Slashdot Mirror
Oops! Missed One Fix — Windows Attacks Under Way
CWmike writes "Microsoft says attackers are now exploiting a critical Windows bug that it didn't get around to fixing in its biggest batch of security patches in more than five years, issued yesterday. Microsoft said that 'limited and targeted' attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter, a tool included with all versions of Windows. If Microsoft patches the WordPad problem on its monthly schedule, the first opportunity for fixing the flaw would be Jan. 9, 2009." Update: 12/10 22:28 GMT by T : OK, there might have been more than one: reader Simon (S2) writes "There is an even more serious flaw ... From SANS: 'There is a 0-day exploit for Internet Explorer circulating in the wild. At this point in time it does not appear to be wildly used, but as the code is publicly available we can expect that this will happen very soon. This is a brand new exploit that is *not* patched with MS08-073 that was released yesterday. I can confirm that the exploit works in a fully patched Windows XP machine. The exploit is a typical heap overflow that appears to be exploiting something in the XML parser.'"
How can code in the wordpad text editor leave a machine vulnerable? Can someone explain this in a way that's not super technical? Faulty code in a browser, or similar, I can understand.
Holding back your zero day exploits until directly after the MS Patchday...if your bug hasn't been removed, then you have up to a full month of time to abuse it.
Clever.
Pffff. What could possibly happen in only a month?
This guy's the limit!
From the article (i know I know, slashdot...), Windows XP SP3, Vista, and Windows Server 2008 aren't vulnerable. I didn't read how the exploit actually works to see if it can realistically be used to attack Windows Server 2003 (which is quite popular), but for people at home, if your machine is up to date, you're fine.
So seriously, whats the big deal?
I will shortly be posting more details on this exploit in Wordpad format. Stay tuned!
Are .rtf files now unsafe on Windows?
Send a specially crafted word document (i.e. code embedded) and trick the user into opening it with WordPad (i.e. using the .wri file extension).
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
Its not remotely exploitable. From the article, a user has to open a maliciously crafted file. So its just the fairly typical exploit where a document viewer poorly handles documents it can open.
It needs user interaction to work, someone has to open a file that they don't trust (I guess it MAY be possible to trick a user into opening the file from the web, since there is a Word viewer that potentially use the same file converter that is responsible for the exploit).
Also, XP SP3, Vista and WinServer 2008 aren't vulnerable at all.
If you had read the article you would know that a specially crafted file with a Wordpad-associated extension is required. Notepad is next ;-)
How do you even make a bug there, it's a CS students first year project to make a text editor?
It is a text editor but it can open Word 2002 files. Word files are binary executables, so Wordpad has to be able to launch an executable. The exploit here is a malicious, executable file that when launched, runs and infects the system.
Here be signatures
IIRC Wordpad can handle some embeded objects in .rtf (and other??) files. I'm guessing the exploit takes advantage of a vulnerability with one of those embedded types or the handling of them.
Just a guess, and I'm posting before reading.
"do you send them a malformed .txt file?" .txt files.
Yes.
Windows 2000 and I think some versions of XP had a way to get a BSOD using type and a malformed text file so why not?
Actually I think you have to send a malformed DOC or RTF since it is in the file converter utility but I am not sure.
Doesn't effect me since I have OO for docs and RTF and Notepad++ for
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
Microsoft said that the WordPad converter bug requires some help from the user, who must be tricked into actually opening a malicious file -- most likely delivered as an e-mail attachment.
Apparently it has to do with the conversion process, and-once again-requires a little bit of help. Following the basic precautions that keep you out of most malware-related problems will (hopefully) keep you out of trouble on this one, (don't open e-mails from senders you don't know, etc.)
Word files are not binary executables. They are (pre OOXML) binary file formats. I don't know what the exact exploit is (probably some sort of buffer overflow) but the idea is to craft a Word document such that it contains executable code and exploits the flaw in wordpad that causes the executable code to execute.
