New Critical Bug In All Current Windows Versions

Trailrunner7 writes "Microsoft is warning its users about a dangerous flaw in the way that Windows handles certain MHTML operations, which could allow an attacker to run code on vulnerable machines. The bug affects all of the current versions of Windows, from XP up through Windows 7 and Windows Server 2008. Microsoft issued an advisory about the MHTML vulnerability, which has been discussed among security researchers in recent days. There is some exploit code available for the bug, as well. In addition to the advisory, Microsoft has released a FixIt tool, which helps mitigate attacks against the vulnerability in Windows."

Comments

Knowledge Base containing Fixit Link

[Nuisance]

Would be nice to have seen these in the article...

http://support.microsoft.com/kb/2501696

Re:Knowledge Base containing Fixit Link

[icebike]

Perhaps also useful would be a hint that simply avoiding Internet Explorer would provide all the protection from this bug that is needed.

Re:Knowledge Base containing Fixit Link

[CastrTroy]

I can't think of any serious browser that uses the IE rendering engine. Firefox, Opera, Chrome, and Safari all use their own rendering engines. That covers 99.999% of all browsers in use.

Re:Knowledge Base containing Fixit Link

[parlancex]

Many applications that display embedded HTML would be at risk. Those applications include Steam, MSN Messenger and others, etc.

Re:Knowledge Base containing Fixit Link

[EvilIdler]

Steam uses WebKit now, so no problem there. MS products are of course always at risk while there are vulnerabilities in the IE engine.

Re:Knowledge Base containing Fixit Link

[TheLink]

Uh that's all the data most of their users need. Most of their users want a simple "FixIt" (that's how they often get into trouble in the first place, but that's not MS's fault). Most of these users aren't going to even know about this problem though. They'll only get a fix if MS ever releases it in a Windows Update and they have Windows Updates enabled.

As for the rest of the users who actually care to know more: https://www.microsoft.com/technet/security/advisory/2501696.mspx
The very few who are that interested can find out even more details themselves.

So it's inaccurate to say MS doesn't give a shit about this problem.

Investing

[cosm]

Can I just say that now is probably a good time to invest in the tech industry. Since /. has redesigned the site, I believe productivity levels in the industry will be on the rise due to the number of commenters leaving in droves.

Re:Investing

[Anonymous Coward]

I'd mod you up but moderation is broken on opera

Re:Investing

[lowlymarine]

Clearly it's just your horribly dated hardware. Everything's fine on my i7-2600k, time to get with the times grandpa!

Re:Investing

[artor3]

And I'd mod you down, but doing so would make my post (and all other child posts) invisible as well. Heck, since you posted as AC, odds are no one will ever know this post was here.

Re:Investing

[Culture20]

Assuming you're using the javascripty version of Discussion2
Take a look at your process list. Your browser is eating at least one of your cores. open a few more /. windows. Feel the burn. My single core machine was dying with just one window open. I had to go back to Discussion1 and flag /. with noscript. http://slashdot.org/users.pl?op=editcomm

Re:Investing

[dave562]

I would reply to this, but if you were to reply back to me, I would have to drill down through a whole slew of posts to find what you wrote. Where as previously I could just go to http://slashdot.org/~dave562/comments and then click on the comment you replied to. It would bring up a nice, EXPANDED tree view of the discussion thread.

One step forward, two steps back? Ah hell, who am I kidding. We all know that three steps were taken, but they were all in the same direction.

Re:Investing

[Cthefuture]

Is it just me or does the front page not show the number of comments any more? I really liked that and now it feels weird.

Any way to turn it back on?

Re:Investing

[seifried]

I think they've "pulled a Digg"

Re:Investing

[WrongSizeGlass]

Now inline commenting and moderation is fucked up, All they want to do is create a site for "people that use Safari browser".

I see they finally got my letters! Yay Slashdot!

Re:Investing

[icebraining]

Classic version ftw. It doesn't use more than 6-7% of one core (AMD AthlonII X4 620).

Re:Investing

[DAldredge]

I would mod you up but /. hasn't given me mod points for 3 or 4 years.

Re:Investing

[rudy_wayne]

Why mod me down for Using Opera? It was the ONLY browser in which /. could render properly before the redesign fuck up.

Now inline commenting and moderation is fucked up, All they want to do is create a site for "people that use Safari browser".

