Slashdot Mirror
Third Microsoft Word Code Execution Exploit Posted
gregleimbeck writes "Exploit code for a third, unpatched vulnerability in Microsoft Word has been posted on the Internet, adding to the software maker's struggles to keep up with gaping holes in its popular word processing program.
The attack code, available at Milw0rm.com, contains sample Word documents that have been rigged to launch code execution exploits when the file is opened."
anyone else?
Try saying that fast three times.
But seriously, why would anyone use anything M$ when there are non-stop bugs and security holes. Open Office / Google Writely anyone?
I always suspected that Microsoft Word was Turing-complete.
Format the Page the way it was meant to be SIMPLE! I mean its JUST WORDS put together why the need for Super Secret imbedded code? Word Perfect did this with precision .
I tried to open the PoC with OpenOffice 2.0.4 and it crashed. Can someone confirm?
/usr/lib/openoffice/program/soffice: line 236: 12793 Segmentation fault "$sd_prog/$sd_binary" "$@"
ooffice2 12122006-djtest.doc
This may not be a code execution bug; I'll try to trace it with gdb to see what happens.
Ads? What ads?
Someof these bugs can penetrate macs, but is there an actual exploit the pentration on macs? For just one or all three?
Are these fully macro virsues or are these actual binary executables being injected?
If we have binary executables being injected by some sort of buffer overrun, then I wonder what happen on intel macs. Does the exploit inject i86 code or ppc code. Does Rosetta run the PPC injection or does the i86 injection run on it's own.
Some drink at the fountain of knowledge. Others just gargle.
Who the fuck got this past whatever committee was reviewing design specs, and why haven't they been clubbed to death like a baby seal?
When the entire OS relies on the last three characters of a filename to handle filetypes, did nobody think this was a bad idea?
there is add for TechNet Security Center on that page. mspx
http://www.microsoft.com/technet/security/default
Fairly alarming that a simple document meant to basically contain text, can launch code on an OS.
How long before someone turns this into an actual feature? Open an attachment in an Email, and launch an app to install something on the machine imbedded in the email itself? I could almost see this as usefull in a business atmosphere.
Just dont sign me up to work in their IT department. Oh god the horror that could (would) cause.
Some drink at the fountain of knowledge. Others just gargle.
I did. My brain went blue screen and shut down. My attorney will be in touch.
but what can you do with a box running that crap ? :D
....
/usr/lib/openoffice/program/soffice: line 236: 12793 Segmentation fault "$sd_prog/$sd_binary" "$@"
ooffice2 69-crasgtest.doc
Enough said...
What exactly does Microsoft suggest that I do with Word files? Besides using them to fragment my hard-disk? Maybe I can burn them to keep warm in the winter... um, no.
Or perhaps I'll just use Word to create and save HTML files!!
"I see that you are trying to craft an exploit. Would you like me to assist?"
So, the only question is, when will OpenOffice finally support this new feature?
Read them straight off the hard disk with your bare eyes. Obviously.
- There did not exist a credible alternative to Microsoft Access. The integrated database application is not friendly at all and leaves a lot to be desired.
The whole suite feels heavy to a user with an average system. Sadly, I agree with him. OpenOffice really needs more love. It's one thing to make a free office suite available but it's another to actually get users to use it.It's my hope that the developers will see this and create a suite that people can use. Most of them have used Word-Perfect or Microsoft Office and should not find it hard to see what we are talking about.
This goes under the category of basic internet security. Don't open files from people you don't know. And if you do get a wierd file from someone you don't know stop and think for 10 seconds about it before you open it. Or, buy a mac.
Biggest problem with this sort of exploit, is it gets under the radar of people who actually know not to open executables etc that are sent to them - but a document? Unless they are aware of this emploit being "out there" people will recieve an email with "teh funny.doc", "invite to my birthday.doc" or "pics of brittany + paris.doc" and double click without thinking. Boom - instant zombie machine.