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
This type of bug relies on "glitches" in the memory management (simplifying it a bit...) of the program, not on any high-level misses in the actual mechanisms of the code. Any program written in a programming language without automatic memory management can be exploited in this way, if the programmer "misses his step" somewhere. They can also be devilishly hard to find, because data can be structured and handled in memory in very complex and abstract ways.
It seems this has been going on forever now. The most high-profile cases where the excel bugs a while back.
1. Fuzz MS file format handling code until bug is found.
2. Develop exploit, and mail infected files to high-profile targets.
3. ???
4. Profit!
When you're running everything as root, everything can be exploitable. And it looks like this is a character set or file format converter, which is considerably more than simple typing and copy/paste (the extend.) From the Security Focus page (disucssion tab), it looks like it could be a buffer overflow ("prone to a remote code-execution vulnerability because of...corrupted memory.")
The info page shows that it does indeed affect Server 2003, one of the more populat versions out there, as noted by another comment
People know not to open executable files (.exe) and even for more obtuse executables (.scr, .cmd) most systems and mail clients are smart enough to warn that it's executable content.
For data files like .jpg or .wri, neither the user or the system probably consider the file dangerous. So these type of exploits should be considered more dangerous than the completely-idiotic "e-mail people virus executables".
Especially considering many of these viruses propagate through address books (ie: trusted contacts)
But yes, at least it's not a completely automatic remote exploit.
Like the 'Bush hid the facts' bug?
The flaw is in the Wordpad Genuine Advantage Authentication Service. A port is left open by the service that can be used to exploit the system as wordpad and the WPGAA service require system privileges.
(!true)
My bad.
From en.wikipedia.org/wiki/Visual_Basic_for_Applications:
By embedding the VBA IDE into their applications, developers can build custom solutions using Microsoft Visual Basic. It was also built into Office
Office documents can contain Visual Basic code, so when executed by Wordpad...
Here be signatures
Here's a fun one: Create an empty file (empty new txt file will do), rename it boo.com, select it in Windows explorer, press the delete key.
Is tricking users into opening malicious ASCII pr0n files with .wri extensions.
Wordpad does not have the capability to execute those macros, because it does not have an embedded VBA interpreter. The macros are binary gibberish without the VBA runtime, much like a Perl file is just text without the Perl interpreter.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Maybe Wordpad uses the non-Win32 dlls or something? Could that make some not needed functions accessible by it?
Here be signatures
"Windows XP SP3, Vista, and Windows Server 2008 aren't vulnerable", Shados That's two out of four not affected ..
.. If exploited, a hacker could gain the same rights on a PC as a local user and could remotely execute code'
'Impact: Execution of arbitrary code via network, User access via network'
"I didn't read how the exploit actually works to see if it can realistically be used to attack Windows Server 2003", Shados
'"limited and targeted" attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter
http://www.cio.com/article/470080/Another_Microsoft_Bug_Revealed_on_Huge_Patch_Day http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9123100
davecb5620@gmail.com
Control Panel - Folder Options - File Types - WRI - Edit - Open - Change to Microsoft Word.
Problem solved.
Next!
Windows is Exploitable. oooh, BIG surprise. They missed one, just like the bazillion before it that they just now fixed, and the bazillion after that they will fix as people figure them out. Then again, there is the, do-it-yourself e-mail viruses "Please delete your system.ini file. Its infected! All windows systems have this critical error and your private information is stored inside. Instead of coming out publicly with this easy fix, I've forwarded this e-mail to you to tell you the dangers of the system.ini file. " A windows user is a virus! Quarantine them all!
Not according to the article. From the second paragraph:
In an advisory posted yesterday, Microsoft said that "limited and targeted" attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter, a tool included with all versions of Windows. The flawed converter handles Microsoft Word 97 files on Windows 2000 Service Pack 4 (SP4), XP SP2, Server 2003 SP1 and SP2. Newer versions of Windows -- XP SP3, Vista and Server 2008 -- are not vulnerable to the bug, however.
