Slashdot Mirror
New Critical Bug In All Current Windows Versions
Trailrunner7 writes "Microsoft is warning its users about a dangerous flaw in the way that Windows handles certain MHTML operations, which could allow an attacker to run code on vulnerable machines. The bug affects all of the current versions of Windows, from XP up through Windows 7 and Windows Server 2008. Microsoft issued an advisory about the MHTML vulnerability, which has been discussed among security researchers in recent days. There is some exploit code available for the bug, as well. In addition to the advisory, Microsoft has released a FixIt tool, which helps mitigate attacks against the vulnerability in Windows."
Would be nice to have seen these in the article...
http://support.microsoft.com/kb/2501696
Can I just say that now is probably a good time to invest in the tech industry. Since /. has redesigned the site, I believe productivity levels in the industry will be on the rise due to the number of commenters leaving in droves.
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
WTF is a current version of Windows? 3, 95, 98, Me, 2000, XP??
In either case, here at Microsoft, we feel standards are important. And we have fun, too. Doug Mahugh, Microsoft
I would assume Firefox handles its MHTML itself?
a
You don't remember {MS|PC|IBM}DOS do you?
It should be possible to sue for time wasted trying to get 620Kb free memory available to run some shitty Lucas Arts game (or a crappy network stack n client).
Before the "I had a few problems with punch cards" mob dives in - no one ever said that a batch system based on paper doilies would be easy.
Cheers
Jon
Hi MR AC! If you would have read TFA or even TFS (I know I know, but I got bored) you would see they provide a link to The MSFT "fix it for me" page for this problem. Just click on "fix it for me" run the fix it, and that's it. Don't even need a reboot.
I'm sending the link to my customers and family now, and since it makes a restore point before applying it is easy to undo if you need to, although with previous "fix it for me" tweaks that I've run the MSFT patch released later took care of the fix it tweak before applying the patch.
So I don't really see why you or anyone would complain about this one. They have a quick fix that is so simple your grandma can run it, and released the fix quickly to tide people over until they have worked up a patch. I don't see how they could have done any better on this, as a full patch will take time to test and rightfully so as you wouldn't want MSFT releasing patches that break apps and/or drivers and cause more pain than the bug would you? This is easy, simple to apply, and painless to deploy. I don't see how you can get better and the guy that came up with the "fix it for me" program really deserves a raise and company car, as it really has made these fast released workarounds painless for home users..
ACs don't waste your time replying, your posts are never seen by me.
the john and pimp defend their prostitutes to the bitter end.
http://www.80vul.com/mhtml/Hacking%20with%20mhtml%20protocol%20handler.txt
Who writes these Headlines. It's not a NEW bug it's an (possibly) un-noticed OLD bug.
It goes so fast that those little buggies just can't get out of the way. Besides, they are drawn to the light.
Hi MR AC! If you would have read TFA or even TFS (I know I know, but I got bored) you would see they provide a link to The MSFT "fix it for me" page for this problem. Just click on "fix it for me" run the fix it, and that's it. Don't even need a reboot.
I'm sending the link to my customers and family now, and since it makes a restore point before applying it is easy to undo if you need to, although with previous "fix it for me" tweaks that I've run the MSFT patch released later took care of the fix it tweak before applying the patch.
Oh I so trust Microsoft to not have any ill intentions regarding previously undocumented operations. And remember those disgusting and insulting commercials from MS for the "release party" for the latest os? Yea the above quote doesn't smack of that at all...
From the Software company that still refuses to acknowledge Back Oriface was a threat to "Here, take this pill trust us" .
F You Microsoft.
- Dan.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
Not a problem for my Vic 20 or my Linux powered Acer Aspire REVO Nettop.
Linux /obligatory
Wow. What a sorry ass faggotty little cock sucker you are. Mommy will come rub your penis to make you feel better.
Well, some of us don't fscking care. WTF is MHTML?!?
Holy boring, Batman.
"Tongue tied and twisted, just an Earth bound misfit
The bug's not new... in multiple editions of Windows; that means it's been around for quite a while.
Newly discovered, yes, but in the average month there are over 20 serious newly discovered bugs in Windows. And there are millions more where that came from.
Filter error: You can type more than that for your comment.
What EXACTLY is wrong with system restore? I've found especially with my click happy love to install software customers and relatives having a "quick undo" button comes in damned handy! Now of course system restore is in no way shape or form a substitute for backups, which is why I have them set up with weekly differentials and full backups monthly on USB HDDs, but you can't expect them to run a differential every time they want to try something new.
And who cares about "gigabytes" of anything anymore? Hell the lowest machines I sell have 500GB HDDs and even the kids P4 hand me downs have 400Gb drives, so why would anybody care? It isn't like huge drives are expensive.
