Slashdot Mirror
Oops! Missed One Fix — Windows Attacks Under Way
CWmike writes "Microsoft says attackers are now exploiting a critical Windows bug that it didn't get around to fixing in its biggest batch of security patches in more than five years, issued yesterday. Microsoft said that 'limited and targeted' attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter, a tool included with all versions of Windows. If Microsoft patches the WordPad problem on its monthly schedule, the first opportunity for fixing the flaw would be Jan. 9, 2009." Update: 12/10 22:28 GMT by T : OK, there might have been more than one: reader Simon (S2) writes "There is an even more serious flaw ... From SANS: 'There is a 0-day exploit for Internet Explorer circulating in the wild. At this point in time it does not appear to be wildly used, but as the code is publicly available we can expect that this will happen very soon. This is a brand new exploit that is *not* patched with MS08-073 that was released yesterday. I can confirm that the exploit works in a fully patched Windows XP machine. The exploit is a typical heap overflow that appears to be exploiting something in the XML parser.'"
How can code in the wordpad text editor leave a machine vulnerable? Can someone explain this in a way that's not super technical? Faulty code in a browser, or similar, I can understand.
Holding back your zero day exploits until directly after the MS Patchday...if your bug hasn't been removed, then you have up to a full month of time to abuse it.
Clever.
Pffff. What could possibly happen in only a month?
This guy's the limit!
If you visited an affected page, and your BROWSER is compromised:
* you may see a warning about a javascript error. But it depends on how the attack code interfers with other javascript on the respective page, and many users disable these javascript warnings.
* Disconnect the system from the network as soon as possible.
* run a thorough virus check with up to date virus definitions. Many AV vendors (including Malda's stiff cock) released new definitions as recently as last night.
* If you are able to monitor traffic to the infected host, you may see attempts to contact 217.107.218.147 on port 80.
* AV software will detect the javascript as 'JS.Scob.Trojan'.
From the article (i know I know, slashdot...), Windows XP SP3, Vista, and Windows Server 2008 aren't vulnerable. I didn't read how the exploit actually works to see if it can realistically be used to attack Windows Server 2003 (which is quite popular), but for people at home, if your machine is up to date, you're fine.
So seriously, whats the big deal?
What the f* does WordPad have to do with anything remotely exploitable. How do you even make a bug there, it's a CS students first year project to make a text editor? I mean, it was a running joke that the only things not exploited in Windows were Calculator, Notepad and Wordpad but this just tops it. Also. How do you exploit it? Do you suggest somebody to copy/paste a piece of text or do you send them a malformed .txt file?
Custom electronics and digital signage for your business: www.evcircuits.com
I will shortly be posting more details on this exploit in Wordpad format. Stay tuned!
Are .rtf files now unsafe on Windows?
It seems this has been going on forever now. The most high-profile cases where the excel bugs a while back.
1. Fuzz MS file format handling code until bug is found.
2. Develop exploit, and mail infected files to high-profile targets.
3. ???
4. Profit!
When you're running everything as root, everything can be exploitable. And it looks like this is a character set or file format converter, which is considerably more than simple typing and copy/paste (the extend.) From the Security Focus page (disucssion tab), it looks like it could be a buffer overflow ("prone to a remote code-execution vulnerability because of...corrupted memory.")
The info page shows that it does indeed affect Server 2003, one of the more populat versions out there, as noted by another comment
Is tricking users into opening malicious ASCII pr0n files with .wri extensions.
Fedora 9 also botched an update it seems; since the day before yesterday I keep on getting pop-up messages from the packagekitd: "Update Applet Failed to reset client". And I've done nothing but be a faithful updater. But from the message I can't even begin to fathom whether what it is about is a security risk or not. I figured it might have something to do with yum, so I've run yum update manually. There were some updates, but none that fixed these Very. Annoying. Popups. Fedora Core people, are you listening ?!
Religion is what happens when nature strikes and groupthink goes wrong.