My preferred name is frazz, but someone keeps taking it. If you see him, tell him I said hi.
'I keep on getting pop-up messages from the packagekitd: "Update Applet Failed to reset client"'
.. :) It was posted at 10:22 and the responce at 12:23 ...
You must be the only one, I googled on it and got only the one hit
"Fedora Core people, are you listening ?!"
Was it you that posted the question ?
davecb5620@gmail.com
You mean all someone has to do is click on an attachment called "biggest breasts ever.wri"? Oh, NOBODY would be that dumb!
-- Wondering how long until the internet becomes fully corporatist, like television.
It's probably the buffer overflow condition that Java Pimp described.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Nothing happened...
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
No. Someone has to click an attachment called "biggest breasts ever.wri" while, at the SAME TIME, running a non-updated version of Windows, Windows 2000, or Windows Server 2003. You reduce your attack vector by a significant amount here.
0-day for Internet Explorer v.7 is in the wild and was not patched yesterday
http://isc.sans.org/diary.html?storyid=5458
http://www.vupen.com/english/advisories/2008/3391
http://www.theregister.co.uk/2008/12/09/zero_day_ie_flaw_exploited/
Go to Fedora's Koji site (http://koji.fedoraproject.org/koji/) and download the dbus 1.2.8-1, PackageKit 0.3.12-1, and gnome-packagekit (or KDE's equiv). Manually install. It worked for me on both my Fedora 9 and Fedora 10 machines.
No, it must be a buffer overflow that results from reading the file. Applications can't be made to do things they were not designed to do, but they can be used as tangential attack vectors by forcing them to interact with malicious data.
Don't open email unrequested attachments from strangers and stop running Windows under an admin account and you'll effectively eliminate the chances of being hit by something like this. These "attacks" are mostly social engineering anyway.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
It doesn't do anything. I was expecting something a little more fun than deleting a file.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
... while, at the SAME TIME, running a non-updated version of Windows, Windows 2000, or Windows Server 2003.
Does it have to be with the same hand?
j/k
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
In that case, run cmd and type the following:
debug
a
int 18
int 3
(blank line)
g
It's a little more fun than deleting a file, and I bet you've never seen that error before.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Can anyone list the Windows file formats that HAVEN'T been affected by one or more vulnerabilities? There's .txt, possibly .bmp and .wav... are there any others?
Dear MS, please answer the following. Once it was discovered that ONE of your programs had a vulnerability that could cause buffer overflows and thereby would allow code-execution, and that this vulnerability was widely exploited by malware authors, why, for the love of God, did you not audit ALL other programs for similar buffer overflow vulnerabilities?
Does MS really think that these scumbags are as stupid as cartoon criminals in that they'll never try the same exploit twice?
I don't think grandma is using WinServer 2003
My grandmother still uses Windows ME. I have suggested she update, even offered to do it for her, but she resists, laboring under the delusion that the entire interface would change as drastically as the last time when she switched from an old Mac (and I mean old) to her current machine. I would insist, but at her current rate of adoption she won't actually connect it to the internet before the sun burns down to an ember... All that aside, my gran still uses an outdated version of Windows you insensitive clod!
This is not offtopic mods, look it up.
Specifically, Notepad used to get confused between unicode text and western (or ascii?) 4-3-3-5 strings like the one above and would print them graphically as dashes.
Will you pay MS Office price to people who doesn't have it installed?
In that case, I hear OO.org can open .wri files.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Thanks for this information as I do not know a lot about the subject.
[...] and stop running Windows (strike)under an admin account(/strike) and you'll effectively eliminate the chances of being hit by something like this.
That was taken care of a long time ago ;-)
Here be signatures
I'd put a notice at the top of the file. "This naughty image is only compatible with the following versions of Windows: ..."
I'm sure many victims would kindly downgrade as needed to make my exploit work.
