Slashdot Mirror
New Zero-Day Vulnerability In Windows
Jimmy T writes "Microsoft and Secunia are warning about the discovery of a new 'Zero-day' vulnerability affecting all Microsoft based operating systems except Windows 2003. Both companies states that the vulnerability is currently being exploited by malicious websites. One attack vector is through Internet Explorer 6/7 — so be aware where you surf to."
Seems there is always a new "zero day" exploit for Windows. Most times, the exploit can be activated simply by visiting a webpage that has been crafted to take advantage of it.
Does anyone actually know anyone that has been affected by any of these exploits? Seems to me that the odds of actually visiting a site that "runs" the exploit is incredibly low.
I've been looking at porn all night.. it is saturday you now!.... jeeze.. I better start scanning my machine now (or stop looking at porn) .... (or reload my machine).
Lindsay Blanton
RadioReference.com
Damn you, realmolo.
Alright! I know I'm in there! If I don't come out, I'll have to come in after me!
For all of the shortcomings of IE, Microsoft does attempt to cover its ass to some degree. There are settings in IE which decide which goodies [javascript, (un)signed activex controls, etc.) can be run from which websites. When installing Server 2003, just about everything is out-of-bounds in the default IE. If Microsoft would advocate such tight controls by default on all Windows distributions, or even publish its own list of trusted 3rd-party sites, risks could be reduced. The malicious folks who take advantage of zero day exploits tend to be in the seedier parts of the tubes anyway.
I'll be your candy shop of infinite deliciousity if you'll be my discotheque of endless rump-shaking.
Or is it only via IE.
What other ways can this exploit be triggered?
Let the distro war begin!
Just gimme enough time to grab the popcorn.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Is that so much to ask for, of ANY browser?
This issue is a bit more complicated than you think.
Its sad when you think that Windows 2003 is a better desktop OS than Windows XP...a bit pricey for a desktop, too =P
As a sexy nerd-girl once said,
Lay off the caffeine, dog. Now you're seeing things. There ain't no such thing as a sexy nerd girl. There are plenty of sexy girls (directly proportional to the amount of beer you've had), and there are some nerd girls. But sexy nerd girls? No way, unless you are really wasted.
Seven puppies were harmed during the making of this post.
...is also the most impractical. What you do is just never network the Windows box in the first place. No internet, no intranet--nothing. If you use Windows exclusively, then this isn't really an option. You're going to want to get online eventually. But if you're double booting and running Windows for rendering applications, non-multiplayer games, office suites or whatever else that doesn't require connectivity, then you'll be fine.
Windows exploits you!
there's no trend here. windows searches are decreasing also.
What are the odds that some idiot will name his mutex ether-rot-mutex!
You're right. This is the sort of English up with which we should not put.
SIERRA TANGO FOXTROT UNIFORM
and I write buggy software. I am by no means a MS basher, but the security advisory that they have put out reads like an endless stream of lame excuses.
It may very well be that stupid users or badly configured systems allow these exploits to thrive but FFS Microsoft just admit that you are actually at least partially to blame.
As long as they fail to realise that they are not gods and do actually write buggy software, what hope is there that they will ever succeed in producing something secure?
If I had created the world I wouldn't have messed about with butterflies and daffodils. I would have started with lasers
Its funny because the other week I was waiting at the supermarket checkout behind three of the ugliest women I have seen in a long time. Not offensive, just not ... very ... attractive.
Their credit card transaction was going through. One of them appeared to be entranced by the flickering lights of the network gear embedded behind the register. She turned two one of her friends and said I think the hourly transfer is about to run...ah there it is.
Geeks! And supermarket IT geeks at that.
http://michaelsmith.id.au
another interesing graph
Linux searches become Ubuntu searches.
It is when you can run as non-admin and have it mean something.
3 years and zero virii, trojans, etc on any of the Win machines.
- Adam L. Beberg - The Cosm Project - http://www.mithral.com/
Someone set up us the exploit!
That probably comes with good usage more than just the OS though. I've ran NT4, 2k, and XP for about 9 years over (I think thats right?), and didn't get even as much as a spyware on any of those, without any permanent scanners (I scan like once every 6 months or so). But the whole running in non-admin and mean something thing does sound cool.
Since *BSD is dying and there are no good looking geek women, last chance to view BSD vs Linux.
Internet Explorer 6/7
Well that's what they get for not updating and running Internet Explorer 6/7! It's not even version 1.0!
