough the page layout is displayed correctly if Firefox changes User Agent ID to Internet Explorer 6. Under default Firefox ID it displays as a drap one page layout. Why does Microsoft mangle its own pages if viewed under a non MS browser.
if ($browserid!=IEXP) { mangle.page(); else display.page(); }
was: Firefox not vulnerable because VML not supported?
davecb5620@gmail.com
"The "integration into the OS" is that Internet Explorer is tied to Explorer, the Windows Shell."
Which is part of the window manager which according to this image from microsoft.com has been run in kernel mode since NT 4.0 (Article ref). If that weren't the case, then Explorer could not hang the window manager (which it sometimes does).
In WindowsXP you can run `wuauclt /detectnow` which causes the Windows Update client to check for updates immediately. From there you can install udpates after the little icon pops up in your system tray. This is not perfect, but it does mean you don't have to use IE. In Windows Vista the update function has it's own control panel app and updating via the browser is not possible.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Please explain how the diagram you cite shows Explorer to run in the Executive.
meh.
By that logic, all software runs in kernelspace, because all software talks to the kernel.
The problem with IE is ActiveX, and the fact that its users are almost all Administrators, not that it's integrated with Explorer, which is part of the window manager, which talks to the kernel.
For some reason this and 3 other "Critical" patches refuse to install on my system. I've been verified genuine and gone through the MS tech support hoops to no avail. The install always fails and gives me a generic error code. Here are the patches I need but cant get no matter what I do, if anyone knows a possible solution I wont complain.
Security Update for Windows XP (KB917344)
Cumulative Security Update for Internet Explorer for Windows XP (KB918899)
Security Update for Windows XP (KB925486)
...they release their operating systems as quickly as they do their security patches. Eight days from the first report to a working patch? That's working fast!
yeah thanks to zert for stepping in with the fix. microsoft did not have "time" to release a patch. for what i understand microsoft only released the patch a few days after the third party patch appeared online. coincidence or what? with microsoft being reluctant to change their monthly update cycle. attackers have taken advantage of this. i cant understand why they are reluctant to do this. microsoft just let their users systems be vulnerable and unprotected for several weeks until the new patch is updated. to me this is a concern especially now when zero-day vulnerabilities wont be left alone by the attackers. microsoft should do better to protect their users.
Yes, the "Window manager". The equivalent of that in *nix would be X, which runs also in kernel mode. Your point?
Explorer does not have the ability to arbitrily "hang the Window manager" in Windows. If the system has buggy drivers or what not, the "Window manager" can certainly hang itself though. I realize that the Window manager and GDI running in kernel mode has the potential to make WIndows less reliable than other OS's, but it has nothing to do with Internel Explorer, or Explorer.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
"By that logic, all software runs in kernelspace, because all software talks to the kernel."
Oh crap. You're right. I'm no expert, but do you think we could mitigate this risk but using an OS with no kernel?
Hurd maybe?
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
So, talking theoretically....
If someone where to have a Firefox cache file that was infected by Bloodhound / The VML vuln. would there be any concern for that user?
I enforced normal users for all desktop users. Myself included. Some poorly designed apps like quickbooks still require Power User. Some other poorly developed apps still require admin e.g. UPS Ship.
I've looked @ the nonadmin site (yours????) before and I don't see the dll security setting you reference (to neuter IE).
Would you mind spoon feeding me?
Thanks,
Who will guard the guards?
Its support will expire on October 10, 2006 according to Automatic Updates service. Also, see this Microsoft Web page. It's soon, but not over yet.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
when moaning about slashdot, make sure you mention your girlfriend
if you don't have a girlfriend, mention that you used to have an 8-bit computer
my password really is 'stinkypants'
I just want to point out that ALL error codes on Windows are "generic". My computer switched into 640x480 with 8-bit color and it told me "there was an error" like it wasn't really obvious.
I can't really help you though.