"Strangers have the best candy" -Me
I'd recommend Abiword for "Wordpad" fans.http://www.abisource.com/download/ , it is not a "build from source" thing, it is tiny and comes with a installer. Of course, it is a full feature Word processor, not a crippled "Write".
MS figured people happily uses Write for their everyday stuff and even offices so they crippled it and shipped "Wordpad", the naming itself is like "This is like Notepad, use real Word for writing things".
Just install all of the plugins package, it does open and even save them.
OMG! RLY?!?!?! Troll???!
Replace Microsoft Word with OpenOffice, nitwit.
Get a life!
On all systems I know, this causes explorer to hang, consuming 100% CPU on one core.
So tomorrow, instead of telling my teacher, "the dog ate my homework," I can tell her, "WordPad ate my homework, and had the rest of my computer for dessert!"
It didn't work with, "the cat ate my gym suit" either.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Yeah...you DO have a point there...
this is what the red hat bugzilla is for https://bugzilla.redhat.com/ bugs. or perhaps the fedora forums http://fedoraforum.org/ or perhaps #fedora on freenode.
Not a windows story on slashdot, because posting about it here is not really going to get it fixed...
They don't have such chance to make it non vulnerable unless they scrap entire backwards compatibility.
A more mad solution would be the thing Apple did. Run the older OS in a virtual machine in its own thread (trublue, MacOS Classic support).
MS can't take such big decisions so, anything claimed for Windows 7 is a joke. If one can run Wordpad from XP in Windows 7, it is not secure.
Replace OpenOffice with utter crap, dillhole.
Wrote my thesis on it. OpenOffice is truly the king of all that sucks.
"Violence is the last refuge of the competent, and, generally, the first refuge of the incompetent" - Thing_1
The macros are binary gibberish without the VBA runtime, much like a Perl file is just text without the Perl interpreter.
But... Even WITH the Perl interpreter, it's binary gibberish! :-)
*blink*
I don't have a Windows box to test on so....
This generates a "Privileged Instruction" error, followed by triggering a hardware breakpoint?
Now the hackers really do have Microsoft on their side!
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Here's the exploit code referenced in the article update... The second one apparently works on Vista, too. http://www.milw0rm.com/exploits/7403 http://www.milw0rm.com/exploits/7410
... when this:
Anyone stupid enough to get infected this way deserves everything Darwin can throw their way.
makes you ask "what has all this have to do with the OS kernel?"
Ignore this signature. By order.
"do you send them a malformed .txt file?"
Considering that you can get Visual Studio's text editor to go into rich-text mode and start displaying weird fonts while viewing a plain text file by inserting special control characters, then I wouldn't be sure about plain-text not being exploitable in MS software.
You don't even have to RTFA to know that there is no patch available.
Properly implement sudo (kdesudo, etc.) in a version of Windows that doesn't suck and I might.
I think he was using the other definition of remotely, which is admittedly confusing in that context.
No existe.
...going to stop coding fucking buffer overflows and assorted other common software flaws? It's fucking 2009. Why is this shit still happening? Even on Linux I get several security bug patches a week.
And now after Windows XP has been out for HOW FUCKING LONG, Microsoft gets to issue TWENTY-EIGHT fucking fixes in one month - and at that, manages to miss one or two more?
Fucking pathetic.
You programmers better go back to school and start figuring out how to write code that doesn't fucking suck!
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
The macros are binary gibberish without the VBA runtime, much like a Perl file is just ascii gibberish without the Perl interpreter
FTFY
The laws of probability forbid it!
That exploit is for the IE7 0-day, not the wordpad txt converter vulnerability. The IE7 0-day is remotely exploitable, while the wordpad one is not (unless the user opens a maliciously crafted file which happens to launch another malware program that further compromises the system).
AFAI understood this is an IE exploit. So you expect ppl. that use IE to do that?
