MS Plans Emergency Update to Fix .ANI Bug

A feed from The Reg says"Widespread exploitation of an unpatched Windows vulnerability involving cursor animation files over the weekend have prompted Microsoft to announce plans to release an out-of-sequence patch on Tuesday MS plans emergency update to fix blinking cursor bug."

Comments

possible workaround

[slyxter]

Wouldn't setting your own .css file in IE's accessibility options work for this. Just set the .ani to something safe and that should override any website's settings.

Re:possible workaround

[_xeno_]

Yes, but not quite the way you say - you'd want to override the cursor on all elements.

The CSS override would be fairly simple:

* { cursor: text !important; }
/* The next rule returns links to being the little hand cursor: */
a { cursor: pointer !important; }

That overrides the cursor on all elements. The !important is important - the user-specified stylesheet is by default overridden by local pages. However, pages can't override !important rules in the user stylesheet.

However, I have not checked to make sure that using that stylesheet will actually prevent IE from downloading the cursor. For all I know it will still attempt to download the cursor anyway and still be vulnerable.

i wonder what kid released the poc and away we go!

[Anonymous Coward]

often this happens because some person released a working example
for windows XP or what not. then a loser or three use this code
to arm their worms. remember, the worm is written many times over,
they just wait for 0day. they do not code anything, but cut and
paste.

who and where is the code? lets thank them for their hard work :-(

It's more serious than just "blinking".

[Opportunist]

It's a buffer overflow that allows you to execute arbitrary code. Much like the WMF exploit a year ago. But more serious. I have a sample here that opens a program just by browsing (with the explorer) into the directory that contains it.

Nasty sh.t. Even downloading and wanting to dissect it with some disassembler is already enough to set it off, the moment you use the open dialog of your dis.