Slashdot Mirror
Microsoft Patches VML Vulnerability
Uncle Rummy writes, "Microsoft has quietly released an official patch for the zero-day VML vulnerability. The patch was publicly available yesterday, But Microsoft has just added it to the Security Bulletin Index." Eight days from time of first report to patch is pretty fast for Microsoft, and is almost two weeks ahead of their normal patch schedule. This security flaw was being aggressively exploited out in the wild.
How did it affect DRM such that it encouraged MS to do this?
34486853790
Connection too slow for X forwarding? Try "ssh -CX user@host"
Now to see how long it takes my vendors to say "OK, you can safely apply this patch."
I've never been first to comment before, yay.
Only if you use Internet Explorer. For the rest of us, there's Firefox, Opera, Konqueror and other browsers which aren't embedded in the OS and so don't allow such nonsense to affect our systems.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Sometimes, I feel like security researchers are intentionally disclosing their new vulnerability information as close to the "Patch Tuesday" as possible in an attempt to force Microsoft to release an out of cycle patch. This time they were successful.
"Give up hope, dreams are for suckers."
I had no idea what VML was, so I did a little digging and found the following links.
a ult.asp
W3C's introduction to VML: http://www.w3.org/TR/NOTE-VML
Microsoft's brief introduction to VML: http://msdn.microsoft.com/workshop/author/vml/def
Interestingly, the MS page includes a demo "oval with red background" which doesn't work in my Firefox browser.
Of course it didn't work in Firefox. MS is not interested in creating webpages that will work in other people's browsers.
...the unofficial patch that was release by independant security specialits? A bit of a black eye for MS, no?
VML is a standard from almost a decade ago. Firefox wasn't even on their radar in 1998.
Interestingly, the MS page includes a demo "oval with red background" which doesn't work in my Firefox browser.
VML isn't a standard, it was rejected by the W3C.
Given how Firefox ignores things like MNG and SVG, not surprised they didn't implement VML.
Your hair look like poop, Bob! - Wanker.
All your base belong to us. You stupid Winsuckers.
Mods: mark everyone else redundant.
Thanks for that information. From just the brief search I ran, I was under the impression it was already approved (and simply unimplemented).
Do you have a link?
Installing the patch crashes svchost on my system.
The Internet Explorer patch was released early because Microsoft was concerned of the critical risk to users. The vulnerability involves the way that the browser handles Vector Markup Language (VML) graphics. Malicious hackers can exploit the flaw by creating a Web page that can download spyware or keyloggers onto a user's system.
A good move from Microsoft.I guess it's time to kill the Cyber criminals that are known to be using the bug to install keyloggers, adware and spyware and take over Windows PCs. Thank You Microsoft.
SVG is not ignored by Firefox nor by Mozilla as a whole.
HTH
Burns: We're building a casino!
McAllister: Arrr. Give me 5 minutes.
Good for them, doing the right thing here and all.
It's kind of funny how the security bulleting reads "Vulnerability in Vector Markup Language Could Allow Remote Code Execution". We're not saying that it does, but we think it's possible.
Gee. Ya think?
Laws do not persuade just because they threaten. --Seneca
They release patches for critical, out in the wild, flaws as soon as they get them certified. You have to realise that they can't just release a patch right off, by their own policy and as a matter of practise. They have to go through a rather extensive certification procedure to make sure it won't cause computers to blow up. It's similar to patches you see for other OSes like Solaris. You'll hear of a bug and they'll be a patch out, but not one form Sun. That comes a bit later, after they've had time to test it.
You might not agree with the policy but that's how it is, and there are reasons for doing it that way. People already whine about patches breaking systems when at present it's an extremely rare occurrence (in all the cases I've encountered, said system was spywared and that was the problem). If they rushed patches out without testing and they ended up breaking things, it could easily get to a state where people refused to patch because they were more scared of the patch than the problem.
We are dealing with non-technical users here, remember. A patch can't include a page of instructions of things you need to check first, nor can it be assumed that if it causes a problem the user can troubleshoot and fix it. It pretty much has to work straight off, and has to do so on literally tens of millions of permutations of software and hardware configurations.
Personally I'd like to see a compromise where they'd release an unofficial, untested patch for power users as soon as they could and the full patch later after testing. However the likely problem would be the unofficial patch would get in the wild, people would tout it as the official MS patch, something would go wrong, and they'd get blamed anyhow.
Just what I found on WikiPedia, that and there doesn't seem to be any followup on the W3C site past the initial submission for consideration.
Your hair look like poop, Bob! - Wanker.
Actually, the patch is NOT yet in the Security Bulletin Index as of this time. The patch is out there, but the link in the bulletin index isn't there right now. Hopefully, that web page will be updated soon.
I work in a large organization that push-deployed the patch asap. The result is that any XP machine sitting at Service Pack 1 level for the OS can no longer be successfully updated to SP2 without first deleting a file (c:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll on our image). Then we can install SP2, then re-install the 0-day.
What a pain in the ass. Is everybody seeing the same trouble?