So all those family, friends and colleagues who you've (finally) trained not to open funny.exe or funny.scr are all vulnerable to this little beauty.
http://en.wikipedia.org/wiki/Milw0rm
milw0rm is a group of "hacktivists" best known for penetrating the computers of the Bhabha Atomic Research Centre (BARC) in Bombay, the primary nuclear research facility of India, on June 3, 1998. The attack generated heated debate on the security of information in a world prevalent with countries developing nuclear weapons, the ethics of "hacker activists" or "hacktivists," and the importance of advanced security measures in a modern world filled with teenagers willing and able to break into insecure international websites.
Upside:
Familar user interface
Fast
Cheap
WYSIWYG
Downsides:
Replacing blocks of text with larger-sized blocks of text difficult to impossible.
Cut-and-paste is messy, literally.
No automated search.
My Word Processor
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
From TFA:
So yet again it's a case of embedded code within a data file wreaking havoc. And as already been reported in comments here, this vulnerability also exists in OO.org.
Seeing this kind of thing always blows my mind. I would be greatly interested in hearing the rationale behind the decision to incorporate this feature. What the hell did they need that for?
I hear there's rumors on the Slashdots
Why all these exploits now with applications that have been around for over seven years ??!!
I mean if the latest version of word had a newly discovered bug, ok...move along, nothing to see here...
But an exploit that can affect all three version of word (2000, 2002,2003)??!!
Oh sorry, up to three now aren't we....in the same month....
I smell a rat...
And I'll notice the Tail when Word 2007 is declared void of these exploits..
Call me paranoid, but at least just call me...
I'm glad I no longer work as MS Phone Support....
Cheers
End of Line.
well then it's a good thing I don't download word documents ever :P
n/t
you had me at #!
At last! A reason to tell my IT department to fork out the money for upgrades to Office 2007 when it comes out due to it's "security". If they use the same line that the UK government does to sell ID cards, biometric passports, "it's safer", MS are sure to make more cash!
I run MS Word under Crossover Office so I can't see what the exploit is supposed to do:(
So would somebody be so kind to tag it as "yawn" instead of me? Thanks in advance. Maybe it would be useful to make a section "Holes and malware", put Microsoft in a front of it, create columns for each of its products and just adding crosses (dots, lines, whatever) for every new one. Dangerous ones could be red and clickthrough to Secunia or MS security page.
Troll 2.0 Fear my asocial networking!
as is the case on many machines out there.
I wonder if a properly crafted email could launch this one simply by clicking "Reply". Insights, anyone?
abiword opens it as a blank file with a funny page dimension
Openoffice complains about not enough memory to open the file and doesn't even try to open it
Snowden and Manning are heroes.
Good luck trying to get pixel-perfect interoperability between MS Word and OOo. I can't even get OOo to interoperate with itself.
I was using OOo on my Linux (Kubuntu) system to make a Christmas card, embedding a picture and positioning the text so that I can print it out and then fold it into a Christmas card. But I don't have a printer hooked up, so I had to move it to OOo on my wife's Windows (2000) box to print it. But the text had mysteriously resized itself so that it no longer fit properly and spilled out off the page.
WTF!?? Both the Linux and the MS Win box use OOo v2, with the OpenDocument format. (I ended up having to export to PDF.)
This OOo is getting to be quite a kludge. I can't wait for them to go the Mozilla route and toss out the entire codebase, rewriting the whole thing from scratch.
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
Wordpad opens
Gee, I wonder why nobody designs exploits for MICROSOFT Wordpad or Notepad? Hmmm, I wonder? These are the two text editors I use the most, yet there are never any exploits for them and the are both microsoft products. (Also, I have yet to see an exploit for MS-DOS edit or XyWrite for DOS)
I'm sure with a little effort I could construct text files that will crash vi/vim. What's the big deal? So someone has a hate on for Microsoft and has too much time on their hands to spend on creating exploits for MS Word. Whoopee doo! I'l get back to work on my windows system, unaffected by this as with every other "Microsoft security hole".
And don't say WordPerfect or OpenOffice, those pigs are just as bad as MS Word, I'll stick to notepad, wordpad, ped and vim thanks. (Though I'm sure I can construct files to crash any of them, in fact I'm sure I can construct files to crash any application on any platform - who the fuck really cares?)