"Windows XP SP3, Vista, and Windows Server 2008 aren't vulnerable", Shados That's two out of four not affected ..
.. If exploited, a hacker could gain the same rights on a PC as a local user and could remotely execute code'
'Impact: Execution of arbitrary code via network, User access via network'
"I didn't read how the exploit actually works to see if it can realistically be used to attack Windows Server 2003", Shados
'"limited and targeted" attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter
http://www.cio.com/article/470080/Another_Microsoft_Bug_Revealed_on_Huge_Patch_Day http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9123100
davecb5620@gmail.com
Control Panel - Folder Options - File Types - WRI - Edit - Open - Change to Microsoft Word.
Problem solved.
Next!
Windows is Exploitable. oooh, BIG surprise. They missed one, just like the bazillion before it that they just now fixed, and the bazillion after that they will fix as people figure them out. Then again, there is the, do-it-yourself e-mail viruses "Please delete your system.ini file. Its infected! All windows systems have this critical error and your private information is stored inside. Instead of coming out publicly with this easy fix, I've forwarded this e-mail to you to tell you the dangers of the system.ini file. " A windows user is a virus! Quarantine them all!
Not according to the article. From the second paragraph:
In an advisory posted yesterday, Microsoft said that "limited and targeted" attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter, a tool included with all versions of Windows. The flawed converter handles Microsoft Word 97 files on Windows 2000 Service Pack 4 (SP4), XP SP2, Server 2003 SP1 and SP2. Newer versions of Windows -- XP SP3, Vista and Server 2008 -- are not vulnerable to the bug, however.
My preferred name is frazz, but someone keeps taking it. If you see him, tell him I said hi.
'I keep on getting pop-up messages from the packagekitd: "Update Applet Failed to reset client"'
.. :) It was posted at 10:22 and the responce at 12:23 ...
You must be the only one, I googled on it and got only the one hit
"Fedora Core people, are you listening ?!"
Was it you that posted the question ?
davecb5620@gmail.com
You mean all someone has to do is click on an attachment called "biggest breasts ever.wri"? Oh, NOBODY would be that dumb!
-- Wondering how long until the internet becomes fully corporatist, like television.
No. Someone has to click an attachment called "biggest breasts ever.wri" while, at the SAME TIME, running a non-updated version of Windows, Windows 2000, or Windows Server 2003. You reduce your attack vector by a significant amount here.
0-day for Internet Explorer v.7 is in the wild and was not patched yesterday
http://isc.sans.org/diary.html?storyid=5458
http://www.vupen.com/english/advisories/2008/3391
http://www.theregister.co.uk/2008/12/09/zero_day_ie_flaw_exploited/
... while, at the SAME TIME, running a non-updated version of Windows, Windows 2000, or Windows Server 2003.
Does it have to be with the same hand?
j/k
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
Can anyone list the Windows file formats that HAVEN'T been affected by one or more vulnerabilities? There's .txt, possibly .bmp and .wav... are there any others?
Dear MS, please answer the following. Once it was discovered that ONE of your programs had a vulnerability that could cause buffer overflows and thereby would allow code-execution, and that this vulnerability was widely exploited by malware authors, why, for the love of God, did you not audit ALL other programs for similar buffer overflow vulnerabilities?
Does MS really think that these scumbags are as stupid as cartoon criminals in that they'll never try the same exploit twice?
After what was expected to be an unusually quiet Patch Tuesday, Microsoft has released eight patches for applications with an insufficient number of security holes.
The updates include "critical" patches to Windows Media Player visualisations, Zune player software, that really cute dinosaur cursor and Age Of Empires II. The exploits opened by these patches allow a malicious user to take webcam pictures of your pimply butt, steal your pizza delivery and have sex with your girlfriend. The exploits have already been marketed to the Dark Security market by Microsoft Russia.
"Windows 7 won't be vulnerable! Did we mention how fantastic Windows 7 will be? Also, Vista's pretty good! Really! The London Stock Exchange was probably still on XP!"
