Slashdot Log In
Third Microsoft Word Code Execution Exploit Posted
Posted by
CowboyNeal
on Thu Dec 14, 2006 07:26 PM
from the doors-wide-open dept.
from the doors-wide-open dept.
gregleimbeck writes "Exploit code for a third, unpatched vulnerability in Microsoft Word has been posted on the Internet, adding to the software maker's struggles to keep up with gaping holes in its popular word processing program.
The attack code, available at Milw0rm.com, contains sample Word documents that have been rigged to launch code execution exploits when the file is opened."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Thanks for the proof (Score:4, Funny)
Re:Thanks for the proof (Score:5, Funny)
No, that's Emacs. MS Word is a pushdown automaton at best.
Parent
This appears to affect OpenOffice 2.0.4? (Score:5, Interesting)
ooffice2 12122006-djtest.doc
This may not be a code execution bug; I'll try to trace it with gdb to see what happens.
Re: (Score:3, Interesting)
Re:This appears to affect OpenOffice 2.0.4? (Score:4, Insightful)
eip 0xb7286b4d 0xb7286b4d osl_getVolumeInformation+4487
Of course, this is probably because the exploit was designed to crash MS Word in the first place, not execute arbitrary code.
Parent
Re: (Score:2)
Fatal exception: Signal 6
Stack:
[0xffffe420]
Re: (Score:2)
http://rafb.net/paste/results/Jki6Ds85.html [rafb.net]
Re: (Score:2)
Re: (Score:3, Funny)
Dont you know that OpenOffice.org use Slashdot as a bug tracking system ??
Re:This appears to affect OpenOffice 2.0.4? (Score:4, Interesting)
Parent
Re:This appears to affect OpenOffice 2.0.4? (Score:5, Insightful)
Run Visicalc?
Parent
Re: (Score:2)
But as long as people write most of their complex stuff in C or C++ this will keep happening.
People should switch to programming languages and frameworks that just won't run "arbitrary code of an attacker's choice" when something exceptional occurs.
After all these decades aren't there any easy to learn, safe and fast programming languages?
Re: (Score:3, Insightful)
However... it looks like there are Oo.org users digging into that side of the problem. Probably they'll have an accurate synopsis of the failure mechanism and a patch on the way in a few days. Unfortunately we can't say the same (with th
C++ (Score:4, Insightful)
Uh if that happens then the language used is obviously unsafe.
The language isn't "unsafe" - it just lets you do some very, very nifty stuff that noobtard programmers are better off leaving alone.
C++ has perfectly "safe" features - the Standard Template Library has container classes like strings and vectors that won't overflow no matter how careless you are.
For those who insist on going down to the byte level and concatenating their strings themselves, Microsoft included "safe" versions of these functions in Visual Studio 2005, and will compile with warnings if you use the dangerous, buffer-overrun-producing variants.
Why should potentially arbitrary code be executed because a program tries to put data somewhere it won't fit?
Because a hacker's input and a programmer's overconfidence in his manual input validation (or lack thereof) put the hacker's code over the program itself. It fit just fine where the still-running program used to be.
This can happen in any language - C++ programmers are simply notoriously bad at input validation.
Parent
Affect on Macs? (Score:2)
Are these fully macro virsues or are these actual binary executables being injected?
If we have binary executables being injected by some sort of buffer overrun, then I wonder what happen on intel macs. Does the exploit inject i86 code or ppc code. Does Rosetta run the PPC injection or does the i86 injection run on it's own.
Pointers in documents? (Score:2)
Re: (Score:2)
Ad on site (Score:2)
http://www.microsoft.com/technet/security/default
Kinda limits Word's functionality, dontcha think? (Score:5, Funny)
What exactly does Microsoft suggest that I do with Word files? Besides using them to fragment my hard-disk? Maybe I can burn them to keep warm in the winter... um, no.
Or perhaps I'll just use Word to create and save HTML files!!
Re: (Score:2)
who downloads attachments from unknowns anyway (Score:4, Insightful)
Re: (Score:3, Informative)
How will buying a Mac help unless the team that coding Office for the Mac was much more security-conscious than the team that coded Office for Windows? The one thing that Mac has going for it is a good impl
Underneath the radar (Score:2, Interesting)
So all those family, friends and colleagues who you've (finally) trained not to open funny.exe or funny.scr a
Anyone remember milw0rm? (Score:5, Informative)
milw0rm is a group of "hacktivists" best known for penetrating the computers of the Bhabha Atomic Research Centre (BARC) in Bombay, the primary nuclear research facility of India, on June 3, 1998. The attack generated heated debate on the security of information in a world prevalent with countries developing nuclear weapons, the ethics of "hacker activists" or "hacktivists," and the importance of advanced security measures in a modern world filled with teenagers willing and able to break into insecure international websites.
