IE 7.0/8.0b Code Execution 0-Day Released

SecureThroughObscure writes "Security blogger and researcher Nate McFeters blogged about a 0-day exploit affecting IE7 and IE8 beta on XP that was released by noted security researcher Aviv Raff. The flaw is a 'cross-zone scripting' flaw that takes advantage of the fact that printing HTML web pages occurs in the Local Machine Zone in IE rather than in the Internet Zone. Quoting McFeters's post: 'This is currently unpatched and in all of its 0-day glory, so for the time being, beware printing using the "print table of links" option when printing web pages.' McFeters and others will be presenting at Black Hat on the link between cross-site scripting and cross-zone. Rob Carter has been hitting this hard over at his blog, pointing out cross-zone weaknesses in Azureus, uTorrent, and the Eclipse platform."

Comments

0-day

[Anonymous Coward]

0-day? This term seems to have lots all meaning. Could we please stop using it?

Re:0-day

[tyler.willard]

No. It wasn't.

The whole "day thing" is about the time between disclosure and patch/signature release. Disclosure starts the clock: Day-1. Day-0 is for talking about the day before disclosure.

A Disturbing Trend, But Not Unforeseen...

[blcamp]

The more complex the software releases become, the more complex and insidious the exploits of them become also.

Proof

[morgan_greywolf]

This is proof of what I've said from the beginning -- the whole concept 'zones' in IE is stupid and pointless. Scripts should be allowed only what you allow them, period. You should be able to give permissions down to the individual site (ala NoScript) or even down to the individual script.

Re:Proof

[ScentCone]

You should be able to give permissions down to the individual site (ala NoScript) or even down to the individual script.

Look, for most people, the zone idea actually makes sense. Basically, don't trust ANY web site to do the tricksy stuff, but add (for example) your company's intranet to the safe zone, where it can do more desktop-ish stuff. I don't think that's such an awkward concept, and it spares people from having to think through what to allow, or not, on a site by site basis, as they surf. Most people are not this audience. And being able to enforce zone policies at the enterprise level makes a lot of sense, since average users are routinely shown to be spineless and witless: they'll add a poisonous Russian casino spam site to the safe list if that site pops up a tutorial on the steps the have to take to do so, if they want their free emoticon package.

Fiddly, granular systems only work for fiddly, granular people.

Re:Proof

[morgan_greywolf]

Pffft. So tell me-- why when I browse a site in the "Internet-zone" and then print a table of links, does that function run in the 'Local Zone'?

I'll tell you why: because it has to. You can't access local devices in the Internet Zone. That's the point. Granular approaches would allow you to print without accidentally giving other permissions to something that shouldn't have them.

At the enterprise level, with something like NoScript, you can just allow entire domains, say intranet.example.com or whatever your organization uses.

Next thing you're gonna tell me is that you think Microsoft should do away with ACLs at the individual file level or even the directory because users are just too stupid to figure that out. They should just have "file zones" and people will just have to stick their files in the right zone. Pffft.

Re:Proof

[Manip]

IE or any other modern browser on the market.

You would also have every web developer in the marketplace whining about how IE ignores standards if they pulled the plug on scripting.

Sorry but Zoning in IE is fine. IE 7 is actually a pretty good modern browser and, sure, it isn't perfect but frankly what is?

Re:Proof

[Penguinisto]

Having actually used the 'Zones' concept recently on IE, I gotta say - it needs work. LOTS of work. The first time someone wants to diddle with a MySpace app and discovers that it won't work until you basically ratchet down the settings --often by hand in the advanced options--? Then couple that with the fact that many websites can pull in parts and content from multiple domains, requiring permissions to be set on each and every one? The whole thing would go out the window and the user would promptly ratchet down the whole WWW.

The concept itself is okay, but the implementation could use a good, solid overhaul.

/P

Re:Proof

[CastrTroy]

And for IE the defaults allow special permissions to your entire intranet. By default all the permissions should be low. There's no reason to grant higher permissions to the entire intranet. If you need something like that set up at your organization, you should have to enable it per server, or per domain.

Re:Proof

[MobyDisk]

People just need to stop using web browsers as a way to control the desktop. If you are in a domain, then the domain administrator can push executable apps, policies, and commands down to the computer. HTML, Javascript, and ActiveX are not tools for administering networks.

Also, having developed desktop applications that used embedded IE, I can tell you the zones system is completely screwed-up. It changes in every version, the APIs are inconsistent across different Windows OS's, and there are crazy loopholes with magical URLs like res:, file:, about:. Then there's exceptions for files on the local hard drive, on the network, on mapped-drives. It's a total mess. All of it really just to support some stupid extensions to Javascript, VBScript, and Microsoft Office - that should never have been added in the first place.

