Slashdot Mirror
Google Discloses An Unpatched Windows Bug (Again) (bleepingcomputer.com)
An anonymous reader writes: "For the second time in three months, Google engineers have disclosed a bug in the Windows OS without Microsoft having released a fix before Google's announcement," reports BleepingComputer. "The bug in question affects the Windows GDI (Graphics Device Interface) (gdi32.dll)..." According to Google, the issue allows an attacker to read the content of the user's memory using malicious EMF files. The bad news is that the EMF file can be hidden in other documents, such as DOCX, and can be exploited via Office, IE, or Office Online, among many.
"According to a bug report filed by Google's Project Zero team, the bug was initially part of a larger collection of issues discovered in March 2016, and fixed in June 2016, via Microsoft's security bulletin MS16-074. Mateusz Jurczyk, the Google engineer who found the first bugs, says the MS16-074 patches were insufficient, and some of the issues he reported continued to remain vulnerable." He later resubmitted the bugs in November 2016. The 90-days deadline for fixing the bugs expired last week, and the Google researcher disclosed the bug to the public after Microsoft delayed February's security updates to next month's Patch Tuesday, for March 15.
Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing".
"According to a bug report filed by Google's Project Zero team, the bug was initially part of a larger collection of issues discovered in March 2016, and fixed in June 2016, via Microsoft's security bulletin MS16-074. Mateusz Jurczyk, the Google engineer who found the first bugs, says the MS16-074 patches were insufficient, and some of the issues he reported continued to remain vulnerable." He later resubmitted the bugs in November 2016. The 90-days deadline for fixing the bugs expired last week, and the Google researcher disclosed the bug to the public after Microsoft delayed February's security updates to next month's Patch Tuesday, for March 15.
Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing".
This is what happens when control overtakes security as a priority.
Zoom Player Lead Dev.
Shouldn't the headline be "Microsoft fails to fix exploit for months"?
The bug was actively being used to exploit windows. Letting people know there is active exploit is more important than bad PR for Microsoft.
> Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing".
I would describe Microsoft's ability to patch these bugs within a reasonable timeframe as "disappointing".
This is a pretty disappointing spin on what sounds like actually happened.
So... March 2016 they found it and suggested a fix. The June patch by Microsoft was insufficient, so they told them (again) in November 2016 they need to fix it. Microsoft had an additional 90 days to patch the bug (which is pretty standard practice in the industry), and didn't fix a YEAR OLD bug
What was Microsoft expecting here? I would expect the same to happen to Google, Apple, or any other big company if it took them that long to fix a bug that's been known for that long.
That's a design flaw that affects all platforms. Microsoft can't single handedly fix SSID spoofing. This article however describes a bug in Microsoft code.
It would be interesting to see if this security issue also affects LibreOffice on a Window$ system since it also opens docx files. Anyone know? I'm a Linux user (duh), but even I will admit to how much nicer M$ Office is. I like Apple's iWork stuff too, but having to save a document in a strictly Apple format to keep the cool stuff it'll do isn't work it vs. practicality. The day LibreOffice supports Google Drive out-of-the-box and has a mobile version, Office 365 doesn't have a chance. Also, something to note on Linux and LibreOffice, there are a whole bunch of command line cheats you can use with LibreOffice, so no GUI needed if you have enough patience. Type a doc with nano or pico and convert to a PDF with "soffice --headless --convert-to : file_to_convert.xxx" There's a lot more you can do with LibreOffice than you can M$ Office, but eye candy gets people every time.
It's almost like companies can have different functions being tackled by different teams.
Microsoft dropping Patch Tuesday is disappointing!
Microsoft, owner of Skype (which Microsoft changed specifically for spying, not that Skype was trustworthy under its previous owner either as The Guardian tells us, "Eight months before being bought by Microsoft, Skype joined the Prism program in February 2011.") and NSA "provider" since 2007-09-11 (the NSA's first PRISM provider) wants us to understand their "commitment to our customers' security". Apparently that commitment is as little as they can get away with.
That's true of every software proprietor, Google included. The problem is the lack of software freedom which is designed to leave users at the mercy of the only programmers allowed to inspect, alter, and publish improvements to the proprietary software—these are the very programmers users couldn't trust with their security in the first place.
Digital Citizen
The bad news is that the EMF file can be hidden in other documents, such as DOCX, and can be exploited via Office, IE, or Office Online, among many.
Can we hear about other attack methods? So far this sounds like an issue that isn't going to impact people not using Microsoft Office or DOCX files.
So, yet another exploit in GDI; an initial attempt at a fix that didn't actually work; a second attempt that was delayed a month(along with a reasonably juicy SMB issue; and probably some other stuff); and the disclosure is the 'disappointing' part? How eminently plausible.
Why are we are trusting these people to provide widely-used software, again?
A reasonable time-frame to patch security vulnerabilities is like 2...4 weeks. 90 days is already stretching it considerably and they still are too incompetent or uncaring to make that long deadline. Google is doing the right thing here. If incompetent and lazy vendors are not forced to fix security vulnerabilities, they will never do it. It is just utterly pathetic that we allow MS to be one of these worst offenders.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
So you are advocating that because one house is burning to ignore the other one that is also burning? Sounds stupid.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing"...
Perhaps if Microsoft wasn't so focused on making the Microsoft Telemetry OS (a.k.a. Windows 10) to feed unethical revenue channels, they would be more concerned about Security in their products.
In short, Screw You, Microsoft, for having the unmitigated gall to make such a statement after having months to fix your shit. I would suggest that you should start taking Security seriously, but you've failed to do that for decades now. Don't even know what to say about your new-and-improved patch process other than par for the course.
I don't know about you, but I'd focus on putting all the fires out at my home, before wandering the neighborhood looking for other fires.