Slashdot Mirror
Google Discloses An Unpatched Windows Bug (Again) (bleepingcomputer.com)
An anonymous reader writes: "For the second time in three months, Google engineers have disclosed a bug in the Windows OS without Microsoft having released a fix before Google's announcement," reports BleepingComputer. "The bug in question affects the Windows GDI (Graphics Device Interface) (gdi32.dll)..." According to Google, the issue allows an attacker to read the content of the user's memory using malicious EMF files. The bad news is that the EMF file can be hidden in other documents, such as DOCX, and can be exploited via Office, IE, or Office Online, among many.
"According to a bug report filed by Google's Project Zero team, the bug was initially part of a larger collection of issues discovered in March 2016, and fixed in June 2016, via Microsoft's security bulletin MS16-074. Mateusz Jurczyk, the Google engineer who found the first bugs, says the MS16-074 patches were insufficient, and some of the issues he reported continued to remain vulnerable." He later resubmitted the bugs in November 2016. The 90-days deadline for fixing the bugs expired last week, and the Google researcher disclosed the bug to the public after Microsoft delayed February's security updates to next month's Patch Tuesday, for March 15.
Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing".
"According to a bug report filed by Google's Project Zero team, the bug was initially part of a larger collection of issues discovered in March 2016, and fixed in June 2016, via Microsoft's security bulletin MS16-074. Mateusz Jurczyk, the Google engineer who found the first bugs, says the MS16-074 patches were insufficient, and some of the issues he reported continued to remain vulnerable." He later resubmitted the bugs in November 2016. The 90-days deadline for fixing the bugs expired last week, and the Google researcher disclosed the bug to the public after Microsoft delayed February's security updates to next month's Patch Tuesday, for March 15.
Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing".
This is what happens when control overtakes security as a priority.
Zoom Player Lead Dev.
Shouldn't the headline be "Microsoft fails to fix exploit for months"?
Doesn't Google have it's own bugs to look after?
The bug was actively being used to exploit windows. Letting people know there is active exploit is more important than bad PR for Microsoft.
> Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing".
I would describe Microsoft's ability to patch these bugs within a reasonable timeframe as "disappointing".
This is a pretty disappointing spin on what sounds like actually happened.
So... March 2016 they found it and suggested a fix. The June patch by Microsoft was insufficient, so they told them (again) in November 2016 they need to fix it. Microsoft had an additional 90 days to patch the bug (which is pretty standard practice in the industry), and didn't fix a YEAR OLD bug
What was Microsoft expecting here? I would expect the same to happen to Google, Apple, or any other big company if it took them that long to fix a bug that's been known for that long.
I mean Wifi has been susceptible to SSID spoofing for all these years, and nobody will implement a solution because people don't want to believe it's a problem.
Unlike all those sensible religions.
It would be interesting to see if this security issue also affects LibreOffice on a Window$ system since it also opens docx files. Anyone know? I'm a Linux user (duh), but even I will admit to how much nicer M$ Office is. I like Apple's iWork stuff too, but having to save a document in a strictly Apple format to keep the cool stuff it'll do isn't work it vs. practicality. The day LibreOffice supports Google Drive out-of-the-box and has a mobile version, Office 365 doesn't have a chance. Also, something to note on Linux and LibreOffice, there are a whole bunch of command line cheats you can use with LibreOffice, so no GUI needed if you have enough patience. Type a doc with nano or pico and convert to a PDF with "soffice --headless --convert-to : file_to_convert.xxx" There's a lot more you can do with LibreOffice than you can M$ Office, but eye candy gets people every time.
But, they are so 'disappointed'
because they do not want to fix the bugs
in the first place and Google is pissing
them off.
Fuck you Microsoft! You have always
been in bed with NSA.
And there are more exploits to come.
Microsoft dropping Patch Tuesday is disappointing!
Microsoft, owner of Skype (which Microsoft changed specifically for spying, not that Skype was trustworthy under its previous owner either as The Guardian tells us, "Eight months before being bought by Microsoft, Skype joined the Prism program in February 2011.") and NSA "provider" since 2007-09-11 (the NSA's first PRISM provider) wants us to understand their "commitment to our customers' security". Apparently that commitment is as little as they can get away with.
That's true of every software proprietor, Google included. The problem is the lack of software freedom which is designed to leave users at the mercy of the only programmers allowed to inspect, alter, and publish improvements to the proprietary software—these are the very programmers users couldn't trust with their security in the first place.
Digital Citizen
Not defending Microsoft, but it is kind of funny that people are complaining about MS record .... when Google's Android is the new Windows ME ... full of security holes, unstable, full of built-in spyware and (for the most past) not getting patches.
The bad news is that the EMF file can be hidden in other documents, such as DOCX, and can be exploited via Office, IE, or Office Online, among many.
Can we hear about other attack methods? So far this sounds like an issue that isn't going to impact people not using Microsoft Office or DOCX files.
So, yet another exploit in GDI; an initial attempt at a fix that didn't actually work; a second attempt that was delayed a month(along with a reasonably juicy SMB issue; and probably some other stuff); and the disclosure is the 'disappointing' part? How eminently plausible.
Why are we are trusting these people to provide widely-used software, again?
A reasonable time-frame to patch security vulnerabilities is like 2...4 weeks. 90 days is already stretching it considerably and they still are too incompetent or uncaring to make that long deadline. Google is doing the right thing here. If incompetent and lazy vendors are not forced to fix security vulnerabilities, they will never do it. It is just utterly pathetic that we allow MS to be one of these worst offenders.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
So you are advocating that because one house is burning to ignore the other one that is also burning? Sounds stupid.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I think Microsoft should find 0-day security flaws in Google's services and announce them.
What a proud step for Google.
Attacking Grandmothers and the common man. Lashing out at the world for not bowing down to their awesome power and making sure the boot of google power firmly holds down anyone disloyal or unwilling to be a google toady.
Gleefully taking a historic situation of a technical issue with a regular security update, and attempting to hurt as many people as possible. You can almost smell the burnt flesh in Google cafeterias this week. Lunching of the dead carcasses of their opponent.
Nothing quite so proud as a company using defenseless victims to enrich its already rich taskmasters.
Meanwhile encouraged by a horde of loyal foot-soldiers, giddy at a taste of blood, unable to see past their hate of everyone more successful than them, the Google apologists will be out in full force, their pride evident. What a glorious company to support. What fools anyone opposed to them are.
What a proud day to be a Google supporter.
I patched my gdi32.dll in just 15 minutes without the source. Fire-up your IDA debugger and Softice then trace all related to EMF calls to track the location of those buggy codes then hexedit. More than 1 year is a lot for insiders with source code.
...make sure you upgrade to windows 10. It's the most secure operating system ever....lol. That's laughable. Surely, microsoft is supporting the other versions that are still relevant?
Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing"...
Perhaps if Microsoft wasn't so focused on making the Microsoft Telemetry OS (a.k.a. Windows 10) to feed unethical revenue channels, they would be more concerned about Security in their products.
In short, Screw You, Microsoft, for having the unmitigated gall to make such a statement after having months to fix your shit. I would suggest that you should start taking Security seriously, but you've failed to do that for decades now. Don't even know what to say about your new-and-improved patch process other than par for the course.
these days I'm much more inclined to trust M$
because forced windows 10 ?because forced windows 10 ?because forced windows 10 ?
I don't know about you, but I'd focus on putting all the fires out at my home, before wandering the neighborhood looking for other fires.