Slashdot Mirror
New Zero-Day Vulnerability In Windows
Jimmy T writes "Microsoft and Secunia are warning about the discovery of a new 'Zero-day' vulnerability affecting all Microsoft based operating systems except Windows 2003. Both companies states that the vulnerability is currently being exploited by malicious websites. One attack vector is through Internet Explorer 6/7 — so be aware where you surf to."
Seems there is always a new "zero day" exploit for Windows. Most times, the exploit can be activated simply by visiting a webpage that has been crafted to take advantage of it.
Does anyone actually know anyone that has been affected by any of these exploits? Seems to me that the odds of actually visiting a site that "runs" the exploit is incredibly low.
Interesting graph for you to ponder.
Yippie.
Alright! I know I'm in there! If I don't come out, I'll have to come in after me!
I've been looking at porn all night.. it is saturday you now!.... jeeze.. I better start scanning my machine now (or stop looking at porn) .... (or reload my machine).
Lindsay Blanton
RadioReference.com
For all of the shortcomings of IE, Microsoft does attempt to cover its ass to some degree. There are settings in IE which decide which goodies [javascript, (un)signed activex controls, etc.) can be run from which websites. When installing Server 2003, just about everything is out-of-bounds in the default IE. If Microsoft would advocate such tight controls by default on all Windows distributions, or even publish its own list of trusted 3rd-party sites, risks could be reduced. The malicious folks who take advantage of zero day exploits tend to be in the seedier parts of the tubes anyway.
I'll be your candy shop of infinite deliciousity if you'll be my discotheque of endless rump-shaking.
the gayer the city, the more people search for Macs
Or is it only via IE.
What other ways can this exploit be triggered?
Let the distro war begin!
Just gimme enough time to grab the popcorn.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
"all Microsoft based operating systems except Windows 2003"
Glad nobody I know is vulnerable to this. Everyone is OSX, Linux, or Win2003 for a long time now.
- Adam L. Beberg - The Cosm Project - http://www.mithral.com/
Actually, after I got tired of calling Microsoft to activate my XP on 2 different machines a zillion times I just grabbed my Win2k Pro CD and slipstreamed it to SP4, after which I used the CD to set myself up some images for QEMU and I disallow w2k to do anything except SSH and FTP to the host (Linux) machine.
:)
Need to try this on OpenBSD too.
Running Windows with it's gonads hanging out the window is asking for trouble.
If I did not have some expen$ive proprietary software that I need to use, I'd not touch the leper.
Is that so much to ask for, of ANY browser?
This issue is a bit more complicated than you think.
That's cool. This is my pirate version of choice for the desktop.
Isn't even affected by WGA.
Niiice.
...is also the most impractical. What you do is just never network the Windows box in the first place. No internet, no intranet--nothing. If you use Windows exclusively, then this isn't really an option. You're going to want to get online eventually. But if you're double booting and running Windows for rendering applications, non-multiplayer games, office suites or whatever else that doesn't require connectivity, then you'll be fine.
Windows exploits you!
Can anyone reply with the HTML code that this vulnerability can exploit for me?... ...
Why are you looking at me that way?
I'd say that I sense a logic gap but that might be "pointing out how brilliant" I am and I'd hate to upset the sour apples.
You're right. This is the sort of English up with which we should not put.
SIERRA TANGO FOXTROT UNIFORM
and I write buggy software. I am by no means a MS basher, but the security advisory that they have put out reads like an endless stream of lame excuses.
It may very well be that stupid users or badly configured systems allow these exploits to thrive but FFS Microsoft just admit that you are actually at least partially to blame.
As long as they fail to realise that they are not gods and do actually write buggy software, what hope is there that they will ever succeed in producing something secure?
If I had created the world I wouldn't have messed about with butterflies and daffodils. I would have started with lasers
What the summary doesn't state is that more important than "where you surf to" is "what you surf with". As the summary states, this vulnerability only covers IE.
another interesing graph
Linux searches become Ubuntu searches.
Someone set up us the exploit!
Just let it go. No one cares. Except me. I hate having to read it. So I replied. Now I need to figure out some where else to go ... to.
Whatever happened to the days of when exploits were just called exploits? Now, everyone has to add zero day just to make it sound scary. Does anyone really care?
I, for one, am sick of the "zero day" exploits. Call them exploits, because that's what they are.
And before anyone brings it up, yes I am aware that zero day means the exploit was released the day the vulnerability was announced/discovered. That still doesn't change my opinion.
Internet Explorer 6/7
Well that's what they get for not updating and running Internet Explorer 6/7! It's not even version 1.0!
I will forever be a student.
Why is it that when you believe something it's an opinion, but when I believe something it's a manifesto?