So, MS takes "only" 8 days to release a patch, and Firefox gets patches out in a day...which seems better: having exploits running around for over a week being hacked at or having it fixed immediately?
look! it's a bird, it's a plane, it's....a girl? yes, a girl browsing Slashdot on Linux
Why is it that every time a patch is announced nowadays, it's announced as "X quietly releases a patch"? What? do they need fanfare or something?
Surely you're trolling? It's not exactly a well-kept secret that Firefox supports SVG.
I knew it! It's Vulnerable Markup Language!
The problem isn't that MS doesn't offer a non-IE way to conduct system updates. The problem is that MS allows IE to conduct system updates in the first place. 85% of the world's population uses IE as their default browser. It doesn't matter if there exists an alternate method for updating the OS. What matters is that 85% of the world is using their OS update utility as a web browser - that's just scary.
We use UPS world ship. It ships with a little program you can run that will make it work for regular users. It's in the program directory (normally C:\ups I think). I don't remember the name of the utility and the computers I know run it are not on, so I can';t find it right now. Browse the program directory and look at the .exe files and you should be able to find it. Run it as an administrator and your users will be able to use the program without any special rights.
As for diabling IE, I can't remember the dlls. I found them by running process explorer and looking at which dlls IE used. One of them is "mshtml.dll". Deny "everyone" access to that dll and I'mmpretty sure IE will puke when you try and use it. I personally don't bother, because IMO IE is not as huge a security threat if you practice other more important secuirty practices - such as running as a non-admin, or simply choosing not to use it.
The non-admin site is not mine. I've just contributed to it.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Gonna roll the dice before I follow the Wikipedia link:
Virus Markup Language?
Vulnerability Markup Language?
Virtual Messy Layer?
Uhhh. Any browser could be used to do system updates using java applet. Microsoft's just happens to use ActiveX instead of Java.
The scary part is not that people use the browser in that way. It's that people run with root-level access, which allows them to use their browser in that way.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Also, you mentioned quickbooks. This too can be fixed easily to work for regular users by modifying a few permisions. The vendor of Quickbooks has a KB article on their website that explains how to fix it.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
The difference is, remove Konqueror from your system, and KDE won't go boom. Remove IE from the oldstyle Win98 & have an unusable system. Konqueror is just another program that uses KDE/QT core libraries. Nothing critical in itself. And those libraries are installed (on my FC5 system, anyways) seperate from Konq.
> The equivalent of that in *nix would be X, which runs also in kernel mode. Your point?
Uh ? X runs in kernel mode ? Nonsense !
You'll be happy to know Vista uses a standalone app to manage Windows Updates.
And the scarier part is that even when they WANT to run as regular users (which entails creating a new user since the default user is an adminstrator. This is something most Windows users don't know how to do because they don't know why they need to do it), they'll find that most of their software no longer runs.
Compare to...any other OS: they tell you right off the bat "hey, you probably don't want to run as administrator. Here, let me make you a limited account that you should use to access your computer. It will work just fine for most of your needs, trust me."
Now excuse me while I find my tinfoil hat and try to figure out why exactly MS wants us to all run as admins.
Uh ? X runs in kernel mode ? Nonsense !
It's runs with root-level permisions, and the drivers run in kernel mode.
What exactly is nonsense?
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
The above poster got modded up three times for posting something that is 100% wrong.
It certainly pays to be an ignorant Microsoft basher on Slashdot.
Windows 98?
Should we bring up Slackware 96 issues too?
Actually, the Administrator is a highly priveleged account but it doesn't have unlimited access (e.g. cannot get into the SAM part of the registry). The account with the most privileges (and the closest equivalent to root on UNX/Linux) is the NTAuthority/System account. Keep this in mind when checking which account services are running under. Think about e.g. your web server running with more access to the system than even the administrator has (which is how it used to be IIS and may still be -- I don't use W2K3 Server). The easiest way to become the System account is to schedule an interactive cmd.exe to run using the at command (or soon if you still have it).