Slashdot is death, suck it

Every since the "new design" displaying posts has been fucked up. In Firefox, my normal browser, a small bit of the far left of each post is cut off. Ironically, I decided to try Internet Explorer (v8) and I am writing this reply in IE which displays the "new" Slashdot better than Firefox.

How interesting.

Re:Investing

[Mr. DOS]

Sorry, but the 10 mod points is because you've been singled out (check the question “Why do I have 10 moderator points instead of the usual 5?” under Comments and Moderation), not because of the new design.

Re:Investing

[dbIII]

For one thing I intensely hate how the sidebar on the left obscures a few columns of article and comment text until about 4/5 of the way down the screen on firefox FFS. If they can't get it right for the current firefox on linux (and I'm assuming other platforms) then where does it work? Is this an iPad only site at the moment?

Re:Investing

[ikkonoishi]

I must be a moderating god because I get mine in chunks of 15. O_o

Yes. The power! Its going to my head. I am the mod god! Its me!

Re:Investing

[uvajed_ekil]

You're right, I'm not seeing the number of comments, either. I liked having it - I knew instantly if there was a big buzz about something, or if taking time to throw in my two cents might matter for a stalled thread.

Re:Investing

[nmb3000]

It's so frustrating how correct you are. I used to enjoy reading comments to a story, but now it's essentially impossible because of how BROKEN the scrolling is (at least in Firefox and IE). Scrolling using the mousewheel is slow as hell and when using the keyboard it's very unresponsive. That and the new style is hard to read and has too much whitespace. I feel like I'm staring at a lightbulb trying to read gray text.

For me this redesign has just demonstrated why I hate web 2.0. You are held hostage at the whims of moron marketing people and crappy devs like those behind the driving force of this redesign. It serves absolutely no meaningful purpose, is worse than the previous design, and everyone hates it. As you noted, fewer people are commenting, and if it doesn't improve people won't come back.

Taco - Why can't you wait until you have something that's actually better than the previous version before releasing this crap on us? Or do you not have a dev/staging system in place and this is your way of testing it? Waiting for people to come up with Stylish hacks to fix your useless and broken CSS? Just wondering.

Re:Investing

[Sponge Bath]

./ needs an online FPS called Mod Arena where people with mod points can wager them in virtual combat. The winners can then sculpt discussions in their own Mod God self image. For instance you could mod up all posts about Lord of the Rings as "+1 Super Cheetos Cool" and mod down all Star Wars posts as "-1 Decaying Franchise".

Oh, yeah. To stay on topic: Windows has security problems.

Re:Which versions

[postmortem]

WTF is a current version of Windows? 3, 95, 98, Me, 2000, XP??

Versions that are still supported actively, which are Windows XP SP3 and newer.

Re:Which versions

[PatPending]

Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2**
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2**
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems**
Windows Server 2008 R2 for Itanium-based Systems
Source: http://www.microsoft.com/technet/security/advisory/2501696.mspx
Appears to apply only to Internet Explorer

Re:Is it Windows or Internet Explorer?

[JSG]

Try using a search engine with the term MHTML and getting something like this: http://en.wikipedia.org/wiki/MHTML

On FF you'll need a plugin to "see" MHTML, whatever it is. It seems to be an unholy mix of HTML and MIME and sounds unpleasant and probably a bit unnecessary.

Cheers
Jon

Re:uhh

[hairyfeet]

Hi MR AC! If you would have read TFA or even TFS (I know I know, but I got bored) you would see they provide a link to The MSFT "fix it for me" page for this problem. Just click on "fix it for me" run the fix it, and that's it. Don't even need a reboot.

I'm sending the link to my customers and family now, and since it makes a restore point before applying it is easy to undo if you need to, although with previous "fix it for me" tweaks that I've run the MSFT patch released later took care of the fix it tweak before applying the patch.

So I don't really see why you or anyone would complain about this one. They have a quick fix that is so simple your grandma can run it, and released the fix quickly to tide people over until they have worked up a patch. I don't see how they could have done any better on this, as a full patch will take time to test and rightfully so as you wouldn't want MSFT releasing patches that break apps and/or drivers and cause more pain than the bug would you? This is easy, simple to apply, and painless to deploy. I don't see how you can get better and the guy that came up with the "fix it for me" program really deserves a raise and company car, as it really has made these fast released workarounds painless for home users..

Re:Which versions

[stoborrobots]

Appears to apply only to Internet Explorer

And anything else which uses the MHTML component, which includes many, many applications, including anything which uses the "Windows Help" system...

