Google Discloses An Unpatched Windows Bug (Again) (bleepingcomputer.com)

An anonymous reader writes: "For the second time in three months, Google engineers have disclosed a bug in the Windows OS without Microsoft having released a fix before Google's announcement," reports BleepingComputer. "The bug in question affects the Windows GDI (Graphics Device Interface) (gdi32.dll)..." According to Google, the issue allows an attacker to read the content of the user's memory using malicious EMF files. The bad news is that the EMF file can be hidden in other documents, such as DOCX, and can be exploited via Office, IE, or Office Online, among many.

"According to a bug report filed by Google's Project Zero team, the bug was initially part of a larger collection of issues discovered in March 2016, and fixed in June 2016, via Microsoft's security bulletin MS16-074. Mateusz Jurczyk, the Google engineer who found the first bugs, says the MS16-074 patches were insufficient, and some of the issues he reported continued to remain vulnerable." He later resubmitted the bugs in November 2016. The 90-days deadline for fixing the bugs expired last week, and the Google researcher disclosed the bug to the public after Microsoft delayed February's security updates to next month's Patch Tuesday, for March 15.
Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing".

Comments

Control vs. Security

[ZP-Blight]

This is what happens when control overtakes security as a priority.

Re: Control vs. Security

[Anonymous Coward]

My perception is that, for the prior MS bug and this one, the difference between Apple and Microsoft was that Microsoft didn't ask Google to delay disclosure.

If you look at, say, this one: https://bugs.chromium.org/p/project-zero/issues/detail?id=837#c3

You'll see that Apple had to request an extension, get denied it, then set up meetings to explain why they needed it, get denied a partial disclosure extension AGAIN, and then it escalated before they got a further extension.

I would have expected that MSFT could have at least gotten the 14d extension on the 90d disclosure deadline, even if they couldn't push it all the way to the next Patch Tuesday.

Re: Control vs. Security

[ArmoredDragon]

How is Google being a dick? They're following common industry practices. Public disclosure does two things:

- Deadlines put pressure on the software vendor to patch their shit sooner rather than later (without a deadline, or an unenforced deadline, they tend to just sit on bugs for a long time.)
- If the software vendor fails to patch their product, then at least the end users can come up with their own countermeasures (i.e. adding IDS signatures, switching to different software, suspending services, creating workarounds, etc) before some rogue actor takes advantage of them.

If Google didn't stick to these timelines, and/or delayed them on a whim, then there may as well be none.

Wrong Headline

[Anonymous Coward]

Shouldn't the headline be "Microsoft fails to fix exploit for months"?

Re:Wrong Headline

[moronoxyd]

Microsoft was first informed about these bugs in June 2016. That is a lot more than 90 days. They didn't manage to fix all the bugs and basically got an extension when Google resubmitted the still open bugs in November. Yet they still didn't manage to fix the bugs.

Microsoft deserved it

[bongey]

The bug was actively being used to exploit windows. Letting people know there is active exploit is more important than bad PR for Microsoft.

Re: Microsoft deserved it

[chaboud]

Which is why a 90 day disclosure to public announcement deadline is a reasonable measure. If a bug can be discovered by a nice engineer, it can also be discovered and exploited by a malicious one.

People being mad about this announcement would be akin to people being angry about leaks from Trump's administration rather than the malfeasance uncovered, which would be, you know... Ludicrous.

Or Snowden, etc...

Disappointing?

[danhuby]

> Microsoft has described Google's announcements of unpatched Windows bugs as "disappointing".

I would describe Microsoft's ability to patch these bugs within a reasonable timeframe as "disappointing".

Re:Disappointing?

[wbr1]

The correct verbiage now is as follows:

So-called tech company releases fake news. SAD!

'Disappointing', eh?

[fuzzyfuzzyfungus]

So, yet another exploit in GDI; an initial attempt at a fix that didn't actually work; a second attempt that was delayed a month(along with a reasonably juicy SMB issue; and probably some other stuff); and the disclosure is the 'disappointing' part? How eminently plausible.

Re:LibreOffice?

[fuzzyfuzzyfungus]

You can definitely embed Windows Metafile images in LibreOffice on Windows; but I'm not entirely sure if that is enough to make it vulnerable. WMF is dangerous because it is basically a package of GDI function calls, which might be good for efficiency or compactness; but has led to a number of creative and executable things being shoehorned in(as in this case; and repeatedly over the years).

However, there are several image handling libraries that can render or convert WMF images without access to GDI; so in those cases GDI bugs wouldn't be a problem(though you probably have other things to worry about).

This Libreoffice VCL documentation suggests that LibreOffice uses its own VCL WMF filters; but I sure wouldn't bet anything remotely important on that without testing it first; or knowing rather more about how LibreOffice is put together.