People know not to open executable files (.exe) and even for more obtuse executables (.scr, .cmd) most systems and mail clients are smart enough to warn that it's executable content.
Which people are you referring to then? Surely not the average user.
http://www.zombieapocalypse.tv/
I'll introduce you to the average user... they'll open anything that gets through spam/virus scans in their email.
Even if you tell them not to open anything they didn't expect, they always do.
Attachments are so exciting to them, it's like a raccoon going after a shiny trinket.
Mods. Please. Look it up.
This must be mod-fucktard day.
NTVDM does not support ROM basic.
Attacks that revolve around opening fucked up attachments and the usual bugginess of IE. Man, such a novel concept, I know I never would have seen that coming.
Seriously though, anyone who is still opening up weird attachments and is still using IE deserves to have their computers raped.
Recent cloud computing simulations has concluded Microsoft Windows(R) share the same properties as an ancient hand-crafted Chinese ivory ball.
http://www.buddhamuseum.com/puzzle-ball_006.html
They are both bulky, complex and expensive, with multilayer of interacting holes capable of forming holes at any possible angle with near infinite combination.
At this point in time it does not appear to be wildly used,
Perhaps hackers will become more enthusiastic about it with time.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
Properly implement sudo (kdesudo, etc.) in a version of Windows that doesn't suck and I might.
Wish granted. (Yes I know Windows Vista isn't affected, but the capability you asked for is there.)
"Beware of he who would deny you access to information, for in his heart he dreams himself your master."
Agreed. UAC is like sudo but without any short-term memory whatsoever (i.e. the 15-minute auto-OK).
proud caffeine whore
I posted it first, over an hour earlier: http://slashdot.org/firehose.pl?op=view&id=2125979
Bow before me, for I am root.
I find it amazing how, seen the incredible number of Windows machine being used in botnets, a lot of people here are still downplaying the importance of these 0-day exploits.
The MS-astroturfers are alive and well
--
John Doe
Change the default application that opens .wri (OLD Ms-Write files from Windows 3.x, that Wordpad opens) to Microsoft Word (whatever version) & you should be ok. Changing the file extension association here:
HKEY_CLASSES_ROOT\.wri
From WORDPAD.EXE (beneath that in the tree of folders), to the same thing the .doc file extension has!
Just merging THIS .reg file into your registry SHOULD technically do the job:
----
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.wri]
@="Word.Document.8"
"Content Type"="application/msword"
[HKEY_CLASSES_ROOT\.wri\PersistentHandler]
@="{98DE59A0-D175-11CD-A7BD-00006B827D94}"
[HKEY_CLASSES_ROOT\.wri\Word.Document.8]
[HKEY_CLASSES_ROOT\.wri\Word.Document.8\ShellNew]
"FileName"="winword8.doc"
----
Technically SHOULD do the job for "proofing you" vs. this attack, until MS issues a patch next month/year January 2009...
APK
exploits are only developed by analyzing patches.
Wrong - you see? Exploits are being written by skilled crackers* and security experts alike. But:
It is much better for a cracker to only use few targeted attacks and stay under the radar of the infosec community.
The whitehat security researchers might tell Microsoft about the problem, which you can observe as "the vulnerability was privately reported" in those advisories. Those are the vulnerabilities that are found by "hackers" that do not make money out of it.
And therefore, the blackhats keep their 0-days and those get only patched when the whitehats discover the same vulnerability and report it.
Apart from that, the creator of the 0-day could possibly also just have a very good tool for finding flaws automatically or could be good in fuzzing techniques and might as well just have directed his skills at the program mentioned in the advisories. All I want to say is that it was not necessarily someone who looked at the disassembled code, looking for the patched vulnerability and just realizing (matrix like by "seeing the code") another vulnerability.
Personally I regard this as unlikely as I know of some very good programs to analyze the patch and find the vulnerability this very patch tries to close but would not show you any other flaws.
