Slashdot Mirror
Windows 0-Day Exploited In Ongoing Attacks
An anonymous reader writes: Microsoft is warning users about a new Windows zero-day vulnerability that is being actively exploited in the wild and is primarily a risk to users on servers and workstations that open documents with embedded OLE objects. The vulnerability is currently being exploited via PowerPoint files. These specially crafted files contain a malicious OLE (Object Linking and Embedding) object. This is not the first time a vulnerability in OLE has been exploited by cybercriminals, however most previous OLE vulnerabilities have been limited to specific older versions of the Windows operating system. What makes this vulnerability dangerous is that it affects the latest fully patched versions of Windows.
UAC will display a warning, this exploit only touches users who run as admin.
I don't think any still supported version of Windows defaults to admin.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Linux is not good, damn full of bugs, heartbleed, shellsock and now THIS!!! Crap, wait, I must have made some mistake ;)
....Don't ever change you magnificant bastard.
Yeah, you defflinitely have "allow" it. But most people don't read half the messages excel or powerpoint throw at them. Just accept, accept, open, enable, install, install. Why do we even make botnets... I'm sure the users would do it on their own if they were prompted.
Just download this handy powerpoint slideshow and I think you'll find it explains how this attacks works in perfect detail...
Computers suck. Gotta love how an office document can compromise your system. Can we just use txt files and get away from Executable documents
Really? Who installs PowerPoint on the server? Cause you are gonna be all like, hold up let me unrack this server and connect a projector to it...right.
...yours
Thank you Dave Raggett
+1
Why do we need multiple rendering engines? There should be one to rule them all. It seems that even large companies like microsoft can't fix all issues, and microsoft has to maintain multiple rendering engines, like Trident or the Office rendering engine. If microsoft would use trident for office documents, too, and all plug-ins were made in js (or NaCL if you like binary), Office could profit by the huge efforts Microsoft (and Google) puts into securing Browsers.
If you're a security remediation specialist for the I.T. department, Windows is job security as these problems will never go away.
If you leave one hole in Windows unpatched, soon there will be more.
Who the fsck embeds OLE objects in PowerPoint.
I have enough trouble getting text to display.
... and if the one rendering engine was used, the moment an exploit becomes available, all systems are vulnerable. Haven't we learned about the dangers of monocultures yet?
One is used in-browser but the same thing.
The problem is MS never had a small tutorial during windows installation or during the first boot showing users how to create a Standard User account and have an administrative account for elevating your rights for doing administrative stuff. But now, with windows 8 during the install, you can create any type account you like, but again, no tutorial.
Yes, tones of people do that already, it's called TeX or LaTeX. It probably takes about as long to learn as Word does anyway. The huge benefit of using LaTeX is that its fairly backward/forward compatible, unlike Word. Want a text based visio replacement? Try dot. Powerpoint? Don't know, don't care, make a multipade LaTeX document and just page up/down the output pdf/dvi. I don't really care much for powerpoint. Get started with LaTeX now.
Why UNIX?
We're working on it. We got rid of monocles, except in very isolated instances, so monocultures are next, alphabetically.
Sleep your way to a whiter smile...date a dentist!
... almost every doc I open is opened in a locked state, Windows tosses up a message asking if I want to unlock it to make changes, or even to print it, I believe. That's a great way to train your users to click "OK" to every message they see.
Never let a lack of data get in the way of a good rant.
PowerPoint - nothing else even comes close. As engineers we don't care about it, but there are just as many people who live and die by the PowerPoint presentation (literally in some cases, as the US military leadership is sadly all about the PPT these days).
SmartArt is freaking magic for some people. It's exactly the sort of automation that LaTeX would be great at, but presented visually, not as "yet another programming language for those geeks." Like VI or EMACS, PowerPoint will always be with us: it's that central to a culture.
Socialism: a lie told by totalitarians and believed by fools.
That's an office software vulnerability, which is slightly less bad than heartbleed or shellshock
FTFY.
IIRC, Powerpoint uses the same DatadiagramML standard. And these "whatever-ML" standards that Office uses are now part of OOXML (yeah, yeah, ODF blah blah blah), and are embedded into a zip file for packaging. That's all the docx, xlsx, pptx, and vsd formats are anymore. Everything since Office 2007 has used this XML-in-a-zip-archive format by default, with ever-more deprecated support for OLE with each new version.
Runner-up for text-based Visio replacement goes to: Visio (again) for it's SVG export capability. To be fair, its SVG export is no better than anyone else's. It's just that Visio's interface (IMO, of course) beats all comers until they're a gelatinous pile of formerly-structured matter. Even the "mighty" Adobe Illustrator is an imprecise pain-in-the-ass by comparison. It is, however, more "artsy" (and possibly more "fartsy" as well) and less "boring-ass systems diagrammy".
Word sucks, though. It's gotten better with 2010 and later, but it still pretty much sucks. Too much baggage, not enough actual need for pretty documents beyond what HTML can provide. I only use it when I just don't have the time or give-a-damn to make up an HTML document. I've never had sufficient give-a-damn to even start using *TeX (or click your "get started" link).
Well, we mostly use Libreoffice at work. Are we vulnerable if we open a powerpoint file in Impress?
***not exclusive to windows
Use Linux.
aaaaaaa
Quick yes or no question: Will this Pwn boxes with Windows XP on them?
Using the SSL Version Control add-on for Firefox, I see that to get to the Microsoft Security Advisory linked to in the summary, I have to downgrade from TLS 1.2 to 1.0. So there's one more thing that needs to be upgraded!
Writing a program that demands admin rights when it does not need them (eg. to put a lock file in the root of the system drive instead of elsewhere for a purely arbitrary reason) is even lazier.
Sometimes it's better to go after the root cause of the problem and get the developers that have been left behind to understand that it's the 21st century and their desktop software is likely to be running in a multi-user, networked, multi-core, 64 bit environment. There are far too many that can't even get ONE of those things in the list right which is a major part of why so many MS Windows systems are drowning in a malware swamp. We need to get away from the "we've always done it this way" culture of being acceptable when the way it's "always been done" only makes sense on single user systems with no network connection.