Several faintly cat-piss-smelling Linux users pointed and laughed in a nerdy bray at the news and a much larger number of annoying Mac users showed off their new model iPod Nanos.
http://rocknerd.co.uk
I don't think grandma is using WinServer 2003
My grandmother still uses Windows ME. I have suggested she update, even offered to do it for her, but she resists, laboring under the delusion that the entire interface would change as drastically as the last time when she switched from an old Mac (and I mean old) to her current machine. I would insist, but at her current rate of adoption she won't actually connect it to the internet before the sun burns down to an ember... All that aside, my gran still uses an outdated version of Windows you insensitive clod!
Will you pay MS Office price to people who doesn't have it installed?
In that case, I hear OO.org can open .wri files.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
I'd put a notice at the top of the file. "This naughty image is only compatible with the following versions of Windows: ..."
I'm sure many victims would kindly downgrade as needed to make my exploit work.
"Strangers have the best candy" -Me
I'd recommend Abiword for "Wordpad" fans.http://www.abisource.com/download/ , it is not a "build from source" thing, it is tiny and comes with a installer. Of course, it is a full feature Word processor, not a crippled "Write".
MS figured people happily uses Write for their everyday stuff and even offices so they crippled it and shipped "Wordpad", the naming itself is like "This is like Notepad, use real Word for writing things".
Just install all of the plugins package, it does open and even save them.
OMG! RLY?!?!?! Troll???!
Replace Microsoft Word with OpenOffice, nitwit.
Get a life!
So tomorrow, instead of telling my teacher, "the dog ate my homework," I can tell her, "WordPad ate my homework, and had the rest of my computer for dessert!"
It didn't work with, "the cat ate my gym suit" either.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Yeah...you DO have a point there...
Replace OpenOffice with utter crap, dillhole.
Wrote my thesis on it. OpenOffice is truly the king of all that sucks.
"Violence is the last refuge of the competent, and, generally, the first refuge of the incompetent" - Thing_1
Now the hackers really do have Microsoft on their side!
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Here's the exploit code referenced in the article update... The second one apparently works on Vista, too. http://www.milw0rm.com/exploits/7403 http://www.milw0rm.com/exploits/7410
TY for the random speculation /.
It can be exploited via simple HTML, as detailed at http://milw0rm.org/exploits/7410
No, but I did throw granola at a deaf person once
... when this:
Anyone stupid enough to get infected this way deserves everything Darwin can throw their way.
makes you ask "what has all this have to do with the OS kernel?"
Ignore this signature. By order.
You don't even have to RTFA to know that there is no patch available.
...going to stop coding fucking buffer overflows and assorted other common software flaws? It's fucking 2009. Why is this shit still happening? Even on Linux I get several security bug patches a week.
And now after Windows XP has been out for HOW FUCKING LONG, Microsoft gets to issue TWENTY-EIGHT fucking fixes in one month - and at that, manages to miss one or two more?
Fucking pathetic.
You programmers better go back to school and start figuring out how to write code that doesn't fucking suck!
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
AFAI understood this is an IE exploit. So you expect ppl. that use IE to do that?
Attacks that revolve around opening fucked up attachments and the usual bugginess of IE. Man, such a novel concept, I know I never would have seen that coming.
Seriously though, anyone who is still opening up weird attachments and is still using IE deserves to have their computers raped.
Recent cloud computing simulations has concluded Microsoft Windows(R) share the same properties as an ancient hand-crafted Chinese ivory ball.
http://www.buddhamuseum.com/puzzle-ball_006.html
They are both bulky, complex and expensive, with multilayer of interacting holes capable of forming holes at any possible angle with near infinite combination.
At this point in time it does not appear to be wildly used,
Perhaps hackers will become more enthusiastic about it with time.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
I posted it first, over an hour earlier: http://slashdot.org/firehose.pl?op=view&id=2125979
Bow before me, for I am root.
