Slashdot Mirror
Oops! Missed One Fix — Windows Attacks Under Way
CWmike writes "Microsoft says attackers are now exploiting a critical Windows bug that it didn't get around to fixing in its biggest batch of security patches in more than five years, issued yesterday. Microsoft said that 'limited and targeted' attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter, a tool included with all versions of Windows. If Microsoft patches the WordPad problem on its monthly schedule, the first opportunity for fixing the flaw would be Jan. 9, 2009." Update: 12/10 22:28 GMT by T : OK, there might have been more than one: reader Simon (S2) writes "There is an even more serious flaw ... From SANS: 'There is a 0-day exploit for Internet Explorer circulating in the wild. At this point in time it does not appear to be wildly used, but as the code is publicly available we can expect that this will happen very soon. This is a brand new exploit that is *not* patched with MS08-073 that was released yesterday. I can confirm that the exploit works in a fully patched Windows XP machine. The exploit is a typical heap overflow that appears to be exploiting something in the XML parser.'"
How can code in the wordpad text editor leave a machine vulnerable? Can someone explain this in a way that's not super technical? Faulty code in a browser, or similar, I can understand.
Holding back your zero day exploits until directly after the MS Patchday...if your bug hasn't been removed, then you have up to a full month of time to abuse it.
Clever.
Pffff. What could possibly happen in only a month?
This guy's the limit!
From the article (i know I know, slashdot...), Windows XP SP3, Vista, and Windows Server 2008 aren't vulnerable. I didn't read how the exploit actually works to see if it can realistically be used to attack Windows Server 2003 (which is quite popular), but for people at home, if your machine is up to date, you're fine.
So seriously, whats the big deal?
I will shortly be posting more details on this exploit in Wordpad format. Stay tuned!
Send a specially crafted word document (i.e. code embedded) and trick the user into opening it with WordPad (i.e. using the .wri file extension).
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
Its not remotely exploitable. From the article, a user has to open a maliciously crafted file. So its just the fairly typical exploit where a document viewer poorly handles documents it can open.
It needs user interaction to work, someone has to open a file that they don't trust (I guess it MAY be possible to trick a user into opening the file from the web, since there is a Word viewer that potentially use the same file converter that is responsible for the exploit).
Also, XP SP3, Vista and WinServer 2008 aren't vulnerable at all.
IIRC Wordpad can handle some embeded objects in .rtf (and other??) files. I'm guessing the exploit takes advantage of a vulnerability with one of those embedded types or the handling of them.
Just a guess, and I'm posting before reading.
Word files are not binary executables. They are (pre OOXML) binary file formats. I don't know what the exact exploit is (probably some sort of buffer overflow) but the idea is to craft a Word document such that it contains executable code and exploits the flaw in wordpad that causes the executable code to execute.
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
This type of bug relies on "glitches" in the memory management (simplifying it a bit...) of the program, not on any high-level misses in the actual mechanisms of the code. Any program written in a programming language without automatic memory management can be exploited in this way, if the programmer "misses his step" somewhere. They can also be devilishly hard to find, because data can be structured and handled in memory in very complex and abstract ways.
When you're running everything as root, everything can be exploitable. And it looks like this is a character set or file format converter, which is considerably more than simple typing and copy/paste (the extend.) From the Security Focus page (disucssion tab), it looks like it could be a buffer overflow ("prone to a remote code-execution vulnerability because of...corrupted memory.")
The info page shows that it does indeed affect Server 2003, one of the more populat versions out there, as noted by another comment
People know not to open executable files (.exe) and even for more obtuse executables (.scr, .cmd) most systems and mail clients are smart enough to warn that it's executable content.
For data files like .jpg or .wri, neither the user or the system probably consider the file dangerous. So these type of exploits should be considered more dangerous than the completely-idiotic "e-mail people virus executables".
Especially considering many of these viruses propagate through address books (ie: trusted contacts)
But yes, at least it's not a completely automatic remote exploit.
Wordpad does not have the capability to execute those macros, because it does not have an embedded VBA interpreter. The macros are binary gibberish without the VBA runtime, much like a Perl file is just text without the Perl interpreter.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Are .rtf files now unsafe on Windows?