I will forever be a student.
Why is it that when you believe something it's an opinion, but when I believe something it's a manifesto?
Some of us gays prefer to stick with Linux, thanks.
You want news? Now this would be news:
REDMOND - NOV 23, 2006
Microsoft is proud to announce that for the second day in a row, now 0-day exploits were discovered in its flagship Microsoft Operating System.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Is this just a vulnerability , or is there an exploit for it in the wild. If so, what is the payload? I use a mac , so I'm not concerned for me , just the network i manage.
"When they invent bitch slaps that can go through a monitor you better f'ing duck" --deft (253558)
Well, the idea is that you combine the code with a worm that can infect webservers. That way, lots of webpages will have the code, and the odds of an unprotected Windows machine being infected increase rather substantially.
Cool, a new zero day exploit for win9x/nt
In other news, it is being reported that the sun rose this morning. Tape at eleven.
This flaw does not affect Vista users thanks to IE 7's Protected Mode feature.
Jeri Ellsworth
Like the romans said, you can't argue taste. Ewww. As far as I'm concerned, my point stands. But then again I must concede that yes, at least she LOOKS female.
Seven puppies were harmed during the making of this post.
You've never met a Mac geek girl.
:)
You can keep them. Perhaps I'm spoiled, since I live in latin america. Oiga, las mujeres down here are, well, guapissimas
Seven puppies were harmed during the making of this post.
I don't use it much - but sandboxie impressed me a few months ago for running IE (or anything) in a semi-virtualised environment
kill all the fucking niggers
"... all Microsoft based operating systems except Windows 2003."
So a box running Windows 95 or DOS is at risk then?
I'm not sure which is more irritating - that the summary uses the above phrase that is not in the article, or that they article doesn't explicitly say which OS/browser versions are affected (and you'd have to go digging around to find whether you are using "XMLHTTP 4.0 ActiveX Control, part of Microsoft XML Core Services 4.0".
I suppose the most irritating thing for a Windows user is that this is yet another security hole.
Actually, it might make sense to take the caching functions out of the web browser, maybe even out of client machines entirely, in favor of network appliances. That would allow you to have very secure, locked-down browsers, while still doing caching.
I've always been surprised that Linksys or one of the other network-box companies hasn't put together an easy to use "web accellerator" caching proxy. I suppose it's because it would be too hard to explain to a lot of people (the kind of people who don't grok the difference between a web browser and "the Internet" to begin with) and require setup on the client machines that would incur too many support questions.
But if you look at the setup of most people's home networks, you have a relatively slow backhaul, usually only a few megabits, with a very fast and barely utilized internal network (generally at least 10-11 Mb/s, often faster).
It would make a certain amount of sense to do all the caching in a single location, at the router, and then have all the clients pull from that. Then you could access the internet from lightweight devices that didn't have any onboard storage. Plus you could probably set up some way to save the browser state between devices (like Google Browser Sync), but without transmitting any information out of the house.
By separating out the functions that require write access to a file system from the browser, you could run the browser without any privileges, but still get caching. The cache device would just save files based on when and how frequently they were accessed, without looking at them, so it would also be secure. No process would be both executing instructions in the content, and have write access to a filesystem.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Why can't you just write 'I', without the ',for one,'? There aren't all that many schizophrenics that you need to make the distinction.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
From Secunia, the vulnerable versions are:
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Nice try :) Let me see you run a windows machine for developing for a month, no crashes, no reboots. Repeat this for month after month. Then let me see you install a windows machine through booting a CD (or DVD if you prefer), seeing everything works as expected, and then initiate the install. The install will automatically accomodate the existing OSs on the computer, and making dual booting between any number of OSs possible. After the install, let me then see you find and install a secure browser, 2 different spreadsheets, a 3D object editor and maybe 30 small games for those 10 minutes with nothing to do. Then let me see you get an overview over all the applications installed, and press a button to upgrade all those to their newest version. Your budget is.... let's be generous and say 30 Euro.
Windows is good for exactly one thing... playing certain games. And it's getting worse all the time (not due to linux, but due to the PSn or whatever those playing boxes are called).As I have lost much of my interest in playing that sort of games, I have never been happier with Linux, which is so much better for what I do... developing software.
