Slashdot Log In
Windows XP Flaw 'Extremely Serious'
Posted by
Zonk
on Fri Dec 30, 2005 08:49 AM
from the escalation dept.
from the escalation dept.
scottott wrote to mention a Washington Post article with the news that the security hole we mentioned on Wednesday has widened. Computers can now be infected just by visiting infected web sites, or looking at images in the preview panel of older versions of Outlook. From the article: "At first, the vulnerability was exploited by just a few dozen Web sites. Programming code embedded in these pages would install a program that warned victims their machines were infested with spyware, then prompted them to pay $40 to remove the supposed pests. Since then, however, hundreds of sites have begun using the flaw to install a broad range of malicious software. SANS has received several reports of attackers blasting out spam e-mails containing links that lead to malicious sites exploiting the new flaw, Ullrich said."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Late breaking news from the article: (Score:5, Funny)
Amazing!
Re:Late breaking news from the article: (Score:5, Informative)
1) Yes, Virtual PC and WINE allow you to run Microsoft programs like Internet Explorer and Office.
2) The vulnerability is in the Microsoft Windows Graphics Rendering Engine, which is a part of the Windows kernel, and is why the exploit affects Windows versions from Win98 to WinXP.
3) Virtual PC and WINE running under Linux do not use the Microsoft Graphics Rendering Engine.
4) Even if they did, a Windows program trying to run in a Linux environment is a fish out of water, and can't do much besides SEGFAULT and exit.
5) Therefore, Linux (and Mac) users are safe, even if they are running IE or Office - just like the article said.
Parent
Re:Late breaking news from the article: (Score:5, Informative)
The graphics rendering engine is divided between the Win32 subsystem which is a user process (csrss.exe), and the Win32 executive (Win32.sys) which actually runs in kernel space. The portion of the graphics system in the executive is limitted almost exclusively to the actual displaying of images and direct interaction with the drivers that interface with the display hardware. I'm not 100% sure, but I can't ever recall there being a vulnerability found in this part of the executive.
This specific vulnerability, like almost all image processing vulnerabilities, occurs in the image format parser, which is in the Win32 subsystem. As such its not in the kernel and runs in standard user scope. I know this doesn't change the point you were trying to make, which was the vulnerability doesn't occur on other systems. I just wanted to correct the statement about it being a kernel vulnerability.
Parent
Re:Late breaking news from the article: (Score:5, Informative)
If there ever was a smoking-gun lead-pipe indictment of Microsoft's sloppy love of whizzo features, security, stability, maintainability, administerability be damned; this has GOT to be it. If the filetype API is that flawed, we need to just get rid of .WMF files, period.
Parent
Re:Late breaking news from the article: (Score:4, Informative)
Parent
Re:Late breaking news from the article: (Score:4, Informative)
Parent
Re:Late breaking news from the article: (Score:4, Informative)
At least in Firefox, you will get a prompt asking you to run the script before it executes. So as long as you always remember to click on "Hell NO", you should be pretty safe.
Parent
Another /. dupe (Score:5, Funny)
Re:If Windows Were Open Sourced (Score:5, Informative)
They have no business doing that, people without Admininstrator should be able to play, anything running as Administrator (or in that group) can do great damage (e.g. virus infections, file deletion, even destroy the BIOS), and doing things that require Administrator wrongly can also trash the system (accidently corrupting a DLL, locking up hardware, etc).
There is a RunAs on Windows, and it is useful for doing sys admin stuff only when needed. It would be nice if it could be configured that a browser run by Administrator (lets say to need to Google for a solution to a problem you are working on) would drop privs (but even Linux doesn't do that).
But my main point is games and other user programs should need Administrator.
Parent
Windows development culture is insecure (Score:5, Insightful)
It's the core security problem of Windows: the development culture doesn't respect security. Developers went for decades of DOS and Windows 3.1/9x without needing to worry about users and permissions. So they got used to assuming they could write whereever they wanted. When real user seperation and permissions became mainstream with Windows 2000 and XP, they weren't prepared to change. Because so much software required full access the easiest way to get stuff running is to run in an Administrator account. And since so many people (developers included) run as Administrator, why bother doing the right thing? Games are usually guilty, but there are piles of business and research software that is equally guilty. My brother is a sysadmin for a research lab. To keep Administrator access out of users hands, he has to bend of backwards to get the machines running the software his users need. A 2005 release of a $3,000 package that refuses to be placed in a directory with whitespace or a tilde, meaning it can't be installed in C:\Program Files. A $500 package that demands write access to a file in the C:\Windows directory.