Re:Proof

[knarf]

While it may be true (and it *better be true*) that untrusted zones can not directly touch local devices the question still remains why there is any processing being done on data from a lower-trust zone *inside* a higher-trust zone. That is the wrong approach. Had they formatted the document to be printed inside the lower-trust zone and handed a formatted document to the higher-trust zone (in whatever format is used to print documents: metafile, postscript, etc) to be printed this problem would not have occurred. That is, given that the print spooler does not goof up with the data to be printed of course...

Re:Amazing

[CastrTroy]

Even if you did know about the feature, I'm not sure of it's usefulness. Saveing a spreadsheet of links might be useful, but printing them out? Most URLSs are pretty hard to type back in, and wouldn't be all that useful on paper. Look at the url I'm no right now.

http://it.slashdot.org/comments.pl?sid=555236&op=Reply&threshold=1&commentsort=0&mode=nested&pid=23432544

Why you would want that printed out on a piece of paper is beyond me. It might possibly somewhat work on a PDF printer, but even then, it's use is limited.

Re:Amazing

[Penguinisto]

Actually, I could see uses for it - but mostly for web designers as an audit tool, and for corporate security types who want to gin up a list of naughty links with which to show the employee and his/her boss.

Now for a real use? Well, maybe one. To save having to scribble them down, you could waste a couple reams of paper printing out, oh, maybe a dozen MS Sharepoint links to an overly-anal supervisor who demands that you include reference links in a printed report.

/P

Re:Irresponsible disclosure

[reset_button]

Is it better to keep it secret until a patch comes out and hope that nobody else has discovered the vulnerability, or publicize it and let people know not to use this IE feature until it's patched?

Re:Irresponsible disclosure

[benjymouse]

In a word? Yes. Ask Mozilla.

Re:Irresponsible disclosure

[Anonymous Coward]

The vuln. is probably real, but Aviv Raff notified Microsoft the day before he went public with a "treasure hunt" for this bug (celebrating Isreals 60th birthday); thus the fact that it's a 0day vuln. is entirely his doing. Way to go.
Yes, as always... blame the whistle blower not the manufacturer of the crap product.

*feeds the troll*

[Animaether]

Nobody is blaming Aviv for the existence of the bug. Nobody is blaming Aviv for telling people about the bug.

We *might* be blaming Aviv for telling the world, script kiddies and botnet operators alike, about this bug -before- even notifying the manufacturer of the crap product.

Nor did Aviv wait a reasonable time period for the manufacturer to admit their product's crap state and issue either A. a warning of their own (don't print links) or B. a fix, while providing full credit for discovering the bug to Aviv. Aviv could then still parade his bragging rights around, disclose the exact details, provide proof-of-concept and generally be admired for re-affirming the notion that the product is crap and telling the world in a responsible manner.

Yes, I know, in the time that Aviv would be waiting for the manufacturer to issue a warning / a fix, there could be *others* who also have figured out this vulnerability, and could be actively using it, perhaps on your computer right now! don't look! But given the odds of maybe a handful of people using this for targeted operations vs thousands of script kiddies at work, I'll take my chances with that handful of people in that time period.

Oh, and I consider 3 days to be sufficient a time period for any manufacturer to respond, so anybody who felt like showing how it sometimes takes a manufacturer YEARS before fixing things can just bugger off. I have nothing against disclosure if the manufacturer takes too long - forcing their hand may be the best thing. But having them caught off-guard and scrambling by flat-out announcing it to the world is far more irresponsible than the alternative.

imho.

Must we highlight every bug in IE?

[Anonymous Brave Guy]

I appreciate the desire to raise awareness, but there's no practical benefit to running this story other than Windows bashing. It'll get patched, the patch will probably ship on some future Tuesday given this is a feature few people use and the risk of exploitation is relatively low, and that'll be that.

In contrast, a far more dangerous bug in the openssl package used by Debian and its derivatives was discovered earlier this week, and doesn't seem to have made the Slashdot home page at all, even though it's probably relevant to a lot of the Slashdot readership and there is real action they can take to fix things. Go figure...

Re:WTF is a "0-day" ?

[OneSmartFellow]

From the Wikipedia article cited

A zero-day (or zero-hour) attack or threat is a computer threat that tries to exploit unknown, undisclosed or unpatched computer application vulnerabilities.

So, it's a newly discovered exploit. Can't we use that phrase instead of the uber-lame "0-day"