You want news? Now this would be news:
REDMOND - NOV 23, 2006
Microsoft is proud to announce that for the second day in a row, now 0-day exploits were discovered in its flagship Microsoft Operating System.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Before the linux freaks start foaming at the mouth (and knob) about another windows vulnerbility, lets get things in perspective:
...Yep thought so, don't worry linux users, you can always lick up the mess from those foaming knobs
Most people will try and be pragmatic about a given situation and accept the lesser of two evils, in this case windows. Before you all jump on this if I asked you which language would you rather speak English (not the perfect language, but the majority of people understands and use it like windows) or Latin (Archaic, long winded, difficult to understand and only oucasts of humanity and people living in the past use it, like linux)
Is this just a vulnerability , or is there an exploit for it in the wild. If so, what is the payload? I use a mac , so I'm not concerned for me , just the network i manage.
"When they invent bitch slaps that can go through a monitor you better f'ing duck" --deft (253558)
A trick now seems to find a reputable well-established site which gets a reasonable number of hits. Not a massive site belonging to some big company but something reasonable anyway. Hack it and then when people visit the webpage they get hacked. How do I know? Because it happened to me.
Well, the idea is that you combine the code with a worm that can infect webservers. That way, lots of webpages will have the code, and the odds of an unprotected Windows machine being infected increase rather substantially.
Cool, a new zero day exploit for win9x/nt
In other news, it is being reported that the sun rose this morning. Tape at eleven.
Imagine that - a post that's not informative, funny, ironic or in any way meaningful. Is this all that YOU'RE contribution to /. consists of? Sad.
Because straight guys prefer getting exploited and "pwnd"? Are you familiar with the robot saying "Does not compute"?
The Internet is not safe if you use Windows and IE 6/7. Please Do NOT click any links until these issues are fixed. If you do, you might get pwn3d by 12 year-old script-kiddies or unemployed computer geeks turned hackers that still live with their mothers in the basement and are upset at the world.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
This flaw does not affect Vista users thanks to IE 7's Protected Mode feature.
Holy crap! Time to look for patches for my DOS 2.1 and Xenix systems!
Or, you know, look for accurate reporting. Either one, really.
I don't use it much - but sandboxie impressed me a few months ago for running IE (or anything) in a semi-virtualised environment
Gah. Not every convention lumped under the category of "Correct Grammar" is actually correct.
Things like this are style issues, not hard and fast rules. This would be wrong in formal speech, but in casual speech it's just a little redundant. It doesn't cause ambiguity, so why waste your breath?
Wow MSFT is joint mentioning this with Securia as an actual issue that needs to be addressed immediately. Thats a change.
kill all the fucking niggers
"... all Microsoft based operating systems except Windows 2003."
So a box running Windows 95 or DOS is at risk then?
I'm not sure which is more irritating - that the summary uses the above phrase that is not in the article, or that they article doesn't explicitly say which OS/browser versions are affected (and you'd have to go digging around to find whether you are using "XMLHTTP 4.0 ActiveX Control, part of Microsoft XML Core Services 4.0".
I suppose the most irritating thing for a Windows user is that this is yet another security hole.
Actually, it might make sense to take the caching functions out of the web browser, maybe even out of client machines entirely, in favor of network appliances. That would allow you to have very secure, locked-down browsers, while still doing caching.
I've always been surprised that Linksys or one of the other network-box companies hasn't put together an easy to use "web accellerator" caching proxy. I suppose it's because it would be too hard to explain to a lot of people (the kind of people who don't grok the difference between a web browser and "the Internet" to begin with) and require setup on the client machines that would incur too many support questions.
But if you look at the setup of most people's home networks, you have a relatively slow backhaul, usually only a few megabits, with a very fast and barely utilized internal network (generally at least 10-11 Mb/s, often faster).
It would make a certain amount of sense to do all the caching in a single location, at the router, and then have all the clients pull from that. Then you could access the internet from lightweight devices that didn't have any onboard storage. Plus you could probably set up some way to save the browser state between devices (like Google Browser Sync), but without transmitting any information out of the house.
By separating out the functions that require write access to a file system from the browser, you could run the browser without any privileges, but still get caching. The cache device would just save files based on when and how frequently they were accessed, without looking at them, so it would also be secure. No process would be both executing instructions in the content, and have write access to a filesystem.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
From Secunia, the vulnerable versions are:
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Nice try :) Let me see you run a windows machine for developing for a month, no crashes, no reboots. Repeat this for month after month. Then let me see you install a windows machine through booting a CD (or DVD if you prefer), seeing everything works as expected, and then initiate the install. The install will automatically accomodate the existing OSs on the computer, and making dual booting between any number of OSs possible. After the install, let me then see you find and install a secure browser, 2 different spreadsheets, a 3D object editor and maybe 30 small games for those 10 minutes with nothing to do. Then let me see you get an overview over all the applications installed, and press a button to upgrade all those to their newest version. Your budget is.... let's be generous and say 30 Euro.
