Slashdot Mirror
Third-Party Vendor Issues Temporary Patch For Windows Vulnerability (bleepingcomputer.com)
An anonymous reader writes: "A vulnerability discovered by Google Project Zero security researchers and left without a patch by Microsoft received a temporary fix from third-party security vendor ACROS Security," according to Bleeping Computer. Microsoft is set to officially patch the flaw on March 15, after it previously pushed back February's Patch Tuesday for next month.
"According to Google researchers, attackers could leverage malformed EMF files to expose data found in the victim's memory, which can then be leveraged to bypass ASLR protection and execute code on the user's computer... ACROS Security has issued a temporary patch that can be applied to Windows computers via its product, called 0patch, a platform that applies fixes for zero-days, unpatched vulnerabilities, end-of-life and unsupported products, for legacy OSes, vulnerable 3rd party components, and customized software." When Microsoft issues an official update, the temporary patch will stop working immediately.
"According to Google researchers, attackers could leverage malformed EMF files to expose data found in the victim's memory, which can then be leveraged to bypass ASLR protection and execute code on the user's computer... ACROS Security has issued a temporary patch that can be applied to Windows computers via its product, called 0patch, a platform that applies fixes for zero-days, unpatched vulnerabilities, end-of-life and unsupported products, for legacy OSes, vulnerable 3rd party components, and customized software." When Microsoft issues an official update, the temporary patch will stop working immediately.
APK's HOSTS file will protect me.
did they get a court order from the NSA, because they need time to exploit it? Apple has done the same in the past, waiting up to 10 months fixing flaws that were critical, but had trivial solutions.
M$ seems to be blowing it right and left so why not?
Why the fuck does a browser load an EMF file?
How about locking it down to js, css, html, png, gif, and jpg?
What's next? Direct in-browser rendering and execution of exe, com , bat, pif, reg, and dll?
See my subject: I don't even know that & anyone tried this patch yet?
* Let's hear about it...
(Must admit I'm hesitant to try a patch minus hearing how it goes for others 1st...)
APK
P.S.=> It's possible it could depending on how this threat's leveraged & what, if anything, it talks to + how (host/domain name vs. IP address, etc. - et al)... apk
Never heard of it. I'm not applying a non-transparent third party patch.
Do you want to join botnet? Because this is how you join botnet.
Next Patch Tuesday is March 14. Let's not make it any later than it is.
The autism-hating, Musk-hating, custom EpiPen-hating Slashdot troll!
A truthful question. How is a patch applied to a binary without the source code to compile a new binary?
Gramps, go back to bed.
Because all of the little millennial kids are impressed by it. They are the same people who consider the ability to plug in PC expansion cards, RAM modules or CPUs an indicator of computer expertise.
That's unbelievable...
"BadTimes will make you fall in love with a penguin" - Laika
How's life in the hypocrite lane, gramps?
APK Hosts File Engine 9.0++ SR-7 32/64-bit http://www.bing.com/search?q=%22start64.com%22%20and%20%22APK%20Hosts%20File%20Engine%22&qs=n&form=QBRE&sp=-1&pq=%22start64.com%22%20and%20%22apk%20hosts%20file%20engine%22&sc=0-41&sk=&cvid=4E6D0ACAB195467CB44CC4E3AA653148/
Ads & malware rob speed/security/privacy
Hosts add speed (via hardcodes/adblocks), security (vs. bad sites/malware/poisoned dns), reliability (vs. dns down), & anonymity (vs. dns requestlogs/trackers).
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!
Avoids DNSChangers in routers/IP settings & dns redirects (99.999% of ISP DNS != patched vs. it) + lightens DNS load & resolves faster from local system RAM!
* NATIVELY in the IP stack's FASTER kernelmode!
APK
P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/
See my subject: Replacing a jne (jump not equal) w/ a noop to bypass passwords for installs etc. - or per my subject, in the case of my own ware here https://tech.slashdot.org/comments.pl?sid=10324921&cid=53984051/ to alter it (changing string resources from MY initials or its name to another) OR to undo its built in antivirus protection.
I.E. - It does .exe sizechecks to give it what I call "Hyper Alloy Combat Chassis - Microprocessor controlled: Fully Armored, Very Tough" construction in EACH function/procedure for antivirus built in (it's executable cannot change size even by 1 byte or it warns it may be altered by program "hackers" looking to do what's in my subject or that it is infected by a 'classical virus' that attaches to the tail end of a program changing jump tables as they do - it shuts itself down @ that point & will NOT run...).
I built it this way since the program IS actual hacker/cracker & malware/virus/botnet herder's enemy (especially them). It inevitably will be attacked (& why I won't "OpenSORES" it - I don't want a Google EFast on MY conscience).
Only problem?
It additionally does jne's 100's of times doing such comparisons vs. attack/infestation/alteration AND 10's of 1,000's more in the very work it does filtering vs. false positives in its data!
It'd be a LOT of work to undo & undo right. Especially minus step tracing as in the case of a TRUE debugger/disassembler. There are tools others noted here (like hexeditors) that are NOT that but will let you do the job MAYBE in some cases (my methods make those tools backfire & make it a HUGE pain for debuggers too (taking FAR longer, in addition to the fact it does comparisons by TRUCKLOADS beyond the 'antivirus' code built into it)).
APK
P.S.=> Executable compression to do that to it on disk (bit less hassle in memory) makes it even MORE difficult! However, admittedly, it is NOT 'impossible' to do - nothing really is, depending on how determined an attacker is & how patient (just takes a LOT more time to do & has to be done JUST right due to sizechecks (making 'hacking it' even MORE difficult/time-consuming)) - much like ASLR in pointers in memory for locations of callstack code, it's a delayer (but imo, more effective due to longer delay due to the fact, again, the code performs TONS of 'jne' in comparison work it does ontop of sizecheck vs. alteration/infection)... apk
. . a third party patches microsoft software because microsoft can't do it on time? Why are people paying for windows again?
See my subject, it's appreciated & I briefly changed to Win7's "AeroGlass" display (iirc, it's not dependent on GDI but rather graphic card DirectX) to hopefully offset or avoid this until patched. Only problem(s) = 100's of mb of memory used (for 'shiny' I don't really require though it IS pretty, & WinKey + tab = cool effect imo in turning on Desktop Window Manager & Themes (usermode slower bulk too in & of themselves))... & yes, it too, imo + experience IS slower vs. std. 'classic' oldschool Windows 9x/2000 style startbar desktop (always reminded me of OS/2 workplace shell desktop).
* In any event. thanks for letting me know MS will probably HAVE to slow GDI based display up to make this work (unless their coders can outdo/outperform ACROS' folks (it's possible)).
APK
P.S.=> "Onwards & UPWARDS!!!" & we'll see (hopefully a BETTER more performant patch from MS - not cutting down ACROS' folks either - @ least THEY had the skills & courage to create this patch, assuming it's not faulty OR malware (we don't know that))... apk
Why are people paying for windows again?
Because they do not have a choice.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
i used true old win xp)
I downloaded the patch, then found it needs an installer, so I downloaded that and read the terms. Am I the only one who reads these things? It says by installing this software you agree to spyware^h^h^h^h^h^h^h telemetry. Needless to say, I did not install.