I find it amazing how, seen the incredible number of Windows machine being used in botnets, a lot of people here are still downplaying the importance of these 0-day exploits.
The MS-astroturfers are alive and well
--
John Doe
Change the default application that opens .wri (OLD Ms-Write files from Windows 3.x, that Wordpad opens) to Microsoft Word (whatever version) & you should be ok. Changing the file extension association here:
HKEY_CLASSES_ROOT\.wri
From WORDPAD.EXE (beneath that in the tree of folders), to the same thing the .doc file extension has!
Just merging THIS .reg file into your registry SHOULD technically do the job:
----
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.wri]
@="Word.Document.8"
"Content Type"="application/msword"
[HKEY_CLASSES_ROOT\.wri\PersistentHandler]
@="{98DE59A0-D175-11CD-A7BD-00006B827D94}"
[HKEY_CLASSES_ROOT\.wri\Word.Document.8]
[HKEY_CLASSES_ROOT\.wri\Word.Document.8\ShellNew]
"FileName"="winword8.doc"
----
Technically SHOULD do the job for "proofing you" vs. this attack, until MS issues a patch next month/year January 2009...
APK
exploits are only developed by analyzing patches.
Wrong - you see? Exploits are being written by skilled crackers* and security experts alike. But:
It is much better for a cracker to only use few targeted attacks and stay under the radar of the infosec community.
The whitehat security researchers might tell Microsoft about the problem, which you can observe as "the vulnerability was privately reported" in those advisories. Those are the vulnerabilities that are found by "hackers" that do not make money out of it.
And therefore, the blackhats keep their 0-days and those get only patched when the whitehats discover the same vulnerability and report it.
Apart from that, the creator of the 0-day could possibly also just have a very good tool for finding flaws automatically or could be good in fuzzing techniques and might as well just have directed his skills at the program mentioned in the advisories. All I want to say is that it was not necessarily someone who looked at the disassembled code, looking for the patched vulnerability and just realizing (matrix like by "seeing the code") another vulnerability.
Personally I regard this as unlikely as I know of some very good programs to analyze the patch and find the vulnerability this very patch tries to close but would not show you any other flaws.
Maybe the cracker got his hands on a description of the patched vulnerabilities that Microsoft gives out to paying customers? And has then targeted the mentioned programs? But as finding some otherwise unspecified flaw in IE is difficult, targeting a small executable is much more simple and so the attacker might have looked for a flaw and found one that later turned out to be a different flaw that what MS thought of in the early patch announcement. I find this scenario to be especially likely as this would explain why the attacker has wasted a precious 0-day for mass exploitation: he simply thought he would exploit what the MS patch was about to patch. So there would not have been any benefit in keeping that knowledge but instead it would have been most profitable to exploit it before the patch comes!
I for one imagine a cracker somewhere, now biting into his ass that he disclosed a vulnerability which previously nobody knew of - in a way, not even himself. *g*
______
* call me pathetic for using the correct words. I know, nobody uses them any more
I just checked and Write from Windows for Workgroups 3.11 handles Unix style text files just fine. Also tested notepad which doesn't handle them correctly just to make sure dosbox wasn't translating them into DOS style text files on the fly.
Patch Tuesday, exploit Wednesday. -Rob
why isn't "biggest breasts ever.wri" underlined it won't let me click on it how do I get the file?
This fixes it by altering the file association for the Explorer/IE shell from WordPad.exe to winword.exe (it's immune to this):
----
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.wri]
@="Word.Document.8"
"Content Type"="application/msword"
[HKEY_CLASSES_ROOT\.wri\PersistentHandler]
@="{98DE59A0-D175-11CD-A7BD-00006B827D94}"
[HKEY_CLASSES_ROOT\.wri\Word.Document.8]
[HKEY_CLASSES_ROOT\.wri\Word.Document.8\ShellNew]
"FileName"="winword8.doc"
----
Paste what is between the dashed liens only above, into notepad.exe, save it as TYPE "All Files", & on disk as APKMsWordPadBugFix.reg, & then open it using regedit.exe. It will ask if you want to merge this registry file. Do so.
