Slashdot Mirror
40 Windows Apps Said To Contain Critical Bug
CWmike writes "About 40 different Windows applications contain a critical flaw that can be used by attackers to hijack PCs and infect them with malware, says HD Moore, chief security officer at Rapid7 and creator of the open-source Metasploit penetration-testing toolkit. Gregg Keizer reports that the bug was patched by Apple in its iTunes software for Windows four months ago, but remains in more than three dozen other Windows programs. Moore did not reveal the names of the vulnerable applications or their makers, however. Each affected program will have to be patched separately. Moore first hinted at the widespread bug in a message on Twitter on Wednesday. 'The cat is out of the bag, this issue affects about 40 different apps, including the Windows shell,' he tweeted, then linked to an advisory published by Acros, a Slovenian security firm."
http://www.youtube.com/watch?v=wxlhyX-4qKI
Only 40? That's definitely an improvement over the 7 year old Linux exploit that was only just fixed where any GUI app could gain root access.
Just 40?
Then worry about this:
http://it.slashdot.org/story/10/08/18/1534258/Linux-Xorg-Critical-Security-Flaw-Silently-Patched?from=rss
Palm trees and 8
So there are forty unknown applications with an unknown flaw that results in code execution. This sounds like it includes web browsers (given the references to 'viewing a web page' in the article), but it doesn't specify which. It also doesn't specify what sort of file(s) (except in the case of iTunes -- a 'media file') are affected.
So what're we supposed to do? There's no detail here, not even cursory detail, on what filetypes or applications to avoid. I'm fine with no details on the innermost workings of this exploit being widely disseminated, but why announce it with such fanfare if there's not even a way to avoid exposing yourself (i.e., listing these supposed '40 applications')?
Then worry about this:
Yeah, I'm far more worried about a _fixed_ exploit that requires I install a malicious GUI app than an active exploit that just requires I open a malicious Word document.
Exactly... I am dubious on Windows security, but I use Windows boxes all the time without issue due to basic security precautions and basic common sense.
(Yes I realize most users do not have either)
They fixed a bug in the Linux kernel? I'm worried now.
'The cat is out of the bag, this issue affects about 40 different apps, including the Windows shell,'
That sounds really bad!
'The cat is out of the bag, this issue affects about 40 different apps, including the Windows shell,' he tweeted
Oh, doesn't seem so bad now...
A lot of people need to learn the phrase : "Common sense is not so common".
I was under the impression that very few Windows applications were statically compiled... so why can't this just be updated in whatever shared object it uses again?
I know he says
but what and why?
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
Or Joe Sixpack visits a website with a Flash applet, and there happens to be a vulnerability in Flash player that allows those applets to issue requests directly to the X server. Or, Joe Sixpack opens a PDF file using acroread, and there is a vulnerability in acroread. Or any number of other vulnerabilities; all an attack needs is to be able to issue requests directly to the X server.
It really was not a trivial, uninteresting bug. It was a serious security problem for desktop Linux users that had been around for years.
Palm trees and 8
http://www.archlinux.org/packages/core/i686/kernel26/
Patched on 8/13, new kernel package on 8/14. I'm not concerned. And slower-updating distros generally have a security team to patch these kinds of things into their current kernel release.
The part where an exploit that allows malicious programs to be run without the user's knowledge? Or did you think there were no such exploits?
For the record, I am a Fedora user, not a Windows user. I am willing to acknowledge when there is a security problem. I am glad it was fixed, but that does not imply that it was not a real problem.
Palm trees and 8
Don't run X as root. Who does that these days?
KMS, bitches.
These day it could be considered a super power.
...Rob
The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
You misunderstand. The Xorg bug doesn't require a malicious GUI app; it just requires a perfectly normal GUI app with an exploitable vulnerability. So if OpenOffice.org (or Acrobat Reader, or Firefox, or any other document viewer) has a flaw which can be exploited by a malicious document, the Xorg bug turns that into a privilege-escalation vulnerability, circumventing not only the normal permission mechanisms but also tools such as SELinux sandboxes (which protect against malicious code running in the sandboxed user application, not the X server).