Maybe the cracker got his hands on a description of the patched vulnerabilities that Microsoft gives out to paying customers? And has then targeted the mentioned programs? But as finding some otherwise unspecified flaw in IE is difficult, targeting a small executable is much more simple and so the attacker might have looked for a flaw and found one that later turned out to be a different flaw that what MS thought of in the early patch announcement. I find this scenario to be especially likely as this would explain why the attacker has wasted a precious 0-day for mass exploitation: he simply thought he would exploit what the MS patch was about to patch. So there would not have been any benefit in keeping that knowledge but instead it would have been most profitable to exploit it before the patch comes!
I for one imagine a cracker somewhere, now biting into his ass that he disclosed a vulnerability which previously nobody knew of - in a way, not even himself. *g*
______
* call me pathetic for using the correct words. I know, nobody uses them any more
HOLY SH!T ... just tried it, and verified that bug. Like the wiki says, a bug in IsTextUnicode().
Yeah, mods are on crack on this one.
I just checked and Write from Windows for Workgroups 3.11 handles Unix style text files just fine. Also tested notepad which doesn't handle them correctly just to make sure dosbox wasn't translating them into DOS style text files on the fly.
Patch Tuesday, exploit Wednesday. -Rob
I'd be willing to bet that the vast majority of users have never heard of a WRI file.
And that binary format contains calls to Windows(tm) drawing routines. That WAS exploited earlier. This may be similar. Microsoft binary formats had little to do with interchange, and a lot to do with efficiency. Not having to deal with portability issues means that things like drawing dll parameters where simply "jammed in".
This increased the attack surface to a major part of the Windows(tm) drawing and rendering code.
And, since the display driver is running in kernel, it too was part of the attack surface. I had presumed that this was all straightened out, but... who knows?
The effect is that valid code sequences CAN be dropped into WORD(tm) files, and buffer overflows may extend into rather unexpected places, that can then run the exploit code. Rather clever, actually. Its a clever exploit on "clever" coding. What it should have taught is to review "clever" code, and rip it out.
On to a real-life story. A patch was developed for a performance enhancement for a BIG Unix installation. The Unix vendor (all names removed to protect the guilty and innocent) had generated the patch internally. It worked, and "saved the day" for the client (a major financial institution). The patch was proposed as an add-in for the regular Unix system; after all, there may be other clients who could benefit. The Unix committee squashed the patch -- it was too clever.
And that's what SHOULD happen.
Just another "Cubible(sic) Joe" 2 17 3061
Yes, that is a little more exciting than deleting a file..
Almost as exciting as copy \ paste.
why isn't "biggest breasts ever.wri" underlined it won't let me click on it how do I get the file?
Well, it didn't on XP.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
This fixes it by altering the file association for the Explorer/IE shell from WordPad.exe to winword.exe (it's immune to this):
----
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.wri]
@="Word.Document.8"
"Content Type"="application/msword"
[HKEY_CLASSES_ROOT\.wri\PersistentHandler]
@="{98DE59A0-D175-11CD-A7BD-00006B827D94}"
[HKEY_CLASSES_ROOT\.wri\Word.Document.8]
[HKEY_CLASSES_ROOT\.wri\Word.Document.8\ShellNew]
"FileName"="winword8.doc"
----
Paste what is between the dashed liens only above, into notepad.exe, save it as TYPE "All Files", & on disk as APKMsWordPadBugFix.reg, & then open it using regedit.exe. It will ask if you want to merge this registry file. Do so.
(That's a fix before Ms issues a fix, because it changes the .wri file extensions' file association from opening in WordPad.exe if you click on any bogus files sent your way, hopefully not, but just in case, & the shell will spawn the process as Microsoft Word, which is immune to this in most modern versions of it, if not all versions)
An easy fix for anyone just in case, before MS issues a fix...
APK
This patches the bug for Microsoft Office 2003/Microsoft Windows 2003 users by default, & simple to change for later/earlier versions too...