(That's a fix before Ms issues a fix, because it changes the .wri file extensions' file association from opening in WordPad.exe if you click on any bogus files sent your way, hopefully not, but just in case, & the shell will spawn the process as Microsoft Word, which is immune to this in most modern versions of it, if not all versions)
An easy fix for anyone just in case, before MS issues a fix...
APK
This patches the bug for Microsoft Office 2003/Microsoft Windows 2003 users by default, & simple to change for later/earlier versions too...
(Simply by altering the file association for the Explorer/IE shell from WordPad.exe to winword.exe (it's immune to this, & Ms-Word handles old Windows 3.x & NT 3.5x Ms-Write .wri files, just fine...)):
----
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.wri]
@="Word.Document.8"
"Content Type"="application/msword"
[HKEY_CLASSES_ROOT\.wri\PersistentHandler]
@="{98DE59A0-D175-11CD-A7BD-00006B827D94}"
[HKEY_CLASSES_ROOT\.wri\Word.Document.8]
[HKEY_CLASSES_ROOT\.wri\Word.Document.8\ShellNew]
"FileName"="winword8.doc"
----
Paste what is between the dashed lines only above, into notepad.exe, save it as TYPE "All Files", & on disk as APKMsWordPadBugFix.reg, & then open it using regedit.exe. It will ask if you want to merge this registry file. Do so.
(That's a fix before Ms issues a fix, because it changes the .wri file extensions' file association from opening in WordPad.exe if you click on any bogus files sent your way, hopefully not, but just in case, & the shell will spawn the process as Microsoft Word, which is immune to this in most modern versions of it, if not all versions)
A simple to do, easy fix for anyone, even before MS issues a fix...
NOTE - POTENTIALLY/POSSIBLY IMPORTANT for users of versions of Office or Word, other than 2003:
IF you have versions of Ms-Office (Ms-WORD specifically), other than 2003?
You MIGHT have to change "Word.Document.8", wherever it appears above, to whatever version number yours is, along with the GUID used to do the OLEServer library marshalling/summoning of Word to open .wri files with, instead of Wordpad.exe & that's found in the .doc file association under -> HKEY_CLASSES_ROOT , easily enough)...
APK
P.S.=> "We can do this... We HAVE the technology!", I am surprised that MS didn't - it's common-sensically easy!
I don't see HOW they could have missed this IF it was a KNOWN issue that came up before "Patch Tuesday" 2 days ago, I thought of it in literally 2 seconds, & took maybe 2 minutes to make the file & test it, it works... apk
EZ enough fix is below, for the bug for MS Office 2003/MS Word 2003 users by default, & simple to change for later/earlier versions too...
(Simply by altering the file association for the Explorer/IE shell from WordPad.exe to winword.exe (it's immune to this, & Ms-Word handles old Windows 3.x & NT 3.5x Ms-Write .wri files, just fine...)):
----
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.wri]
@="Word.Document.8"
"Content Type"="application/msword"
[HKEY_CLASSES_ROOT\.wri\PersistentHandler]
@="{98DE59A0-D175-11CD-A7BD-00006B827D94}"
[HKEY_CLASSES_ROOT\.wri\Word.Document.8]
[HKEY_CLASSES_ROOT\.wri\Word.Document.8\ShellNew]
"FileName"="winword8.doc"
----
Paste what is between the dashed lines only above, into notepad.exe, save it as TYPE "All Files", & on disk as APKMsWordPadBugFix.reg, & then open it using regedit.exe. It will ask if you want to merge this registry file. Do so.
(That's a fix before Ms issues a fix, because it changes the .wri file extensions' file association from opening in WordPad.exe if you click on any bogus files sent your way, hopefully not, but just in case, & the shell will spawn the process as Microsoft Word, which is immune to this in most modern versions of it, if not all versions)
A simple to do, easy fix for anyone, even before MS issues a fix...