Windows is good for exactly one thing... playing certain games. And it's getting worse all the time (not due to linux, but due to the PSn or whatever those playing boxes are called).As I have lost much of my interest in playing that sort of games, I have never been happier with Linux, which is so much better for what I do... developing software.
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
You guys, you're all Borat, right? How do you say 'grammar asshat' in Kherzikistooi?
Yeah, I found the data here, just click to read all about the odds of visiting an exploiting site.
d ie/boom.html
http://12.34.56.78/hacks/exploits/im/a/script/kid
I8-D
Buffer overflow again? we programmers should run a petition for Microsoft to stop using C for their products :-).
On a more serious note, I am using Firefox and Thunderbird, so it is highly unlikely that I am affected by the vulnerability. Open source wins again!
There will be another browser vulnerability study published that compairs minor Firefox bugs with severe "allows code execution" vunerbilities in IE. This will allow IE users come to the smug conclusion that neither browser is more secure and feel good about using Microsoft products again.
Technically, you are correct.
I think when most people read "0-day exploit" though, they mean exploits where no patch or easy/reasonable workaround is available at the time the bug becomes public knowledge.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I've got squid on linux on my router running a transparent caching proxy, so I've already got this.
XP 64 is actually a non-server build of 2003 (NT 5.2), not XP (NT 5.1). I can't tell whether XP 64 is affected, because Microsoft just says this:
"Customers who are running Windows Server 2003 and Windows Server 2003 Service Pack 1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected. Customers would need to visit an attacker's Web site to be at risk. We will continue to investigate these public reports."
I'm on XP 64 SP1, equivalent to 2003 SP1.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Use psexec to protect your system from your browser.
http://download.sysinternals.com/Files/PsExec.zip
C:\utl\psexec.exe -dl "C:\Program Files\firefox\firefox.exe"
or
C:\utl\psexec.exe -dl "C:\Program Files\Internet Explorer\iexplore.exe"
The site desn't have to be of ill repute in order to cause a risk. Remember the BOFRA/iFrame exploit? This was a case where ad server Falk AG was serving up ads to well known sites such as The Register and Comedy Central. You wouldn't hesitate to go to either of those sites most of the time.
The thing to keep in mind is that any page could be a risk and you must be security concious or face the consequences.
Sweet B&B reference. =]
No, really?
Tell me it isn't so.
* Carthago Delenda Est *
File this under the "yawn" category. Does anyone still use IE? Why? I mean, really, why? As a browser it's sucked for year compared to free alternatives.
What do you mean there? Can you cite a reference for this?
If I think of the most obvious definition of "secure", then it's pretty clear to me that it might be possible to prove that a system built for the purpose of being secure is actually secure.
Perhaps what you meant to say is that it's theoretically undecidable to prove that an arbitrary system is secure, but that's not a problem we care about. Our systems aren't arbitrary. They're supposed to be constructed for a purpose.
There's still people using IE instead of Firefox?!? Serves them right then, dummies! Back of the class!
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
B&B? It was Churchill
Or, better yet, just don't run as an administrator. It's rather unfortunate that the installer for XP creates an administrative user (in addition to "Administrator"), but it's quite easy to correct this and run as a standard user.
Perhaps given a sample size of two - the other of which is IE 6 on XP. There are a lot of web browsers out there, from lynx up, on a lot of platforms which do not fall victim to this or many other problems - mostly due to a lack of active-x which even a librarian warned me was a major mistake prior to its introduction. It is easier to point out a shortcoming in the Microsoft product than to advocate absolutely everything else.
And why is this news? Or is this a repost of what we've seen a hundred times before? Just once I'd like to see the headline "Windows declared safe to use for the next 24 hours".d _hot_chili_peppers.php
http://lyricslist.com/lyrics/artist_albums/425/re
It is dangerous to be right when the government is wrong.
MSXML4 is NOT part of Windows, so the article is written by a troll MSXML4 is NOT part of Windows, so the article is written by a troll MSXML4 is NOT part of Windows, so the article is written by a troll MSXML4 is NOT part of Windows, so the article is written by a troll MSXML4 is NOT part of Windows, so the article is written by a troll
People use IE still? weird
It's exactly thought-less posts like this that made me take the challenge...
:)
I have an XP server being used as a torrent server: -
\\### has been up for: 433 day(s), 18 hour(s), 28 minute(s), 37 second(s)
It's being used extensibly throughout the year and for the majority, the cpu usage was up to 70-80%. Currently at 40-50%.
And, IE is banned on the machine