Word 2007 Flaws Are Features, Not Bugs

PetManimal writes "Mati Aharoni's discovery of three flaws in Word using a fuzzer (screenshots) has been discounted by Microsoft, which claims that the crashes and malformed Word documents are a feature of Word, not a bug. Microsoft's Security Response Center is also refusing to classify the flaws as security problems. According to Microsoft developer David LeBlanc, crashes aren't necessarily DoS situations: 'You may rightfully say that crashing is always bad, and having a server-class app background, I agree. Crashing means you made a mistake, bad programmer, no biscuit. However, crashing may be the lesser of the evils in many places. In the event that our apps crash, we have recovery mechanisms, ways to report the crash so we know what function had the problem, and so on. I really take issue with those who would characterize a client-side crash as a denial of service.' Computerworld's Frank Hayes responds to LeBlanc and questions Microsoft's logic.'"

Comments

Re:Let me see...

[Ckwop]

owever, he has not yet found a way to exploit that overflow because Word keeps crashing. Microsoft says that the crash is preventing any security hazard, and therefore there is none.

The Open BSD guys have a philosophy: "The only difference between a bug and a vulnerability is the intelligence of the attacker."

I wish more programmers held this view! A bug is an undefined state of the program. It's quite clear that this is a dangerous position for your program to be in. Bug really are baby vulnerabilities. It's best to remove them as soon as you find them.

Simon

Re:Let me see...

[kebes]

I totally agree that calling this a security flaw or DoS is silly. Until it is actually used to exploit the program, it's not a confirmed security flaw.

However using bad documents to crash Word is still a flaw in Word, in my opinion. The application should just say "Can't open bad/corrupted document" and let the user keep working. In the blog he says:

The theory is that it is better to crash (at least with client apps) than it is to be running the bad guy's shell code.

I understand the rationale, but I would argue it's rather sloppy programming that uses a crash as a means to prevent such bad things from happening. Exceptions can be thrown, but they should be caught and used to halt the "bad actions", and revert back to a normal program state.

Obviously it is better to crash than to execute arbitrary enemy code. However it's better still to just refuse to execute arbitrary code, but otherwise keep running. The problem with using crashing as a security system is that then the "bad guys" will try to crash your application on purpose (calling it a DoS is a stretch, mind you), which opens up new security problems. (A crashing app may expose other security vulnerabilities, disclose otherwise protected information, destabilize other apps/the OS, etc.)

Taking a page from Apple... literally

[PCM2]

The old Apple ][ Reference Manual included a few pages of technical terms, with definitions. Buried among entries like track, sector, stack, and interrupt was this gem:

feature n. A bug, as described by the marketing department.

Re:I don't see the problem

[qualidafial]

During the last EclipseCon, Hugh Thompson (of in-flight Tetris crashing fame) showed us a hack in notepad discovered using fuzz testing. Open up a fresh notepad and type in the words, "this app can break" (without the quotes). Then save the document to file, close notepad, and double-click the file you just saved to bring it back up in notepad. Everything will appear as squares. Not a major exploit, and definitely not a DoS, but kind of interesting.

Apparently that specific line of text exploits the way that notepad determines whether the file is encoded in ASCII or Unicode.

Re:Let me see...

[misleb]

The point is that a malformed documented shouldn't throw a word processor into an unrecoverable state. That is a bug. I don't know whether or not it is a denial of service attack. That is debatable, but not properly handling an exception in a document is definitely a bug. A word processor can simply tell the user, "hey, this document is fucked, I can't open it." If it just crashes, the user could possibly lose data in other open documents. And that is a Bad Thing(tm).

-matthew