NOTE - POTENTIALLY/POSSIBLY IMPORTANT for users of versions of Office or Word, other than 2003:
IF you have versions of Ms-Office (Ms-WORD specifically), other than 2003?
You MIGHT have to change "Word.Document.8", wherever it appears above, to whatever version number yours is, along with the GUID used to do the OLEServer library marshalling/summoning of Word to open .wri files with, instead of Wordpad.exe & that's found in the .doc file association under -> HKEY_CLASSES_ROOT , easily enough)...
APK
P.S.=> "We can do this... We HAVE the technology!", I am surprised that MS didn't - it's common-sensically easy!
I don't see HOW they could have missed this IF it was a KNOWN issue that came up before "Patch Tuesday" 2 days ago, I thought of it in literally 2 seconds, & took maybe 2 minutes to make the file & test it, it works... apk
And what the open source community did? it duplicated an even older operating system, i.e. Unix.
There are other factors that affect the development of operating systems:
Don't think that Unix is any safer than Windows in this case. This bug is analogous to the Unix worm 20 years ago.
" At this point in time it does not appear to be wildly used"
I think the author meant to say "widely", don't you?
Fata viam invenient.
As far as the IE vuln goes: This is not a traditional heap overflow, just look at how it is being exploited. In a traditional heap overflow, we'd see them performing some type of allocation foo or shoving a lot of data into a small buffer or something along those lines, but that is not the case here. The block of XML that triggers the vuln is too small and does not have any of the indicating factors of traditional heap overflows. (This should not be confused with the fact that a heap spray is being used in the exploits we've found in the wild, that makes exploitation more reliable, but does not indicate a heap overflow always). This is a use after free. If you debug it, you'll see that memory is free()'d, but dangling references are left to the free'd object, so if that block of memory is reallocated and filled with user controlled data, we can control a virtual function pointer and call into any area of memory we like. This makes exploitation very unreliable, in about 20 tests I ran, roughly 4 of them resulted in an exploitable condition, the others either failed to crash (memory was never reallocated) or crashed in a non-exploitable manner (another uncontrollable structure was allocated in place of the controlled data). There are ways of making these more reliable (someone wrote a paper and presentation on it a year ago wrt a IIS vulnerability), but it isn't easy and doesn't improve reliability all that much. This is a common problem with browsers due to complicated inheritence and a large number of objects that are being handled.
So someone who doesn't have WORD installed, but thinks they are safe because they only have a converter (WordPad viewer) and no Macro functionality will be screwed.
So if you use any Open source pdf->text converter, then you are saying users that get infected by opening a pdf in their pdf->text converter are "stupid" and "deserve [shit]"?
Wouldn't this also correspond to any open source conversion util ? I.e. -- your assessment of them being "stupid" -- anyone using a converter from some higher level format to view in a lower level format is "stupid"? What about people who use an HTML viewer? Like a browser ? Do they qualify as stupid too?
Just checking...
Maybe you could tell everyone which higher level format converters are 'safe'? Please be exhaustive so those who strive not to be 'stupid' will be able to protect themselves...
Agreed on all counts. Abiword is definitely a good replacement.
That said, wordpad has undergone some serious work (albeit the only work really done on it since it came into existence) for Windows 7. ...of course, you'll get that lovely "ribbon" UI that everyone seems to love to hate, so YMMV.
I suggest it since I know the user profile of Wordpad and Write (yes, true) using people. They just want a fast Word processor to do everyday stuff and some even uses for big text only things.
Abiword is both. It is both massively backwards compatible and it has real word processor features which MS would never dare to put or it would kill Word sales. Apple has cut some Textedit features too, MacOS one was better I heard.
http://www.samanthaslopes.com/images/promo/promo02.jpg
Only cost 40K
The Singularity is closer than you think
Quant