So I really don't see what the problem is with system restore. For a quick undo button it works just fine, with huge drives worrying about 20-50Gb being reserved for system restore is frankly pointless when everyone has more space than they know what to do with, and when used with a combination of good AV, weekly backups, and a lower risk browser like Firefox or Chrome with ABP it does just what it should do, which is provide a quick way to roll back changes if something goes wrong. So what EXACTLY is so bad about it, because frankly I haven't seen a problem with system restore since XP SP2 came out.
ACs don't waste your time replying, your posts are never seen by me.
Because its reliability is spotty at best, its a haven for viruses (super-duper-hidden System Volume Information ftw!), and you never know what it will and will not break.
I think you meant ActiveX. ASPX is a server-side technology; I doesn't require browser support.
MSIE just shot itself in the foot.
MHTML is a microsoft-ism
If you do not use the worlds-most-villified-browser, and if you have also not explicitly installed a plugin (or otherwise) to enable MHTML support in our *much less sucky* browser, then you are golden.
Visit CryptoGnome in his home.
This makes me glad I use Google Chrome. As well as the speed, of course.
Goddamned monolithic systems... Insecure components breaking entire installations, where the components themselves are not used more than once a year perhaps. Way to go, Microsoft, seems you're religious about all of it.
Now you link to some blogpost/article on some random site, which only rehashes what Microsoft's own article at teched has to say as well..
Link to direct advisory:
https://www.microsoft.com/technet/security/advisory/2501696.mspx
Never underestimate the relief of true separation of Religion and State.
Now we can finally run native code in a mainstream browser?
If Pandora's box is destined to be opened, *I* want to be the one to open it.
The summary states, "which could allow an attacker to run code on vulnerable machines," however both the linked blog and the advisory from Microsoft both clearly state that this is an XSS vulnerability that could lead to Javascript being executed within the browser in the context of the current web site. This is an information disclosure vulnerability, not a remote code execution vulnerability.
Citation please? Because both Comodo (which I prefer for the click happy) and MSE (which I prefer for the "just check their email" types) routinely scan system restore points and will delete them if a bug is detected. And as for system restore breaking anything? I honestly haven't seen any behavior of the sort, both in customers or family, since XP SP2 came out. As a SOP before having them restore from a backup I have them attempt a system restore rollback and frankly as long as there is a point before the error I haven't seen it fail yet, hell with Win 7 you can even run system restore using the DVD if for one reason or another the machine won't boot.
So unless you've got current citations of some widespread problem I haven't heard about I'm gonna have to say you're going on old info, right up there with "Windows suffers from lots of BSODs" (not unless you have seriously flaky drivers or hardware, and in Win 7 not even then) "ATI drivers suck in Windows" (IME not since AMD bought them, everything after that runs as well as Nvidia) or the classic "All AMDs run too hot" (not since the old Athlon XPs, most of their chips are 95w or below now).
I'll be the first to admit the first gen system restore sucked and suffered from what you describe, but then again it was on WinME which was a mistake all around. Once XP became the mainstream with SP2 all the AV companies simply added scanning to sysvol which took care of the "restoring a bug" bit, and if you are running a good AV (like those mentioned above) frankly you shouldn't be able to get a bug in the first place without PEBKAC intervention. And also since SP2 the tech around system restore has matured to the point it "just works" and as I said I have clients and family as well as myself on both XP and Windows 7 use it and I've yet to see a problem caused by using system restores.
Hard drives are big and cheap, it doesn't use CPU unless it is making a restore point which with triples and quads so cheap most of the people I deal with have plenty of cycles to spare and even the kids hand me downs are Pentium duals, and it is certainly quicker and easier to use a system restore than have to restore from a full or differential backup, so what's the problem?
ACs don't waste your time replying, your posts are never seen by me.
nice. LOL
The Admin and the Engineer
I continue to be amazed by all of the crap that can be invoked within your browser upon demand by the operators of any web site on the planet by default.
There are browser security bugs..but they seem to be just the tip of the iceburg. Most of this extraneous crap most can live without but it is still there for anyone with some spare time to expliot regardless.
Since MHTML is a web archive format that is also used by MS Word, perhaps there's a possibility of issues there too.