Uh if that happens then the language used is obviously unsafe.
The language isn't "unsafe" - it just lets you do some very, very nifty stuff that noobtard programmers are better off leaving alone.
C++ has perfectly "safe" features - the Standard Template Library has container classes like strings and vectors that won't overflow no matter how careless you are.
For those who insist on going down to the byte level and concatenating their strings themselves, Microsoft included "safe" versions of these functions in Visual Studio 2005, and will compile with warnings if you use the dangerous, buffer-overrun-producing variants.
Why should potentially arbitrary code be executed because a program tries to put data somewhere it won't fit?
Because a hacker's input and a programmer's overconfidence in his manual input validation (or lack thereof) put the hacker's code over the program itself. It fit just fine where the still-running program used to be.
This can happen in any language - C++ programmers are simply notoriously bad at input validation.
DATABASE WOW WOW
Why can't text documents be filtered when they're loaded? Grossly oversimplifying the idea here, but can't you just run the document through some simple sequential reading routine, strip out what isn't text, and then finally store what remains into memory a byte/word at a time? And set that memory range as non-executeable (don't modern MMU's/CPU's do this?) before you start loading.
And if the document did contain invalid data, warn the user that the document is corrupt (or some other equally non-threatening term that implies an invalid but possibly displayable file) and offer them a chance to discard what was loaded. Sure everyone will just hit the "Continue Loading" button anyway, but that's ok - the document has already been filtered. All that's left, ideally, is good old-fashioned 7-bit ASCII text.
Yes it would be slower that using some sort of kernel block-load function, but it would also be safe. I don't know how you'd go about handling Unicode or stuff like UTF-8 (maybe translation tables?), but surely someone could figure out a similar solution.
I recognise the need to allocate memory before loading a document, and I don't see that being a problem with a filtering scheme.. sure, there would be some wasted memory should the document end up shorter once it's loaded (because something was filtered out), but who cares? We're only talking a few hundred K tops, probably far less (I'm not a virus/exploit coder, so I don't track stuff like that).
As for mixed-content documents like text+images, there's nothing that says you have to only have one filter that's good on the text portions - use additional filters to constrain the data being stored to valid images/sounds/whatever in addition to text.
Binary formats like MS .DOC? Well...tough one there, you'd probably have to interpret the document as it's being loaded, into something reasonably non-dangerous like XML or something, throwing out whatever you run into that's not valid data for that format.
I paid for downloading office the hard way!!
In fact, pushdown automatons ARE Turing-Complete, so EMACS is not that better :P
* ducks *
Aha, so you have found thee nam-shub of Enki. Please inform the cult of Asherah.
Being bitter is drinking poison and hoping someone else will die
....and quarantined the .doc demonstration file. Not much of a zero-day exploit....
Does NX cause Word to crash instead of run a worm with this exploit?
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
"Data used by Microsoft Word to construct a destination address for a memory copy routine is embedded within a Word document itself."
If this is a standard practice at Microsoft, I'm beginning to understand why they are so relunctant to publish their protocols and standards.
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
Fucking hell, man...if your attitude is anything to go by, no wonder the majority of open source software sucks in comparison to commercially produced alternatives. You have to understand that the vast majority of people use computers to *get things done*, and when they're not getting things done they want to have fun. Fixing other peoples bugs, implementing missing functionality and writing their documentation doesn't fit into this equation, which is why most people are willing to pay for (ok, often pirate) commercial software. "put up with the shitness or fix it yourself" is an appalling attitude, but it seems to be what you're saying.
+100. I've been there too. Forget about simultaneously editing document on more than two computers. (In fact same goes for M$O - though overall compatibility/portability is much better.)
I would love it just to work, but at moment PDF export is only way to have portable (in read-only sense) document.
All hope abandon ye who enter here.
Guys, also crashed Google docs :)
c
try to upload the file to google docs and you'll see a Server Error
http://www.milw0rm.com/sploits/12122006-djtest.do
Why is there both a bugs and a Microsoft tag on this article? isn't it rather redundant having both tags?
