Image Causes Exploitable Overflow in Microsoft Products 291
Em Adespoton writes "Core Security researchers discovered that by electing a specially-crafted graphic as the user's display picture in MSN Messenger, an attacker could trigger a buffer overflow vulnerability on the chat partner's computer. Through this, it is possible to covertly take over machines running instant messaging software. Windows Messenger and Windows Media Player are also affected by this vulnerability. The story is also available at Newsfactor.com and SearchSecurity.com."
That's genius... (Score:2, Informative)
Re:That's genius... (Score:5, Informative)
Oh, wait, I think I found it [microsoft.com]! A patch was released for PNG processing flaws on Tuesday this week; among the affected software: Microsoft MSN Messenger.
Re:That's genius... (Score:5, Funny)
When did I ever eat corn?
Re:That's genius... (Score:2)
This begs the question... is he really your friend, after all?
Re:That's genius... (Score:2)
MS loss... (Score:5, Funny)
ha.
Re:MS loss... (Score:2)
Re:MS loss... (Score:2)
Re:MS loss... (Score:2)
Re:MS loss... (Score:2)
Where are the Cherubs? (Score:5, Interesting)
Re:Where are the Cherubs? (Score:2)
Re:Where are the Cherubs? (Score:3, Interesting)
Don't worry; after a lifetime of constant exposure to ads, it would take one hell of a picture virus to even make you sneeze :).
Seriously: the purpose of ads is to reprogram our behaviour, either permanently or temporarily. They do this by exploiting various psychological weaknesses of human minds - such as the need to associate with (imitate) what is perceived as succesfull people, th
Re:Where are the Cherubs? (Score:2, Funny)
Oh, that's just peachy. An army of Microsoft Robots (TM), all with their security holes, easily programmed to destroy humanity. Good thing they won't work long enough before a reboot to do too much damage!
Re:Where are the Cherubs? (Score:3, Funny)
So instead of Cherubs, they have Tub Girl.
Did I really just write that? :P
Re:Where are the Cherubs? (Score:2, Informative)
Re: Where are the Cherubs? (Score:2, Funny)
> Never read Snow Crash, but the proper pluralization of cherub is cherubim. (::seraph:seraphim::nephil:nephilim, etc.)
Article left out significant information... (Score:5, Funny)
Still think (Score:3, Insightful)
Re:Still think (Score:3, Funny)
Re:Still think (Score:2)
Yeah, but MS-DOS v1.0 is even safer; no security updates ever! That's right folks, DOS 1.0 has never had a single security related patch released!
Already fixed (Score:5, Informative)
Re:Already fixed (Score:5, Insightful)
I RTFMed, too. Seems like vulnerability [slashdot.org] was fixed in August of last year by Gentoo [gentoo.org], Red Hat [redhat.com], andMandrake. [linuxsecurity.com]
Nothing compares MS security to that of the rest of the world better than seeing how they fix the same damn vulnerability. Let this be a lesson to you. Never astroturf with facts. A quality 'turf would have been to say: "Yes, but Linux has a history of at least three times as many security problems with PNG as Microsoft"
MS Security Chief Says Windows is Safer Than Linux (Score:4, Funny)
MS Security Chief Says Windows is Safer Than Linux [slashdot.org]
Now stop trying to spread FUD.
Re:MS Security Chief Says Windows is Safer Than Li (Score:3, Interesting)
Re:MS Security Chief Says Windows is Safer Than Li (Score:5, Funny)
Re:MS Security Chief Says Windows is Safer Than Li (Score:2)
So, if a single security problem turns up in Linux, can I cry FUD when it's claimed that Linux is more secure?
Re:MS Security Chief Says Windows is Safer Than Li (Score:4, Funny)
1. Claim Linux is more secure than windows.
2. Someone finds exploit in Linux
3. Cry FUD
4. Profit
Re:Hmmmm (Score:2)
What do you think, guys?
IMHO, WADR, STFU.
What??? (Score:2, Funny)
Re:What??? (Score:5, Funny)
Good thing you clearly labelled it as sarcasm.
'cause otherwise I wouldn't have known.
Really good sarcasm, too.
Got me, there.
Phwew.
Bill Gates (Score:3, Funny)
In other news... (Score:3, Funny)
Re:In other news... (Score:2)
I think that's because it's generally so full of worms, that you can't fit any more exploits into your average box. In that respect this actually makes Windows more secure because it makes it more likely that you box will be too infected for any given virus to be able to do anything.