This is one case where backward compatibility came at the expense of security. The development culture is moving too slowly. Bigger companies are starting to do the right thing and you get the occasional smaller development house following the rules. The killer is that huge mass of more specialized software. Apple bit the bullet when they cut over to Mac OS X; software had to do the right thing or it stopped working. Microsoft needs to make such a dramatic change or we'll be putting up with this bullshit for at least another five years.
Parent
Browser appliance (Score:5, Informative)
http://www.vmware.com/vmtn/vm/browserapp.html [vmware.com]
MOD PARENT UP (Score:5, Informative)
Parent
Uploads (Score:5, Insightful)
My browser touches all sorts of things in the host OS, from the sound card to files that I upload and download. Luckily when I get AIM spam for foo.exe or some other sillyness I don't get far unless I type 'wine foo.exe', then even then ;-)
The true challenge is how to dial in the security to a reasonable level. Problem is getting all the millions of programmers to adopt more secure standards combined with the users, IT managers, etc.. that deploy the apps on desktops. Then, getting that out across the millions of home users too. Daunting task.
Parent
Re:MOD PARENT UP (Score:5, Insightful)
What the hell are you talking about? If you're referring to the fact that default home users run as a Administrator or Poweruser by default, you're right, that's a mistake, but its a policy mistake, not a technology mistake. Windows lets you run as a lesser user, its just that by default you don't. Internet Explorer runs 100% in userland. There is no part of Internet Explorer which runs in the kernel. None. Although Internet Explorer certainly has more holes than Firefox, they are both limitted to the same order of magnitude of potential damage. The same as on other "real OSes".
Parent
Re:MOD PARENT UP (Score:5, Insightful)
Bull if that tired old BS was true then would you care to compare IIS to Apache?
Using the same criteria of course. Apache the market giant VS IIS the positions are almost reversed. But once again MS winds up with the lions share of the remote root exploits. Now how does that figure with the claim that market share = number of exploits?
Parent
Re:MOD PARENT UP (Score:4, Interesting)
Not to mention that the OP seems to have confused the issue of "exploits" with the issue of "user permissions" which is what was actually being talked about.
Parent
Re:Browser appliance (Score:5, Informative)
Parent
Temporary Solution (Score:5, Informative)
until a patch is released.
Re:Temporary Solution (Score:5, Informative)
It isn't a bad idea to do, but before you do it in an enterprise environment, be sure you test it and are ready for the calls it will cause.
Parent
Re:Temporary Solution (Score:5, Informative)
From http://www.microsoft.com/technet/security/advisor
I have software DEP enabled on my system, does this help mitigate the vulnerability?
Yes. Windows XP Service Pack 2 also includes software-enforced DEP that is designed to reduce exploits of exception handling mechanisms in Windows. By default software-enforced DEP applies to core operating system components and services. This vulnerability can be mitigated by enabling DEP for all programs on your computer.
Parent
What about Microsoft's Nov 8 patch? (Score:4, Informative)
Parent
Well, Duh... (Score:5, Funny)
Re:Well, Duh... (Score:5, Funny)
Oh wait... I know this joke...
When it's a feature
Parent
Re:Well, Duh... (Score:5, Insightful)
Parent
at work on a M$ machine (Score:5, Funny)
Re:at work on a M$ machine (Score:4, Funny)
Pedantic Bastard!
Is there anything else you want me to call you?
Parent
Sorry to say it got me (Score:5, Interesting)
Spent the next few hours removing all the junk that installed, I was lucky no root kits were installed.
Re:Sorry to say it got me (Score:5, Informative)
Parent
Re:RootKit Revealer (Score:5, Informative)
You can't even be reasonably sure of it without at least some checksumming system like tripwire.
All you are doing is scanning for certain known rootkits. That's a weak strategy that's reactive and guaranteed to fail some of the time.
Parent
Gotta love it... (Score:5, Insightful)
This week's Windows security hole article... (Score:5, Insightful)
Programming code embedded in these pages would install a program that warned victims their machines were infested with spyware, then prompted them to pay $40 to remove the supposed pests.
Where do you send the money? And they aren't afraid of getting caught?