(Simply by altering the file association for the Explorer/IE shell from WordPad.exe to winword.exe (it's immune to this, & Ms-Word handles old Windows 3.x & NT 3.5x Ms-Write .wri files, just fine...)):
----
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.wri]
@="Word.Document.8"
"Content Type"="application/msword"
[HKEY_CLASSES_ROOT\.wri\PersistentHandler]
@="{98DE59A0-D175-11CD-A7BD-00006B827D94}"
[HKEY_CLASSES_ROOT\.wri\Word.Document.8]
[HKEY_CLASSES_ROOT\.wri\Word.Document.8\ShellNew]
"FileName"="winword8.doc"
----
Paste what is between the dashed lines only above, into notepad.exe, save it as TYPE "All Files", & on disk as APKMsWordPadBugFix.reg, & then open it using regedit.exe. It will ask if you want to merge this registry file. Do so.
(That's a fix before Ms issues a fix, because it changes the .wri file extensions' file association from opening in WordPad.exe if you click on any bogus files sent your way, hopefully not, but just in case, & the shell will spawn the process as Microsoft Word, which is immune to this in most modern versions of it, if not all versions)
A simple to do, easy fix for anyone, even before MS issues a fix...
NOTE - POTENTIALLY/POSSIBLY IMPORTANT for users of versions of Office or Word, other than 2003:
IF you have versions of Ms-Office (Ms-WORD specifically), other than 2003?
You MIGHT have to change "Word.Document.8", wherever it appears above, to whatever version number yours is, along with the GUID used to do the OLEServer library marshalling/summoning of Word to open .wri files with, instead of Wordpad.exe & that's found in the .doc file association under -> HKEY_CLASSES_ROOT , easily enough)...
APK
P.S.=> "We can do this... We HAVE the technology!", I am surprised that MS didn't - it's common-sensically easy!
I don't see HOW they could have missed this IF it was a KNOWN issue that came up before "Patch Tuesday" 2 days ago, I thought of it in literally 2 seconds, & took maybe 2 minutes to make the file & test it, it works... apk
EZ enough fix is below, for the bug for MS Office 2003/MS Word 2003 users by default, & simple to change for later/earlier versions too...
(Simply by altering the file association for the Explorer/IE shell from WordPad.exe to winword.exe (it's immune to this, & Ms-Word handles old Windows 3.x & NT 3.5x Ms-Write .wri files, just fine...)):
----
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.wri]
@="Word.Document.8"
"Content Type"="application/msword"
[HKEY_CLASSES_ROOT\.wri\PersistentHandler]
@="{98DE59A0-D175-11CD-A7BD-00006B827D94}"
[HKEY_CLASSES_ROOT\.wri\Word.Document.8]
[HKEY_CLASSES_ROOT\.wri\Word.Document.8\ShellNew]
"FileName"="winword8.doc"
----
Paste what is between the dashed lines only above, into notepad.exe, save it as TYPE "All Files", & on disk as APKMsWordPadBugFix.reg, & then open it using regedit.exe. It will ask if you want to merge this registry file. Do so.
(That's a fix before Ms issues a fix, because it changes the .wri file extensions' file association from opening in WordPad.exe if you click on any bogus files sent your way, hopefully not, but just in case, & the shell will spawn the process as Microsoft Word, which is immune to this in most modern versions of it, if not all versions)
A simple to do, easy fix for anyone, even before MS issues a fix...
NOTE - POTENTIALLY/POSSIBLY IMPORTANT for users of versions of Office or Word, other than 2003:
IF you have versions of Ms-Office (Ms-WORD specifically), other than 2003?
You MIGHT have to change "Word.Document.8", wherever it appears above, to whatever version number yours is, along with the GUID used to do the OLEServer library marshalling/summoning of Word to open .wri files with, instead of Wordpad.exe & that's found in the .doc file association under -> HKEY_CLASSES_ROOT , easily enough)...