-- Argel
root-level != kernel mode (root-level = ring3, kernel mode = ring0)
video drivers!=X (or you could say that *every* app runs in kernel mode)
No X window manager don't run in kernel mode.
Not long ago, there were no part of X running in the kernel (drivers were compiled in the server).
Now some of the video drivers are in the linux kernel.
There are a lot of platform where X have no kernel-level drivers.
In NT4, microsoft moved the GDI in the kernel. *That* is a totally different thing.
I think Opera is way ahead of the Mozilla folks on the SVG implementation. That being said, I understand Firefox 2.x will implement SVG 1.1 stuff, like scripting. How well will it implement the new features? Pretty poorly at first, I'm sure. My needs are for basic multimedia implementations, like getting SVG to animate and sync with an audio file. Which is why I'm particularly interested in:
SMIL: http://www.w3.org/AudioVideo/ Internet Explorer and RealPlayer implement some or all of the current SMIL specs, Firefox hasn't even heard of it, Opera is said to be a bit buggy. I'm hoping this catches on in a big way, but I'm not holding my breath.
Oh, and Flash can be very buggy on Linux. A real estate broker client of mine had his company Website done. It was done almost completely in Flash...barely 6 lines of HTML on the entire site (of course I'm being hyperbolic but not by much). Renders swell on Windows, but for me the entire right half of his property description page just simply disappears. Mid-word, mid-photo. Very strange. I'm guessing a white rectangle is getting rendered above where it should be (wrong Z-index in HTML terms...I don't do Flash so I don't know Flash's terminology). He was livid when I showed him what his Website looked like on my monitor, and Adobe doesn't seem to be in a big hurry to update the Flash plugins for Linux.
One thing I do like about using a scripting language to animate DOM objects in HTML (the current SVG way) is that your "bounding box" can be larger than the browser's display window. Meaning that you can have objects move into the display from off-screen (done this in the past on a development site; will be doing this on a redesign of my company's site). Perhaps you can do this with Flash as well, but I've never seen it. Flash almost always gives me the feeling of looking through a small porthole that appears as a very obvious child window of the browser's parent; manipulating DOM objects via a scripting language means the entire browser window (and beyond) is my canvas to play with and there's no "porthole" effect. I like that.
* * * * *
An advertising agency is 85 percent confusion and 15 percent commission.
—Fred Allen
Thanks, I knew this.
While admin is not quote as all-powerfull as SYSTEM, it does have the ability gain the permissions of SYSTEM, so it may as well be "all-powerfull".
FYI, IIS6 runs as a less priviledged account now. The more sensitve parts of it run as an account with virtually no privileges. I huge improvement over IIS5.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
"video drivers!=X (or you could say that *every* app runs in kernel mode)"
Yeah, you're right.
You will have to forgive me, as I got caught following the logic of the parent.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Typical download size: 250 KB , less than 1 minute
A security issue has been identified in the way Vector Markup Language (VML) is handled that could allow an attacker to compromise a computer running Microsoft Windows and gain control over it.
You can help protect your computer by installing this update from Microsoft.
After you install this item, you may have to restart your computer.
Check Windowsupdate
worm = a self-replicating computer program. It uses a network to send copies of itself to other systems and it may do so without any user intervention through the network.
virus = a self-replicating computer program written to alter the way a computer operates, without the permission or knowledge of the user.
patch = a small piece of software designed to update or fix problems with a computer program. This includes fixing bugs, replacing graphics and improving the usability or performance.
exploit = a piece of software, a chunk of data, or sequence of commands that take advantage of a bug, glitch or vulnerability in order to gain control of a computer system or allow privilege escalation or a denial of service attack
Computer security = a field of computer science concerned with the control of risks related to computer use.
virus or worm writer = genius.
MS = put people into misery and make profit out of it.
God you zealots really and truly are your own worst enemies.