FAQ document here: http://blogs.securiteam.com/?p=640
MSFT fixes a bug. Then it fixes the patch. Patches the patch. So is that dead bug a good choice as an icon? Please change it to phoenix bird. It is supposed to die and come back alive from its ashes.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
It isn't a standard, it was a submission to the W3C for consideration, by Microsoft and some of its useful idiots (HP, Macromedia, Autodesk, Visio). Submissions don't automagically get the thumbs up from the W3C. According to Wikipedia, Adobe, Sun and others submitted a proposal for a competing technology called PGML. Best features of the two technologies were then merged and improved upon to produce:
SVG: http://www.w3.org/TR/SVG10/
SVG became a W3C recommendation on September 4, 2001. Later versions of Opera, Firefox and some other browsers implement at least limited support for SVG. It's also a standard vector graphics creation/exchange format for many open source graphic apps like Inkscape and Scribus. Adobe Illustrator and CorelDraw also support SVG fairly capably. Guess whose browser pointedly doesn't support SVG?
http://en.wikipedia.org/wiki/Vector_Markup_Languag e Check out the code samples. The SVG code is quite a bit more compact than its VML equivalent.
Folks on SVG-rendering browsers (Firefox 1.5.x, Opera 8 and above) will possibly enjoy this little demonstration: http://isthis4real.com/orbit.xml
* * * * *
It's a small world, but I wouldn't want to have to paint it.
—Stephen Wright
If you want to be helpfull rather than biatching and moaing, you could tell the configuration of the system that's having the problem.
Seeing as how I've applied this patch to about 20 machines running Win2K, XP Home, XP Pro, Win2k Svr, Win 2k3 Svr 32-b, and Win 2k3 Svr 64-b, all without any ill effects...
Thanks to these folks: http://isotf.org/zert/
Get up!
"Interestingly, the MS page includes a demo "oval with red background" which doesn't work in my Firefox browser
Interesting enough the page layout is displayed correctly if Firefox changes User Agent ID to Internet Explorer 6. Under default Firefox ID it displays as a drap one page layout. Why does Microsoft mangle its own pages if viewed under a non MS browser.
if ($browserid!=IEXP) { mangle.page(); else display.page(); }
was: Firefox not vulnerable because VML not supported?
davecb5620@gmail.com
For some reason this and 3 other "Critical" patches refuse to install on my system. I've been verified genuine and gone through the MS tech support hoops to no avail. The install always fails and gives me a generic error code. Here are the patches I need but cant get no matter what I do, if anyone knows a possible solution I wont complain.
Security Update for Windows XP (KB917344)
Cumulative Security Update for Internet Explorer for Windows XP (KB918899)
Security Update for Windows XP (KB925486)
...they release their operating systems as quickly as they do their security patches. Eight days from the first report to a working patch? That's working fast!
yeah thanks to zert for stepping in with the fix. microsoft did not have "time" to release a patch. for what i understand microsoft only released the patch a few days after the third party patch appeared online. coincidence or what? with microsoft being reluctant to change their monthly update cycle. attackers have taken advantage of this. i cant understand why they are reluctant to do this. microsoft just let their users systems be vulnerable and unprotected for several weeks until the new patch is updated. to me this is a concern especially now when zero-day vulnerabilities wont be left alone by the attackers. microsoft should do better to protect their users.
So, talking theoretically....
If someone where to have a Firefox cache file that was infected by Bloodhound / The VML vuln. would there be any concern for that user?
Its support will expire on October 10, 2006 according to Automatic Updates service. Also, see this Microsoft Web page. It's soon, but not over yet.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
when moaning about slashdot, make sure you mention your girlfriend
if you don't have a girlfriend, mention that you used to have an 8-bit computer
my password really is 'stinkypants'
I just want to point out that ALL error codes on Windows are "generic". My computer switched into 640x480 with 8-bit color and it told me "there was an error" like it wasn't really obvious.
I can't really help you though.
So, MS takes "only" 8 days to release a patch, and Firefox gets patches out in a day...which seems better: having exploits running around for over a week being hacked at or having it fixed immediately?
look! it's a bird, it's a plane, it's....a girl? yes, a girl browsing Slashdot on Linux
Why is it that every time a patch is announced nowadays, it's announced as "X quietly releases a patch"? What? do they need fanfare or something?
Surely you're trolling? It's not exactly a well-kept secret that Firefox supports SVG.
I knew it! It's Vulnerable Markup Language!
Gonna roll the dice before I follow the Wikipedia link:
Virus Markup Language?
Vulnerability Markup Language?
Virtual Messy Layer?
The above poster got modded up three times for posting something that is 100% wrong.
It certainly pays to be an ignorant Microsoft basher on Slashdot.