Come on, "editors", let's try to edit properly (Score:5, Informative)
There are two major factual errors here. One, the security hole has not "widened" - the scope of exposure is exactly what we read about Wednesday. Using shimgvw.dll to view a specially constructed WMF file results in system compromise (web site viewing of malicious WMF, previewing, opening w/MS picture and fax viewer, etc). The hole is exactly the same - exposure has increased, but the hole has not widened. Two: the web sites are not infected, they are malicious. The system is infected after visiting a malicious web site.
The full (well, as full as it is now) MS advisory is here [microsoft.com]. I'm not very pleased with how MS is handling this at all, but that does not excuse this shoddy "journalism". How hard is it to state facts correctly? All you had to do was change a few words, and it would have read much more accurately:
scottott wrote to mention a Washington Post article with the news that the security hole we mentioned on Wednesday is now affecting many more users. Computers can now be infected just by visiting malicious web sites, which are now rapidly increasing in number, or looking at images in the preview panel of older versions of Outlook.
For the last sentence, note that I sent mysefl WMF files win Outlook 2000 and 2003 while running Sysinternals process explorer and never saw shimgvw.dll called. Opening a WMF attachment called it, but not previewing, so there might be three errors, but I didn't test all versions that way, so I don't know...
What's the real lesson here? (Score:5, Insightful)
But it was really just bad luck that the bug happened to be found in the Windows WMF library and not, say, its Unix/X11 equivalent. Or libpng, or zlib, or whatever. Anyone who thinks otherwise is deluded. All software has bugs, and even if the quality of the free libraries is ten times higher (unlikely) there will still be plenty of memory tramplings and buffer overruns.
So, when the next vulnerability is found in a commonly used Unix library, will we be in any better position? Not really. Still the library is linked into the application and runs in the application's address space. It has access to all the files the app does, and traditionally on Unix that means everything the user has access too. Your email application may only need to read ~/.mail_settings and connect via IMAP to some host, but it runs with permission to overwrite any file owned by you and connect on any TCP/IP port it wants.
Why does the WMF rendering code need to run with any more permissions than: read a block of memory with the WMF file, and write a block with the rendered bitmap? (Or perhaps make display / GDI calls, if performance is a concern.)
What support is there in Unix operating systems for running common library code with only the privileges it needs? As far as I know Linux has no simple way to run a dynamically-linked library (.so file) in its own address space or without permitting it to make system calls. So when the next exploit is found in a common Linux library - and it will be found - the situation will be just as embarassing.
Re:What's the real lesson here? (Score:5, Informative)
Parent
Re:What's the real lesson here? (Score:4, Informative)
Because the WMF rendering code *is* GDI. Seriously - a WMF file is basically a list of GDI functions to call in order, along with the parameters to pass to them.
Parent
Re:What's the real lesson here? (Score:5, Informative)
This isn't a buffer overflow, its a design flaw that allows metafiles to register callbacks with GDI32. And I fail to see what language a programmer uses has anything to do with it. Bad programmers are bad programmers reguardless of the language used. To the CPU its all instructions, it doesn't care if its issued by the crt or the java_vm.
Enjoy,
Parent
Windows Major Foul-Up (Score:5, Insightful)
The problem with the WMF (Windows Metafile) file format turns out to be one of those careless things Microsoft did years ago with little or no consideration for the security consequences.
Almost all exploits you read about are buffer overflows of some kind, but not this one. WMF files are allowed to register a callback function, meaning that they are allowed to execute code, and this is what is being exploited in the WMF bug.
I find this mind-boggling to the point of absurdity. Regardless of any supposed benefit gained by this, allowing a data file to execute arbitrary code upon it being viewed is simply begging for an exploit like this. No matter whan spin Microsoft will try to put on this one, it makes them look bad. Extremely bad.
IDS signatures (Score:5, Informative)
Snort sigs have been available from BleedingSnort [bleedingsnort.com] for some time now; I pushed them out to our corporate IDS yesterday morning.