APK
P.S.=> "We can do this... We HAVE the technology!", I am surprised that MS didn't - it's common-sensically easy!
I don't see HOW they could have missed this IF it was a KNOWN issue that came up before "Patch Tuesday" 2 days ago, I thought of it in literally 2 seconds, & took maybe 2 minutes to make the file & test it, it works... apk
And what the open source community did? it duplicated an even older operating system, i.e. Unix.
There are other factors that affect the development of operating systems:
Don't think that Unix is any safer than Windows in this case. This bug is analogous to the Unix worm 20 years ago.
" At this point in time it does not appear to be wildly used"
I think the author meant to say "widely", don't you?
Fata viam invenient.
Read the OP. He (they) asked a question that was at in part very similar to the wordpad bug.
Mods are, for the most part, fucking stupid when it comes to commonsense.
Yeah, it's another I hate mods troll -1 post. IDC, won't bother me to see them burn up mod points on my drivel.
Wordpad does the same thing.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
As far as the IE vuln goes: This is not a traditional heap overflow, just look at how it is being exploited. In a traditional heap overflow, we'd see them performing some type of allocation foo or shoving a lot of data into a small buffer or something along those lines, but that is not the case here. The block of XML that triggers the vuln is too small and does not have any of the indicating factors of traditional heap overflows. (This should not be confused with the fact that a heap spray is being used in the exploits we've found in the wild, that makes exploitation more reliable, but does not indicate a heap overflow always). This is a use after free. If you debug it, you'll see that memory is free()'d, but dangling references are left to the free'd object, so if that block of memory is reallocated and filled with user controlled data, we can control a virtual function pointer and call into any area of memory we like. This makes exploitation very unreliable, in about 20 tests I ran, roughly 4 of them resulted in an exploitable condition, the others either failed to crash (memory was never reallocated) or crashed in a non-exploitable manner (another uncontrollable structure was allocated in place of the controlled data). There are ways of making these more reliable (someone wrote a paper and presentation on it a year ago wrt a IIS vulnerability), but it isn't easy and doesn't improve reliability all that much. This is a common problem with browsers due to complicated inheritence and a large number of objects that are being handled.
Other than credential caching, I don't see what the problem is with UAC. Most of the "problems" people claim it has are related to crappy software that thinks it has control of the entire computer. It's not a technical issue, it's a legacy and culture one, and given the circumstances I think UAC is the best possible worst solution.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
haha, yes, I suppose I should have used Python as the example instead <g>
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
So someone who doesn't have WORD installed, but thinks they are safe because they only have a converter (WordPad viewer) and no Macro functionality will be screwed.
So if you use any Open source pdf->text converter, then you are saying users that get infected by opening a pdf in their pdf->text converter are "stupid" and "deserve [shit]"?
Wouldn't this also correspond to any open source conversion util ? I.e. -- your assessment of them being "stupid" -- anyone using a converter from some higher level format to view in a lower level format is "stupid"? What about people who use an HTML viewer? Like a browser ? Do they qualify as stupid too?
Just checking...
Maybe you could tell everyone which higher level format converters are 'safe'? Please be exhaustive so those who strive not to be 'stupid' will be able to protect themselves...
Agreed on all counts. Abiword is definitely a good replacement.
That said, wordpad has undergone some serious work (albeit the only work really done on it since it came into existence) for Windows 7. ...of course, you'll get that lovely "ribbon" UI that everyone seems to love to hate, so YMMV.
I suggest it since I know the user profile of Wordpad and Write (yes, true) using people. They just want a fast Word processor to do everyday stuff and some even uses for big text only things.
Abiword is both. It is both massively backwards compatible and it has real word processor features which MS would never dare to put or it would kill Word sales. Apple has cut some Textedit features too, MacOS one was better I heard.
http://www.samanthaslopes.com/images/promo/promo02.jpg
Only cost 40K
The Singularity is closer than you think
Quant