Given Microsoft's apparent priorities. Someone could take all three Word exploits from the wild. Then rewrite them to bypass/disable Windows Media Player DRM. That would get Microsoft's attention. Do that and Microsoft will have a fix in only a little more time than it takes open source to make a fix!
Behold, the dangers of Microsoft wetware.
There is no mod option "-1: Disagree" for a reason. "Overrated" is not an acceptable substitute. Post something instead.
A few reasons:
.NET, and a few other apps you've already spent $1,000 on that new computer you were going to build... and you don't have any parts yet.
.NET applications. They only run (reliably) on windows.
1) $300+ for the operating system and license. OS X Tiger is $129 for a single license, and Linux is free. If you buy Windows, MS Office, VS
2) Proprietary formats -- like WMV's and
3) Security issues. IE will probably *always* be a security risk because it is tied to the OS so deeply. MS releases so many patches to their operating system because it was poorly (and insecurely) written.
4) Internet Explorer -- Not just because of security issues. When I install windows, I have a piece of software installed that I can't uninstall, and that so many applications rely on. Its HTML rendering isn't up to W3C specs, which forces web authors to "hack" for their pages to display properly.
Thanks for the info.... when did you go live as Microsoft's bug database?
Seriously, this isn't "stuff that matters"... If it is, why don't you post open source bugs every time they are discovered? Are you saying open source doesn't matter?
I'd like to agree with you, but my experience from following a number of bugs suggests otherwise. All of these are quite old, and prevent OOo from being much more useful than it presently is. Take the word-count issue, for instance: just about everyone I can think of that makes a living by writing absolutely fucking requires an accurate word count, configurable for different counts -- such as only the selected text, all text minus footnotes, all text everywhere in the document. And yet OOo does not seem to provide this. How blooming difficult can this be?
Chinese, Japanese, and Korean (CJK) support in this area is completely non-existent. OOo is aware of double-byteness at some level, so why can't it discern CJK text from other types? Take the seventh paragraph from this page in Chinese as a good example. OOo seems to think the text has 7 "words" and 60 "characters". WTF is a "word" in this context? If I were to stretch the rules and actually count the Chinese words, I'd get something like 26, not 7. Hmm. But then, Chinese writers don't count words, they count characters (not including spaces). But then, OOo's "character" count is also useless in this regard, as we can't tell if this 60 "characters" includes spaces or not. Moreover, a lot of editors insist on having the Chinese character count and European word count -- this sample text includes two English words, so 60 "characters" here is beyond useless. AFIACT, no one dealing with CJK languages can use OOo exclusively for their business needs. And given a potential Chinese userbase of around a billion, that's a glaring shortfall.
Given that all of the bugs linked to above are easily handled by MSO (and if memory serves by WP), and that they have been languishing in OOo's bug tracker system for several years, I can only conclude that OOo devs either just don't give a shit, or that they are woefully ignorant of the competition's capabilities. I suspect it's a combination of the two -- coding this kind of functionality just isn't as sexy or fun as some of the other stuff, and so it's allowed to linger. And if this tendency continues (which is looking more and more likely as time passes), OOo will whither on the vine.
Forgive me, I am actually a bit bitter about this. I haven't the coding skills (nor time to acquire such skills) to help, or I'd just fix these damn issues myself. OOo is so close to useful. "OOo -- It's almost a good idea!" (TM) And therein lies some very intense frustration on the part of the OOo would-be userbase. Ah, well...
"What in the name of Fats Waller is that?"
"A four-foot prune."
no/t
you had me at #!
It seems as though we are supposed to stop business it is preposterous for many offices to be told not to open any word files. I know that there are other word processing programs and notepad, but ask yourself this: "does your company respond fast to technological changes?". Its simple there are some people in the company who will not be able to make a drastic change very quickly. You can however send an email to a friend call to confirm that the email is legit and not a bot sent version. But that removes the conveniences of email in itself. I wrote a blog post (http://www.iwantmyess.com/) about how you can circumvent the calling in confirmation. Michael