(Warning, mangled by Slashcode - remove newlines)
t afile.pm.php; classtype:attempted-user; sid:2002734; rev:1;)
0 05/3086; sid:2002733; rev:1;)
#by mmlange alert tcp any any -> $HOME_NET any (msg:"BLEEDING-EDGE CURRENT WMF Exploit"; flow:established; content:"|01 00 09 00 00 03 52 1f 00 00 06 00 3d 00 00 00|"; content:"|00 26 06 0f 00 08 00 ff ff ff ff 01 00 00 00 03 00 00 00 00 00|"; reference: url,www.frsirt.com/exploits/20051228.ie_xp_pfv_me
# By Frank Knobbe, 2005-12-28 alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE EXPLOIT WMF Escape Record Exploit"; flow:established,from_server; content:"|01 00 09 00 00 03|"; depth:500; content:"|00 00|"; distance:10; within:12; content:"|26 06 09 00|"; within:5000; classtype:attempted-user; reference:url,www.frsirt.com/english/advisories/2
Once again it looks like Microsoft are going to escape the 'perfect exploit' meltdown by the skin of their teeth. This is exploitable remotely, but Dr Evil can't sit at a console typing in arbitrary IP addresses to 0wn with the exploit. On the other hand you can get close to that sort of thing using Metasploit Framework [metasploit.org].
Firefox? (Score:5, Interesting)
Re:Firefox? (Score:5, Informative)
You can be infected whenever Windows uses its default image viewer to display certain image types. This means there is a long list of applications that are vulnerable that rely upon the image viewer code, but as far as I know no one has yet compiled that list. Windows uses this code when previewing images (for example). The current way this is being exploited is to tell your web browser to open an image (wmf and jpg that I have heard about) in the picture viewer. On IE, this behavior defaults to happening automatically. That means you go to a page and it installs whatever code it wants. With Firefox, you go to a page and a dialogue asks to open a .jpg or .wmf file. If you agree, it installs whatever, but if you decline you're in the clear.
Parent
Missing Option (Score:4, Funny)
more serious (Score:5, Informative)
The time has come.. (Score:5, Funny)
Identifier: X-Application/WinTrojan
Name: Windows Trojan File
File Extension Pattern: *.wtf
What I'd like to know ... (Score:4, Interesting)
If it has been there since WMFs began, that's a long, long time. We're talking Windows '95 or earlier. It all depends when the GDI callbacks feature was added.
So here's what you need to consider: since this exploitable code first "shipped" with Windows, anyone "in the know", e.g. potentially FOLKS AT MICROSOFT, the NSA, your neighbor, whomever
If I build and sell a car that is advertised as having a security system, but that security system is defeatable by running a magnet over the car lock, and that information is "out in the wild" for years and years, maybe even by folks in my company... what is the legal liability?
The only three external things that will adjust Microsoft's behavior regarding security are: (1) customers switching to other products, (2) criminal justice investigations, and (3) lawsuits. I don't see #1 happening so long as customers remain locked in, #2 is a joke as we know, but #3
Not a total solution... (Score:5, Informative)
Okay, really, she said Arkanoid, but you get my point.
Parent
Re:Not a total solution... (Score:5, Informative)
The flaw can be used with a JPG file (read; the image of the button, or the site seal, or the photo) in the web page.
And since the flaw is in data in the header of the WMF file type, it can be executed even if the file extension is not WMF.
In other words, if you are seeing images on web pages with Windows, you can get this. No downloading is necessary even in other browsers. Until it's patched, the only true safe method is unregister the DLL or don't get on the internet with Windows at all.
As an FYI, I had to deal with this thing several weeks back when it was rare. (The bimbo doesn't remember what web site did it.) IF you do, just pull the drive, mount it on another machine, get your data, and wipe the damn thing. It's a really really tough infection to clean. It screwed the OS more ways than Courtney Love and ate so much CPU it was unusable. PLUS it downloaded other stuff and started to try to infect other machines on the network.
Shoot to kill this one guys, the patient is already dead.
Parent
Re:Question (Score:4, Interesting)
Parent
Re:Solution (Score:5, Informative)
This is not an ie flaw. This is a Windows flaw. You can still be affected with other browsers, you just have to try harder. Anything using the Windows DLL that does the WMF processing will be affected.
Parent
Re:Is it IE or Windows? (Score:4, Informative)
Using Firefox with Adblock installed one can stop all files of this dangerous type by adblocking them until a patch is available.
Parent
Re:Real easy (temp) fix. (Score:5, Informative)
Good idea. But how do you "reactivate" this feature once a patch is released? I use Ifranview, but I also depend heavily on the thumbnail feature in explorer.
Sigh. I do wish people would offer some information with their click here/type-this instructions so people would understand WTF they're doing.To register (or re-register) the dll:To run the command, you can use a console window (cmd.exe), or the Run dialog box (accessible from the Start Menu).
Parent