I think Opera is way ahead of the Mozilla folks on the SVG implementation. That being said, I understand Firefox 2.x will implement SVG 1.1 stuff, like scripting. How well will it implement the new features? Pretty poorly at first, I'm sure. My needs are for basic multimedia implementations, like getting SVG to animate and sync with an audio file. Which is why I'm particularly interested in:
SMIL: http://www.w3.org/AudioVideo/ Internet Explorer and RealPlayer implement some or all of the current SMIL specs, Firefox hasn't even heard of it, Opera is said to be a bit buggy. I'm hoping this catches on in a big way, but I'm not holding my breath.
Oh, and Flash can be very buggy on Linux. A real estate broker client of mine had his company Website done. It was done almost completely in Flash...barely 6 lines of HTML on the entire site (of course I'm being hyperbolic but not by much). Renders swell on Windows, but for me the entire right half of his property description page just simply disappears. Mid-word, mid-photo. Very strange. I'm guessing a white rectangle is getting rendered above where it should be (wrong Z-index in HTML terms...I don't do Flash so I don't know Flash's terminology). He was livid when I showed him what his Website looked like on my monitor, and Adobe doesn't seem to be in a big hurry to update the Flash plugins for Linux.
One thing I do like about using a scripting language to animate DOM objects in HTML (the current SVG way) is that your "bounding box" can be larger than the browser's display window. Meaning that you can have objects move into the display from off-screen (done this in the past on a development site; will be doing this on a redesign of my company's site). Perhaps you can do this with Flash as well, but I've never seen it. Flash almost always gives me the feeling of looking through a small porthole that appears as a very obvious child window of the browser's parent; manipulating DOM objects via a scripting language means the entire browser window (and beyond) is my canvas to play with and there's no "porthole" effect. I like that.
* * * * *
An advertising agency is 85 percent confusion and 15 percent commission.
—Fred Allen
Typical download size: 250 KB , less than 1 minute
A security issue has been identified in the way Vector Markup Language (VML) is handled that could allow an attacker to compromise a computer running Microsoft Windows and gain control over it.
You can help protect your computer by installing this update from Microsoft.
After you install this item, you may have to restart your computer.
Check Windowsupdate
worm = a self-replicating computer program. It uses a network to send copies of itself to other systems and it may do so without any user intervention through the network.
virus = a self-replicating computer program written to alter the way a computer operates, without the permission or knowledge of the user.
patch = a small piece of software designed to update or fix problems with a computer program. This includes fixing bugs, replacing graphics and improving the usability or performance.
exploit = a piece of software, a chunk of data, or sequence of commands that take advantage of a bug, glitch or vulnerability in order to gain control of a computer system or allow privilege escalation or a denial of service attack
Computer security = a field of computer science concerned with the control of risks related to computer use.
virus or worm writer = genius.
MS = put people into misery and make profit out of it.
As we noticed a lot of cyber-criminals will be exploiting in any time..I've done some reseaching and interestingly I've found one alternative besides firewall, anti-virus and anti-spyware (which can't solve this problems ).. Do check it out.. http://www.explabs.com/ss/index.html I think this one can really helps us!!
I also have not much understanding on VML but i know it is kind of buffer overflow.. result from my surfing, VML is a remote code execution vulnerability, exists in the Vector Markup Language (VML) implementation in Microsoft Windows. An attacker could exploit the vulnerability by constructing a specially crafted Web page or HTML e-mail that could potentially allow remote code execution if a user visited the Web page or viewed the message. An attacker who successfully exploited this vulnerability could take complete control of an affected system.
Although this the windows vulnerability, IE and outlook still affected because Internet Explorer and Outlook use the vulnerable library of Windows operating system (so-called VML component) when rendering Vector Markup Language graphics. But not all internet browser are affected because this vulnerability affects only to Internet Explorer. Additionally, other browsers using the rendering component of Internet Explorer, e.g. Avant Browser, are affected.Other Internet browsers, like Mozilla Firefox, Netscape and Opera use a different technique known as Scalable Vector Graphics (SVG). The following Windows versions have been confirmed as vulnerable: Windows XP (Professional and Home Edition) Service Pack 1 and Service Pack 2 Windows 2000 (Professional and Server) Service Pack 4 Windows 2003 Server The following OS's are vulnerable as well, but they are not supported any more: Windows 95 Windows 98 and 98SE Windows Me Windows NT
This patch should be released earlier.
While it's quite possible that many of you decided to install ZERT's fix, I decided to wait for Microsoft's patch, especially because it was supposed to arrive before the October 10 deadline. Now, the company has not only released the patch early, but it appears to have bested the previous company record of an 8-day turnaround on a vulnerability. Starting on September 19, the VML bug took seven days to fix. Microsoft's Scott Deacon attributes the breakneck turnaround time to teamwork, saying via the MSRC blog, "Through some really top notch effort by all our testing teams, we were able to reach our quality bar far sooner than we originally anticipated. Yesterday we really became confident in our final checklists that we could release it and so we have done so."
The security bulletin for the new fix is MS06-055. If you've modified VGX.DLL in order to protect your system from possible exploits, Microsoft's advises that you undo the change before applying MS06-055. Otherwise, the patch may not work. In other security news, Microsoft's Craig Gehre has announced that MS06-049 has been re-released.