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat
So in order to exploit this exploit you need to make up another exploit which already allows them to do anything on my PC with my user privileges, which means that they've already installed a keylogger in Firefox and stolen my bank passwords and I no longer give a flying monkey turd about whether they've trashed my OS.
No. In fact, for example, a maliciously-formed PDF file opened in a PDF reader, even if that reader is run in a sandbox, can be used to gain root through the exploit.
Don't run X as root. Who does that these days?
Probably quite a few. Not everyone is running a version of the 2.6 kernel that has KMS.
Exploitable != Malicious. A system without stack protection is an accident waiting to happen. You should read up on how stack protections eliminate an entire class of exploits, and how subtle exploitable code really is. Even the .NET compiler includes stack protection. I have no idea why Linux has not adopted the use of ProPolice across the board.
My previous response was not a troll; it was based on years of experience running Windows, Linux, Mac and BSD machines. Linux is the most brittle of all of the systems I've used. Even remaining up-to-date from the distro is very little protection, since the underlying problem is not being addressed. Nearly every Linux distro could ship with better security, but SELinux and ProPolice are not enabled by default.
"Please describe the scientific nature of the 'whammy'" - Agent Scully
Who? People that run proprietary drivers from Nvidia or ATI do. So do people that use drivers from less popular vendors that don't yet have KMS in their drivers (KMS is not in every open driver yet). It's enough to stop most distros from shipping with X running as another user.
I'd say that putting any OS on the Internet without a reasonable firewall is a poor idea, the exception being a laptop [1] just out of necessity. Yes, most operating systems are hardened, but what brings the bugs are the applications that run on them. This is why having a hardened machine with as little running on it as possible is essential between the general purpose computers and the rest of the Internet.
[1]: I have seen tiny embedded Linux adapters just bigger than an Ethernet plug. Why can't laptop makers build a tiny firewalling router into one of those and mount it on the motherboard? This way, it doesn't matter what OS is, attacks from remote will be minimized, and one could configure it to disallow outgoing ports (such as port 25) that the laptop shouldn't ever need to go out on. I'm sure similar functionality can be done for Wi-Fi. As an added bonus, if a machine gets DoS-ed, it won't be the main CPU that has to sort out the offending packets, but the one on the built in firewall.
Here's a link to the original advisory. It's worth a read as it contains useful remediation advice: http://www.acrossecurity.com/aspr/ASPR-2010-08-18-1-PUB.txt
but better security is not one of them.
And you'd be wrong. Even with a directly connected Linux box it takes someone manually targeting that machine. As far as I know, no one has successfully automated *nix hacking and certainly not any kind of effective drive-by attack. Even if the automated attack gets a foot in the door, they still have to manually find a way to escalate privileges.
If you still believe this, put up a Linux server completely exposed to the Internet, and broadcast all over IRC that your server is badass and can't be hacked.
Connect that same box running Windows directly to the internet and you don't even have to announce its presence. It's like auto-hork.
Linux doesn't have the security issues that Windows does, but mostly it's because its less popular,
Another fallacy. If that were true then the exploits out in the wild should be relative to percentage of machines running that OS. And yet there aren't any. That popularity tripe was a talking point from a MSFT PR firm advertising campaign that went around a few years ago.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Actually, even though Nvidia does not support KMS their drivers do support running X as a normal user. Users of the ATI proprietary drivers are SOL.
Using KMS does not automatically remove the root requirement. For example, Ubuntu uses KMS drivers for many cards currently, but one of the big improvements for 10.10 will be to run X as a normal user with some drivers.
What you're saying is that Linux is totally bulletproof, as long as you run it as much as possible like an iPhone -- trusting only applications that your OS provider says are okay, and that it's not reasonable to examine it in a situation where that's not the case.
How is installing applications from the repos anything like using an iPhone? With Linux, I can install any application I want from anywhere I want as long as it's compatible (just like most other OS's). I can compile from source, write and run my own code on it, whatever floats my boat. I and most other Linux users get most of our software from the repositories because 99 percent of anything you'd want to install is in there and the packages in the repos are generally well tested to work with the system you are using. It would be foolish to not use them. With the iPhone, unless you jailbreak it, you're locked in. That's a walled garden. No Linux distro I've ever used has worked like that at all.
The soylentnews experiment has been a dismal failure.