Since the article/advisory don't really say what MHTML is (It's not Microsoft HTML!), here's the wikipedia description for those not motivated to look it up:
"MHTML, short for MIME HTML, is a web page archive format used to combine resources that are typically represented by external links (such as images, Flash animations, Java applets, audio files) together with HTML code into a single file. The content of an MHTML file is encoded as if it were an HTML e-mail message, using the MIME type multipart/related. The first part of the file is normally encoded HTML; subsequent parts are additional resources identified by their original URLs and encoded in base64. This format is sometimes referred to as MHT, after the suffix .mht given to such files by default when created by Microsoft Word, Internet Explorer, or Opera. MHTML is a proposed standard, circulated in a revised edition in 1999 as RFC 2557"
One gripe I have about the story as posted here, which is NOT a problem in the linked article or advisory, is calling the bug NEW. While a particular researcher discovered it recently, it is not safe to assume that no one else knew about it. This affects XP, meaning it could have been used anytime over a number of YEARS. While it's easy to only raise eyebrows over issues actively doing widespread damage or causing net congestion, it is always possible that someone else out there has discovered an issue and has written code to exploit it, but just hasn't used it yet, or has kept it for focused attacks on specific targets. To an individual, organization, or government that gets hit it may not be matter much whether an exploit has seen much use elsewhere. We should not trivialize vulnerabilities by acting as if they were only a potential danger during a very brief window. There certainly are those out there who won't report vulnerabilities for fixing and have a virtual tool chest of exploits to unleash whenever they see a reason to.
A secret weapon would likely be far more effective than one a target has had time to prepare for.
Security policies should be designed to defend against unknown vulnerabilities. Being current with patches isn't enough. While OSes with a better track record than Windows don't see the mass-market exploits, that doesn't mean that their vulnerabilities wouldn't get exploited under some circumstance. Being hit by a little used or unknown exploit may actually have more impact on a target with it being less likely to be discovered.
I don't like it because it's not clear what exactly it does. If I want to remove some application I'd only use a clean uninstaller, not some generic tool that attempts to overwrite changes to certain unspecified locations.
Slashdot,
where art thou haters of Microsoft? Whence does a man calling out Microsoft get beaten like a straight man in a gay parade?
TO HELL with mod points, Microsoft bought Slashdot...
- Dan.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
If you have a virus that is infecting system restore points, your antivirus isnt going to be detecting anything-- its already been subverted. If you dont understand this, then youve bought into the whole "AV will protect you from viruses, full stop" myth, and obviously havent had to deal with many infections (client or otherwise).
As for it not breaking things, it certainly is possible and Ive certainly seen it; whether that was recent is moot, as once I realized how much of a waste of time it was, I stopped using it. Every time Ive tried to use it, it has ended up not fixint the issue, where I would have been better off doing a repair installation, or manually fixing whatever the issue was (be it through MSI cleanup utility, or autorun inspection tools, or sfc scan, or chkdsk /p).
And heres the real kicker-- if i want the ability to quickly undo changes (like, im about to attempt some rather dangerous registry edits), ERUNT kicks the crap out of system restore-- it always (ALWAYS, baring fs corruption) works, can be restored offline, and doesnt use gigs and gigs of data.
You can argue that its a good alternative for home users who dont know how to do such things-- and I would concede that I have met a few people who mentioned "we had bug X, but fixed it with a system restore", but such stories typically end with "but now we have bug y, can you fix it?" At the end of the day, if i am going to be running systems repairs for friends and families, id much rather they not much around with system restores, given the potential issues that can happen if a restore fails, or breaks Norton's AV to such an extent that nothing works, or trashes something unexpected.
So maybe for someone who has noone to help them out on the technical side of things, it is a boon; but I cannot see a SINGLE scenario where I would not be better served with either
A) fixing the issue by hand
B) reinstalling the operating system
C) just set up ERUNT on all of my computers and use that instead
Whence does a man calling out Microsoft get beaten like a straight man in a gay parade?
When said man acts like a "faggotty little cock sucker", is when.
Uhhh...you DO know that you can have an infected file that isn't active yes? That most of the malware today use social engineering and are Trojan based, which means the user has to launch it first to cause an infection? As for AV the last tests I saw with Comodo were 98.4% and MSE something like 96.something%. So when combined with a more secure browser like Firefox or Comodo Dragon with Adblock Plus the odds are EXTREMELY low of getting a bug that the user doesn't explicitly install.
And whether it was "recent or not" is anything BUT moot as trying to base assertions on things you saw 7 or 8 years ago is FUD, no different than saying "Windows uses DOS!","Macs can't multitask!" or "Linux is a hobbyist OS built in Linus' basement!" because while those statements were true over a decade ago time has marched on and they simply aren't true now.
And can you please show me ANYWHERE where I said to use system restore for virus removal? Because now you are building strawmen as I NEVER said anything of the sort. I said "having a "quick undo" button comes in damned handy! " and "you can't expect them to run a differential every time they want to try something new." Now nowhere in that can you find a single word about using system restore for virus removal, in fact if you have gotten to the point you are infected the battle is already lost.
