Slashdot Mirror
Oops! Missed One Fix — Windows Attacks Under Way
CWmike writes "Microsoft says attackers are now exploiting a critical Windows bug that it didn't get around to fixing in its biggest batch of security patches in more than five years, issued yesterday. Microsoft said that 'limited and targeted' attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter, a tool included with all versions of Windows. If Microsoft patches the WordPad problem on its monthly schedule, the first opportunity for fixing the flaw would be Jan. 9, 2009." Update: 12/10 22:28 GMT by T : OK, there might have been more than one: reader Simon (S2) writes "There is an even more serious flaw ... From SANS: 'There is a 0-day exploit for Internet Explorer circulating in the wild. At this point in time it does not appear to be wildly used, but as the code is publicly available we can expect that this will happen very soon. This is a brand new exploit that is *not* patched with MS08-073 that was released yesterday. I can confirm that the exploit works in a fully patched Windows XP machine. The exploit is a typical heap overflow that appears to be exploiting something in the XML parser.'"
Pffff. What could possibly happen in only a month?
This guy's the limit!
I wondered this as well, it couldn't very well be remote code execution or privilege escalation or anything like that, so I opened up the article. It appears that Wordp
I will shortly be posting more details on this exploit in Wordpad format. Stay tuned!
Ah, see this is why security is not my field, or maybe I need another red bull. I guess I would make a great MS programmer with that attitude: "Just finish the app by noon and we'll let somebody else audit it and we'll release a patch 5 years from now". Yeah, my future with Microsoft is bright.
This information is in the article, BTW.
In the what, now?
It's very simple, really; the attacker breaks into your home or office, knocks you unconscious with a blunt instrument, boots up your computer and opens Wordpad.
His was funnier. Yours was kinda sad.
You mean all someone has to do is click on an attachment called "biggest breasts ever.wri"? Oh, NOBODY would be that dumb!
-- Wondering how long until the internet becomes fully corporatist, like television.
... while, at the SAME TIME, running a non-updated version of Windows, Windows 2000, or Windows Server 2003.
Does it have to be with the same hand?
j/k
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
I don't think grandma is using WinServer 2003
My grandmother still uses Windows ME. I have suggested she update, even offered to do it for her, but she resists, laboring under the delusion that the entire interface would change as drastically as the last time when she switched from an old Mac (and I mean old) to her current machine. I would insist, but at her current rate of adoption she won't actually connect it to the internet before the sun burns down to an ember... All that aside, my gran still uses an outdated version of Windows you insensitive clod!
Oh please. Wordpad is like Notepad, only it can't make up its mind whether to be richtext or plaintext and it doesn't open files when you drop them into it.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
I'd put a notice at the top of the file. "This naughty image is only compatible with the following versions of Windows: ..."
I'm sure many victims would kindly downgrade as needed to make my exploit work.
"Strangers have the best candy" -Me
He did specify .wri attachments you know, but the axe thing is equally good in my books.
http://www.zombieapocalypse.tv/
You programmers better go back to school and start figuring out how to write code that doesn't fucking suck!
I'll get right on that chief. And I asked you to hold the pickles on this burger.
It doesn't much like 150MB SQL dumps, I'll tell you that...
It's 2009 where you live? What timezone is that?!
You are in a maze of twisty little passages, all alike.
Wordpad is like Notepad, only it can't make up its mind whether to be richtext or plaintext
What do you expect? Wordpad is 13 years old now. Things can be very confusing at that age. It's perfectly normal to experiment with both rich and plain text. The important thing, as the article points out, is to use protection.
And if Wordpad decides to be more stylish by wearing fancy fonts, bold typefaces, and italics, there's nothing wrong with that. Society has become a lot more except of rich text editors in the past few decades.
Basically, don't open weird files that you find on the internet.
Any chance you could get that printed up on a mousemat or somthing? I'd certainly buy a few to send out to relatives and family friends as Xmas presents....
I only buy pepper spray that's been tested on anti-vivisectionists.
Find/replace in notepad on large files makes it looks like I'm *really* busy on my computer at work. :-)
A post a day keeps productivity at bay.
why isn't "biggest breasts ever.wri" underlined it won't let me click on it how do I get the file?
There, corrected that for you.