Btw, the answer is yes, they are unsafe on Windows, if you want to keep them safe move your .rtf files to a Linux machine asap. But they are not vulnerable to this exploit.
Control Panel - Folder Options - File Types - WRI - Edit - Open - Change to Microsoft Word.
Problem solved.
Next!
You mean all someone has to do is click on an attachment called "biggest breasts ever.wri"? Oh, NOBODY would be that dumb!
-- Wondering how long until the internet becomes fully corporatist, like television.
No. Someone has to click an attachment called "biggest breasts ever.wri" while, at the SAME TIME, running a non-updated version of Windows, Windows 2000, or Windows Server 2003. You reduce your attack vector by a significant amount here.
No, it must be a buffer overflow that results from reading the file. Applications can't be made to do things they were not designed to do, but they can be used as tangential attack vectors by forcing them to interact with malicious data.
Don't open email unrequested attachments from strangers and stop running Windows under an admin account and you'll effectively eliminate the chances of being hit by something like this. These "attacks" are mostly social engineering anyway.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
... while, at the SAME TIME, running a non-updated version of Windows, Windows 2000, or Windows Server 2003.
Does it have to be with the same hand?
j/k
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
Actually it's .wri files, which haven't been savable in Windows since 3.1.
You can rename or Save As to whatever.wri in any version of Windows. .doc extension, but only if you don't have Word installed (which is not vulnerable). To broaden the susceptible audience, .wri will likely be used an attack because it is always associated to the flawed program (Wordpad), assuming you haven't changed that behavior.
Inferring from the content of the advisory at http://www.microsoft.com/technet/security/advisory/960906.mspx , the extension and format really doesn't matter, except to the extent you can get Wordpad to open the file. It would also work with a
I don't think grandma is using WinServer 2003
My grandmother still uses Windows ME. I have suggested she update, even offered to do it for her, but she resists, laboring under the delusion that the entire interface would change as drastically as the last time when she switched from an old Mac (and I mean old) to her current machine. I would insist, but at her current rate of adoption she won't actually connect it to the internet before the sun burns down to an ember... All that aside, my gran still uses an outdated version of Windows you insensitive clod!
I'd put a notice at the top of the file. "This naughty image is only compatible with the following versions of Windows: ..."
I'm sure many victims would kindly downgrade as needed to make my exploit work.
"Strangers have the best candy" -Me
I'd recommend Abiword for "Wordpad" fans.http://www.abisource.com/download/ , it is not a "build from source" thing, it is tiny and comes with a installer. Of course, it is a full feature Word processor, not a crippled "Write".
MS figured people happily uses Write for their everyday stuff and even offices so they crippled it and shipped "Wordpad", the naming itself is like "This is like Notepad, use real Word for writing things".
Just install all of the plugins package, it does open and even save them.
They don't have such chance to make it non vulnerable unless they scrap entire backwards compatibility.
A more mad solution would be the thing Apple did. Run the older OS in a virtual machine in its own thread (trublue, MacOS Classic support).
MS can't take such big decisions so, anything claimed for Windows 7 is a joke. If one can run Wordpad from XP in Windows 7, it is not secure.
Here's the exploit code referenced in the article update... The second one apparently works on Vista, too. http://www.milw0rm.com/exploits/7403 http://www.milw0rm.com/exploits/7410
That's a lot more userfriendly than Windows.
Linux: "There's a problem. If you're technically able, here is a fix."
Windows: "There is a problem. You're boned, sorry."
You programmers better go back to school and start figuring out how to write code that doesn't fucking suck!
I'll get right on that chief. And I asked you to hold the pickles on this burger.
To be fair, this comes from a legacy component of Windows, that was not only written long ago, but is also not vulnerable in the latest versions. So they DID learn, just too late.
It does remind me of the Twilight Princess exploit on the Wii though. With all the trouble game companies go to DRM their shit to hell and beyond, one of their programmers didn't check bounds while reading the save file (not checking bounds when reading a fucking FILE, WHAT THE FUCK), and it got pwned. So Nintendo defeated its own protection scheme. What morons...
It's 2009 where you live? What timezone is that?!
You are in a maze of twisty little passages, all alike.
Patch Tuesday, exploit Wednesday. -Rob
why isn't "biggest breasts ever.wri" underlined it won't let me click on it how do I get the file?