But for removal of buggy software or drivers, especially in XP where apps have a nasty habit of shotgunning system32 with DLL crap? System restore is a wonderful thing to have. And the fact that you refuse to say whether your experience is recent or not (hell you could be talking WinME) leads me to place your statements without citations into the FUD bin.
ACs don't waste your time replying, your posts are never seen by me.
In that case, who really cares? I'm pretty sure that almost none of the /. crowd uses the retarded browser in the first place.
http://archeleus.com/blog
That most of the malware today use social engineering and are Trojan based, which means the user has to launch it first to cause an infection
Youll need to cite a source for that, anecdotal evidence (the several hundred infections i deal with per year) shows that the vast vast vast majority of infections do not require such crude interaction; they rely on browser and plugin exploits to launch no-click infections.
As for AV the last tests I saw with Comodo were 98.4% and MSE something like 96.something%
No AV that I have seen has detection rates quite that high. Last comprehensive study I saw (about a year ago) showed the top contenders hovering around 81% detection on unknown binaries. MSSE is certainly quite decent, but AGAIN, if you have something dropping stuff in SystemVolume Information, it already has a minimum of administrator priveleges, and most likely SYSTEM priveleges (given the permissions on that folder). It has already circumvented whatever AV you have, and probably already patched your bootloader. This very day I had to disinfect a computer running MSSE, since it had been rootkitted, and MSSE saw no issues (nor did I at first glance, till I launched combofix).
you saw 7 or 8 years ago is FUD
I deal with computers for a living; Im an IT consultant, and do a number of jobs for friends and family. I have seen these last two years cases of system restore either only partially working, or failing, or messing things up. Regardless, I do not want them messing with the "evidence"; my job is to figure out the issue and correct it, and people making changes post-problem do not make my job easier.
And can you please show me ANYWHERE where I said to use system restore for virus removal
I do not believe I implied that; certainly such a use would fail. However, the functionality itself can lend itself to hiding viruses as it leaves a section of the drive that most are unaware of, and many programs do not have priveleges to see. And again, if stuff is getting dropped in there, you are mistaken if you think your AV picking it up means "problem solved"; you are still rootkitted.
But for removal of buggy software or drivers, especially in XP where apps have a nasty habit of shotgunning system32 with DLL crap?
DLLs in system32 are not necessarily an issue. If they are not called, they dont really do anything. Using system restore to remove buggy drivers is retarded; www.sysinternals.com has autoruns which can with 1 click disable said driver. Preface that with a registry backup with ERUNT and youre golden. No need for crossing your fingers and hoping system restore doesnt fail.
And the fact that you refuse to say whether your experience is recent or not (hell you could be talking WinME)
I wouldnt be recommending ERUNT if i was talking WinME, as that is most certainly NOT NT, and ERUNT would not function on it. I have scant experience with ME, and extensive (and ongoing) experience with XP.
because while those statements were true over a decade ago time has marched on and they simply aren't true now.
Again, I dont see how system restore does a job that is not done far better by one of the methods I mentioned. Troubleshoot the problem rather than trying to do a ghetto pseudo rollback which may or may not fix an issue and may or may not hose certain programs. Want quick reversion of changes? Use ERUNT.
Whence does a man calling out Microsoft get beaten like a straight man in a gay parade?
Calling out? Looks more like you're just doing the standard 'i don't trust microsoft' spiel, doesn't appear you're calling them out on anything legitimate.
Anyone have the link of the infected website, where i could test if my work machine is vulnerable....just kidding.
Hi Peach Rings! You don't know what it does? Well allow me to elucidate!
When you choose to make a restore point Windows first makes a backup of the registry (which is what takes a few seconds when you first choose to make a point) it then monitors the file system during software installations (which have to conform to standard conventions which is why if you want a particular installation monitored you should change the name to "setup.exe" in case they use a funky installer) and uses Volume Shadow Copy to make backups of any file the installer alters or replaces. Then if you choose to use system restore it replaces any alterations in the registry or file system with the backups, and voila! System Restore.
But this is why when you do a system restore you may find an empty folder of the original program name in /user name/programs, because system restore is monitoring for changes in the Windows and Users settings but doesn't care about simply making a new folder in programs. As I said I wouldn't recommend these instead of backups, and if you want an even more robust system (especially on WinXP) I would use Comodo Time Machine which provides a boot up recovery option AND seems to catch any and all alterations done by installers better than System Restore (and it uses VERY little resources to boot) but for a built in recovery and undo button system restore works and works quite well.
ACs don't waste your time replying, your posts are never seen by me.