Am I the only one (Score:2, Funny)
Question (Score:4, Interesting)
This is the picture... (Score:3, Funny)
Re:This is the picture... (Score:2, Funny)
Buffer overflow errors/vulnerabilities (Score:2)
I'll bet the guy who used gets() is long gone, so they're still searching for each of his hidden calls to it. It's either that, or he won't admit to ever having used it.
Stupid question: (Score:3, Interesting)
Re:Stupid question: (Score:3, Informative)
Re:Stupid question: (Score:2)
Ah HA! (Score:5, Funny)
Re:Ah HA! (Score:2, Insightful)
Defeating the Borg? (Score:5, Funny)
Maybe the image of Bill Gates-as-Borg was a little more prophetic than we all realized.
Re:Defeating the Borg? (Score:5, Funny)
*Proprietary* Network Graphic? (Score:5, Funny)
They're wrong about PNG (Score:5, Informative)
PNG really stands for Portable Network Graphics. And I hope that people don't get confused and start blaming the PNG file format for a bug that is MS's fault.
Re:They're wrong about PNG (Score:3, Insightful)
Before anyone goes off bashing MS... (Score:5, Informative)
And it's also included in most Linux distros.
If MS is to blame, it's for their lousy reaction speed. This vunerability has been known for months.
Re:Before anyone goes off bashing MS... (Score:5, Interesting)
I wonder though why Microsoft didn't update to a newer version of libPNG when the vulnerability was addressed last August.
-Lucas
HAHAHAH GRABOULOUS! (Score:2, Insightful)
Re:HAHAHAH GRABOULOUS! (Score:2)
Isn't it worth mentioning (Score:5, Insightful)
Re:Isn't it worth mentioning (Score:2)
I think I understand Windows users now... (Score:5, Funny)
Windows... Is a video game!
Sure, think about it. Can you hack your friend Billy's computer before he hacks yours while you chat online? The suspense must be very exciting. Who has the better Script? Who has the better collection of vulnerabilities?
It must be almost like playing Magic: The Gathering, or one of the other card games kids are into now. "My hack trumps yours! I get all your pr0n!"
Suddenly I feel very boring. Sigh... It's okay, Slackware, I love you even IF you're secure. I'll just have to settle for being Rudolph, and not play in any Reindeer Games.
Oh! Look! My Microwave just beeped! Pea Soup!
Mmmm!
The exploit..... (Score:5, Informative)
Already patched? (Score:3, Insightful)
I just need more solid ammunition if I'm going to get in arguments with my Cult-Of-Microsoft coworker zealots.
Re:Already patched? (Score:4, Insightful)
And I bet some independent report will become available claiming that MS patches quicker than OSS because they only awknowledged the libpng bug a few days before releasing the patch.
End user ease of use... (Score:3, Interesting)
Re:End user ease of use... (Score:2)
From TFA: Proprietary Network Graphics (PNG)!?! (Score:4, Informative)
It's Portable Network Graphics
http://en.wikipedia.org/wiki/Png [wikipedia.org]
Re:From TFA: Proprietary Network Graphics (PNG)!?! (Score:5, Funny)
Basilisks, etc. (Score:2)
Ah, see and die. Check out the Wikipedia article on harmful sensation [wikipedia.org] motif.
erm... (Score:2)
hmm. What picture could possibly cause a program to crash and burn and the computer to be PWNT?
Does goatse strike again? *grin*
6 months to patch a known vulnerability (Score:5, Informative)
Re:6 months to patch a known vulnerability (Score:2)
Re:6 months to patch a known vulnerability (Score:2)
Re:6 months to patch a known vulnerability (Score:3, Insightful)
Bad Image Causes Exploitable Overflow (Score:2, Funny)
(A day like every day in Redmond)
Re:Bad Image Causes Exploitable Overflow (Score:2)
Boring! (Score:3, Insightful)
Until things start getting fixed at the tool and OS level we're going to continue having these types of exploits once a month for the NEXT twenty years. If we don't switch from using C this is going to be the Slashdot headline in 2025: "Vulnerability on Microsoft HoloChat allows attackers to take over your nervous system."
Re:Boring! (Score:3, Insightful)
well, depending on the implementation bounds checking can actually incur quite a noticeable performance penalty for huge arrays! the question is whether you'll accept your image loading
bounds ch
Re:Boring! (Score:2)
Never, because it isn't true. These tools which do not allow dangerous memory accesses, what language do you think they are written in?
Take a memory-secure language like Python or Java. What are these languages implemented in? Right, C. So clearly it is possible to use C to implement secure systems. The problem is that most people
once upon a time... (Score:5, Interesting)
when this bug was being discussed in a meeting, the first thing that was said was something to the effect of "oh, and if you tell anybody--anybody--about this, you might as well look for a new job at the same time, and a good lawyer."
of course, this was a few years ago, and from what i understand it was fixed right away, but still...
m-
Re:once upon a time... (Score:4, Insightful)
Remember that this "exploit" doesn't count (Score:2, Informative)
However...