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
> And before anyone brings it up, yes I am aware that zero day means the exploit was released the day the vulnerability was announced/discovered. That still doesn't change my opinion.
ahhh, I didn't know that but there is so much jargon around these days from people trying to sound sexy and intelligent I do let a lot go over my head. Thanks for the clarification. I've been hearing "zero day zero day" everywhere I thought it must be some kind of clevel attack like Birthday or something. There you go, learn something new every zero day.
"I'm not much interested in interoperability. I want substitutability. I want to be able to throw your software out."
Yeah, I found the data here, just click to read all about the odds of visiting an exploiting site.
d ie/boom.html
http://12.34.56.78/hacks/exploits/im/a/script/kid
I8-D
Buffer overflow again? we programmers should run a petition for Microsoft to stop using C for their products :-).
On a more serious note, I am using Firefox and Thunderbird, so it is highly unlikely that I am affected by the vulnerability. Open source wins again!
There will be another browser vulnerability study published that compairs minor Firefox bugs with severe "allows code execution" vunerbilities in IE. This will allow IE users come to the smug conclusion that neither browser is more secure and feel good about using Microsoft products again.
Of course, if they've modified Internet Explorer settings to the point where modern "Web 2.0" sites actually work in Internet Explorer, Windows Server 2003 users are probably vulnerable too...
Technically, you are correct.
I think when most people read "0-day exploit" though, they mean exploits where no patch or easy/reasonable workaround is available at the time the bug becomes public knowledge.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I've got squid on linux on my router running a transparent caching proxy, so I've already got this.
XP 64 is actually a non-server build of 2003 (NT 5.2), not XP (NT 5.1). I can't tell whether XP 64 is affected, because Microsoft just says this:
"Customers who are running Windows Server 2003 and Windows Server 2003 Service Pack 1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected. Customers would need to visit an attacker's Web site to be at risk. We will continue to investigate these public reports."
I'm on XP 64 SP1, equivalent to 2003 SP1.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Use psexec to protect your system from your browser.
http://download.sysinternals.com/Files/PsExec.zip
C:\utl\psexec.exe -dl "C:\Program Files\firefox\firefox.exe"
or
C:\utl\psexec.exe -dl "C:\Program Files\Internet Explorer\iexplore.exe"
The site desn't have to be of ill repute in order to cause a risk. Remember the BOFRA/iFrame exploit? This was a case where ad server Falk AG was serving up ads to well known sites such as The Register and Comedy Central. You wouldn't hesitate to go to either of those sites most of the time.
The thing to keep in mind is that any page could be a risk and you must be security concious or face the consequences.
No, really?
Tell me it isn't so.
* Carthago Delenda Est *
Why is there no trend simply because Windows searches are also decreasing?
In fact, the graph shows Windows searches beginning to increase again.
"Sufferin' succotash."
What do you mean there? Can you cite a reference for this?
If I think of the most obvious definition of "secure", then it's pretty clear to me that it might be possible to prove that a system built for the purpose of being secure is actually secure.
Perhaps what you meant to say is that it's theoretically undecidable to prove that an arbitrary system is secure, but that's not a problem we care about. Our systems aren't arbitrary. They're supposed to be constructed for a purpose.
There's still people using IE instead of Firefox?!? Serves them right then, dummies! Back of the class!
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
Interesting indeed. My conclusion: people have to check the internet to find what's wrong with Windows more often than people have to check to see what's wrong with Mac or Linux.
Or, better yet, just don't run as an administrator. It's rather unfortunate that the installer for XP creates an administrative user (in addition to "Administrator"), but it's quite easy to correct this and run as a standard user.
Perhaps given a sample size of two - the other of which is IE 6 on XP. There are a lot of web browsers out there, from lynx up, on a lot of platforms which do not fall victim to this or many other problems - mostly due to a lack of active-x which even a librarian warned me was a major mistake prior to its introduction. It is easier to point out a shortcoming in the Microsoft product than to advocate absolutely everything else.
And why is this news? Or is this a repost of what we've seen a hundred times before? Just once I'd like to see the headline "Windows declared safe to use for the next 24 hours".d _hot_chili_peppers.php
http://lyricslist.com/lyrics/artist_albums/425/re
It is dangerous to be right when the government is wrong.
MSXML4 is NOT part of Windows, so the article is written by a troll MSXML4 is NOT part of Windows, so the article is written by a troll MSXML4 is NOT part of Windows, so the article is written by a troll MSXML4 is NOT part of Windows, so the article is written by a troll MSXML4 is NOT part of Windows, so the article is written by a troll
Don't you mean: AAAAAAAAA! instead?
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.