Re:Incorrect Article Title (Headline)

[JSG]

Well Mr six dig, RanDomCapS 'n' punctuationeer extraordinare - who can say?

Apparently someone called Timothy left their name on the article for all to see.

This: https://www.microsoft.com/technet/security/advisory/2501696.mspx

was posted 28 Jan 2011.

When did you notice the bug? - We'd all love to hear your insights on it.

Cheers
Jon

Re:Which versions

[Korin43]

Ha! And they said I should stop using Windows 98!

Re:uhh

[hairyfeet]

What EXACTLY is wrong with system restore? I've found especially with my click happy love to install software customers and relatives having a "quick undo" button comes in damned handy! Now of course system restore is in no way shape or form a substitute for backups, which is why I have them set up with weekly differentials and full backups monthly on USB HDDs, but you can't expect them to run a differential every time they want to try something new.

And who cares about "gigabytes" of anything anymore? Hell the lowest machines I sell have 500GB HDDs and even the kids P4 hand me downs have 400Gb drives, so why would anybody care? It isn't like huge drives are expensive.

So I really don't see what the problem is with system restore. For a quick undo button it works just fine, with huge drives worrying about 20-50Gb being reserved for system restore is frankly pointless when everyone has more space than they know what to do with, and when used with a combination of good AV, weekly backups, and a lower risk browser like Firefox or Chrome with ABP it does just what it should do, which is provide a quick way to roll back changes if something goes wrong. So what EXACTLY is so bad about it, because frankly I haven't seen a problem with system restore since XP SP2 came out.

Re:uhh

[LordLimecat]

Because its reliability is spotty at best, its a haven for viruses (super-duper-hidden System Volume Information ftw!), and you never know what it will and will not break.

Re:Incorrect Article Title (Headline)

[seifried]

The bug was noticed about 2 weeks ago: http://www.80vul.com/mhtml/Hacking%20with%20mhtml%20protocol%20handler.txt

Someone call teh ROFLCOPTER

[Crypto Gnome]

MSIE just shot itself in the foot.

MHTML is a microsoft-ism

If you do not use the worlds-most-villified-browser, and if you have also not explicitly installed a plugin (or otherwise) to enable MHTML support in our *much less sucky* browser, then you are golden.

Why don't you link to the Microsoft adisory?

[Otis_INF]

Now you link to some blogpost/article on some random site, which only rehashes what Microsoft's own article at teched has to say as well..

Link to direct advisory:
https://www.microsoft.com/technet/security/advisory/2501696.mspx

Re:uhh

[hairyfeet]

Citation please? Because both Comodo (which I prefer for the click happy) and MSE (which I prefer for the "just check their email" types) routinely scan system restore points and will delete them if a bug is detected. And as for system restore breaking anything? I honestly haven't seen any behavior of the sort, both in customers or family, since XP SP2 came out. As a SOP before having them restore from a backup I have them attempt a system restore rollback and frankly as long as there is a point before the error I haven't seen it fail yet, hell with Win 7 you can even run system restore using the DVD if for one reason or another the machine won't boot.

So unless you've got current citations of some widespread problem I haven't heard about I'm gonna have to say you're going on old info, right up there with "Windows suffers from lots of BSODs" (not unless you have seriously flaky drivers or hardware, and in Win 7 not even then) "ATI drivers suck in Windows" (IME not since AMD bought them, everything after that runs as well as Nvidia) or the classic "All AMDs run too hot" (not since the old Athlon XPs, most of their chips are 95w or below now).

I'll be the first to admit the first gen system restore sucked and suffered from what you describe, but then again it was on WinME which was a mistake all around. Once XP became the mainstream with SP2 all the AV companies simply added scanning to sysvol which took care of the "restoring a bug" bit, and if you are running a good AV (like those mentioned above) frankly you shouldn't be able to get a bug in the first place without PEBKAC intervention. And also since SP2 the tech around system restore has matured to the point it "just works" and as I said I have clients and family as well as myself on both XP and Windows 7 use it and I've yet to see a problem caused by using system restores.

Hard drives are big and cheap, it doesn't use CPU unless it is making a restore point which with triples and quads so cheap most of the people I deal with have plenty of cycles to spare and even the kids hand me downs are Pentium duals, and it is certainly quicker and easier to use a system restore than have to restore from a full or differential backup, so what's the problem?