The mailman exploit [secunia.com] counts against Redhat Enterprise, because it ships with the distribution.
(just squint really hard, and you'll be able to clearly see what I'm talking about)
Removing MSN Messenger doesn't actually remove it (Score:5, Interesting)
WindowsUpdate still asks you to install patches for Messenger and OE, even though they are supposedly "uninstalled".
IE still somtimes shows a Messenger icon on one of the toolbars.
I still occasionally find the the MSN Messenger icon in the status tray, even though it is supposedly "uninstalled", and the users on my network aren't smart enough to run MSN Messenger from the commandline.
What gives?
Re:Removing MSN Messenger doesn't actually remove (Score:5, Informative)
You have to manually call the uninstall section of the msn messenger INF file.. ive done it so many times i type it from memory..
go to start>run, and typemake sure msn messenger is closed first so it wont error when it unregisters the dll files
Re:Removing MSN Messenger doesn't actually remove (Score:2)
Re:Removing MSN Messenger doesn't actually remove (Score:2)
The fact still remains that removing "Windows Messenger" via "Control Panel: Add/remove programs: Add/remove Windows components" doesn't remove C:\Program Files\Messenger .
At least... (Score:3, Insightful)
This is not the only MS security flaw under review, at the moment. It was shown recently that MS Office documents are weakly encrypted using the password directly. It has been shown that there is a way of recovering the key in a relatively short timeframe if you have two versions of the same file. (This isn't actually too hard to achieve, as most people keep backups.)
Instead of boasting how they've "only" released a few mega-patches over the last year, Microsoft really needs to sit down and do a thorough code audit. Hell, if that would be too expensive, just run the standard libraries through "splint" or the Stanford Code Validator. Even if Microsoft were to just fix those bugs one of those code auditing tools reported, I flat-out guarantee confidence in the security of their products will increase far beyond their wildest imagination.
The problem is neither inevitable nor insoluble. And boasting about Windows over Linux eliminates neither the problem nor the growing awareness of it. Addressing the problem, with a firm determination, would.
If only I was smarter... (Score:2)
Thanks Microsoft.
Elbonia & Irony (Score:2)
is it just me... (Score:2)
Re:Worst internet worm ever? (Score:5, Funny)
I'm doing my part. I don't have any friends.
Re:Worst internet worm ever? (Score:2)
ROTFLMAO
That should be on the front page up ahead
Re:Worst internet worm ever? (Score:2)
Re:Worst internet worm ever? (Score:2)
You mean there are people using MSN Messenger?
Re:but its more secure than linux! (Score:4, Insightful)
2. GAIM has had exploits patched.
3. Linux has had exploits patched.
4. I remember reading people defending Linux by saying that a lot of the distribution patches are not for the OS but instead for tools/apps... Yet you don't hold the same true for Microsoft?
5. People need to be a little more objective, even on
6. This is old news.
Re:but its more secure than linux! (Score:5, Interesting)
Those not blessed with geekiness cannot do it, so are stuck.
Re:but its more secure than linux! (Score:2)
Maybe that was added in SP2, though, since I remember having to execute a file (got the instructions from annoyances.org) in the command prompt to uninstall it last time I had installed XP (about a year ago, IIRC). The uninstaller was there, just that there was no shortcut to go to it.
Re:but its more secure than linux! (Score:2, Interesting)
Re:but its more secure than linux! (Score:3, Informative)
The MS bulletin and patch: http://www.microsoft.com/technet/security/Bulleti
It's a vulnerability in libpng that was just patched by MS Tuesday, but was fixed by everyone else when it was discovered last June.
Re:When will this stop being "news?" (Score:5, Informative)
The patch [microsoft.com] was released on Feb 8, the story comes out on Feb 11. Right, not much to see here.
Maybe the RAF has a big PowerPoint that's of interest on web server somewhere...
Re:When will this stop being "news?" (Score:2)
Things you need to know RIGHT NOW that will save your life! Tonight at News at 11
Re:Mac classic (Score:2)
You're mostly right about MacOS. Where did you get the 'ties with openBSD' bit from, though?
Re:WHAT THE FUCK?! (Score:2)
I refreshed a few times and saw a few vonage ads, but none played sound for me...
Re:Start the clock (Score:3)
Re:Talk about Timing! (Score:3, Informative)
The real question to ask is "Why did it take MS so long to remember it had used a vulnerable version in MSN Messenger?"