--> Fight tyranny and repression.... read
As we noticed a lot of cyber-criminals will be exploiting in any time..I've done some reseaching and interestingly I've found one alternative besides firewall, anti-virus and anti-spyware (which can't solve this problems ).. Do check it out.. http://www.explabs.com/ss/index.html I think this one can really helps us!!
I also have not much understanding on VML but i know it is kind of buffer overflow.. result from my surfing, VML is a remote code execution vulnerability, exists in the Vector Markup Language (VML) implementation in Microsoft Windows. An attacker could exploit the vulnerability by constructing a specially crafted Web page or HTML e-mail that could potentially allow remote code execution if a user visited the Web page or viewed the message. An attacker who successfully exploited this vulnerability could take complete control of an affected system.
What's even cooler is that one of the browsers he mentions (Koqueror) is just as much "embedded into the OS" (i.e. uses shared libraries that if removed affect other userland programs) and IE.
I think Microsoft is partly to blame for this misconception - the way they claimed in their anti-trust case that IE was part of the OS wasn't exactly helpful. (However, note that all the libraries that Konqueror uses that if removed affect other parts of KDE are in a completely separate package - kdelibs - and have to be installed separately from Konqueror, whereas IE's bundled into the same installer as the associated libraries and Microsoft doesn't want you to separate them.)
Oddly, Konqueror has a pretty good security record so far, though that could be because not many people are looking for holes. (Of course, the reason IE has so many security holes is more due to ActiveX than to any of its other integration with the OS - lots of (sometimes third-party) controls and libraries that weren't designed with protection against malicious code in mind but can be used by webpages.)
Although this the windows vulnerability, IE and outlook still affected because Internet Explorer and Outlook use the vulnerable library of Windows operating system (so-called VML component) when rendering Vector Markup Language graphics. But not all internet browser are affected because this vulnerability affects only to Internet Explorer. Additionally, other browsers using the rendering component of Internet Explorer, e.g. Avant Browser, are affected.Other Internet browsers, like Mozilla Firefox, Netscape and Opera use a different technique known as Scalable Vector Graphics (SVG). The following Windows versions have been confirmed as vulnerable: Windows XP (Professional and Home Edition) Service Pack 1 and Service Pack 2 Windows 2000 (Professional and Server) Service Pack 4 Windows 2003 Server The following OS's are vulnerable as well, but they are not supported any more: Windows 95 Windows 98 and 98SE Windows Me Windows NT
This patch should be released earlier.
While it's quite possible that many of you decided to install ZERT's fix, I decided to wait for Microsoft's patch, especially because it was supposed to arrive before the October 10 deadline. Now, the company has not only released the patch early, but it appears to have bested the previous company record of an 8-day turnaround on a vulnerability. Starting on September 19, the VML bug took seven days to fix. Microsoft's Scott Deacon attributes the breakneck turnaround time to teamwork, saying via the MSRC blog, "Through some really top notch effort by all our testing teams, we were able to reach our quality bar far sooner than we originally anticipated. Yesterday we really became confident in our final checklists that we could release it and so we have done so."
The security bulletin for the new fix is MS06-055. If you've modified VGX.DLL in order to protect your system from possible exploits, Microsoft's advises that you undo the change before applying MS06-055. Otherwise, the patch may not work. In other security news, Microsoft's Craig Gehre has announced that MS06-049 has been re-released.
No problem. It is nice to answer to AC, anyway.
The parent is indeed confused.
Explorer don't run in kernel, and Internet Explorer don't run in kernel either.
But GDI runs (partialy) in the kernel, and *that* is a bad design decision (dating form NT4).
X have (traditionally) no kernel part. Some unix kernel have video drivers, which X can use.
X now have DRI, which have kernel parts, but that is similar to saying that DirectX have kernel parts.
Have a nice day!
(Slashdot requires you to wait between each successful posting of a comment to allow everyone a fair chance at posting a comment.
It's been 23 minutes since you last successfully posted a comment)