My favorite word processor is immune (Score:2, Interesting)
Familar user interface
Fast
Cheap
WYSIWYG
Downsides:
Replacing blocks of text with larger-sized blocks of text difficult to impossible.
Cut-and-paste is messy, literally.
No automated search.
My Word Processor [sbac.edu]
Goddamn it (Score:4, Interesting)
From TFA:
So yet again it's a case of embedded code within a data file wreaking havoc. And as already been reported in comments here, this vulnerability also exists in OO.org.
Seeing this kind of thing always blows my mind. I would be greatly interested in hearing the rationale behind the decision to incorporate this feature. What the hell did they need that for?
Re: (Score:2)
it would make sense there are other holes that have yet to
be discovered.
Re:Goddamn it (Score:4, Interesting)
>file wreaking havoc.
>...
>What the hell did they need that for?
I don't know about the new XML-ish version, but the old DOC
"format" was basically a Word memory dump. Not
quite as surprising when you think of it that way
Parent
Re: (Score:3, Insightful)
People's pretty WordArt wouldn't work otherwise
Wait until you see how Publisher files are constructed - AFAICR each text box is a mini Publisher OLE object and let's not start on the picture boxes
I feel sick just thinking about it
Unbelievable (Score:4, Insightful)
"Data used by Microsoft Word to construct a destination address for a memory copy routine is embedded within a Word document itself."
If this is a standard practice at Microsoft, I'm beginning to understand why they are so relunctant to publish their protocols and standards.
Re: (Score:2)
About 12 years ago.
Re: (Score:2)
stable until 98se.
Re: (Score:2)
When the entire OS relies on the last three characters of a filename to handle filetypes, did nobody think this was a bad idea?
ROFL. Bad design? Sure. However, this concept dates so far back and is so entrenched that I don't see it going away any time in the next decade. So the "design specs" you are referring to are non-existent, or simply say "make it compatible with the wa
Re:Another day, another misfeature. (Score:4, Informative)
Speaking specifically about using file extensions, I think 'decades' is a little strong.
From Wikipedia's FILE entry [wikipedia.org]:
The original version of file originated in Unix Research Version 4 in 1973
Even if you happen to believe that the real improvements to file were not made until System V, that was 1983...so not decadeS, but decade.
So no, not a troll and not revisionist. You make it sound like Unix was not usable until the 1990's.
Parent
Re: (Score:2)
I tested both of those with word docs, and word opened. RTF is fine, since that was default to Word anyway. TXT is defaulted to notepad.
Re:Third Microsoft Word Code Execution Exploit Pos (Score:4, Funny)
Parent
Tagging (Score:3, Funny)
Re:Wait, who still uses M$ 0ffice? (Score:5, Insightful)
Little things like that count for a lot. OO might be more secure than MS Office, but it's terrible quality software in user-visible ways (i.e. it's ugly, slow and bloated). These things count to people. Little problems can't just be overlooked because it's free. My dad could pick it apart within minutes, and he doesn't normally care about software at all. He didn't care about paying for Office either, in fact he didn't think twice about it.
That's why. Nothing to do with TCO, Microsoft being evil, security, monopoly or anything else. OpenOffice just isn't very good in the ways that count to regular users.
Parent
Not only that... (Score:2)
Re: (Score:3, Interesting)
Re:Wait, who still uses M$ 0ffice? (Score:5, Insightful)
And if you knew end-users enough to comment on them, you should have known enough that end-users won't know how to turn this on.
See, software shouldn't "get in the way" of what you're trying to do.
Parent
Re: (Score:2)
Oh dear, looks like this Microsoft Word Code Execution Exploit just "got in the way". So the end user is still at risk, is out of pocket by $cost_of_office, and expose
Re:Wait, who still uses M$ 0ffice? (Score:5, Interesting)
In the past 12 months a few clients have started using OO and we now share OO documents with them - but they are by far the minority. Hopefully the new "Open" format Microsoft is coming out with will break the barrier down, and allow pixel-perfect interoperability, but until then it is very difficult to operate in a corperate world without the "de-facto" Microsoft Office standard.
Parent
Re:Wait, who still uses M$ 0ffice? (Score:5, Informative)
(For the uninitiated, As you edit a document in MS Word, it picks up bits of other documents you have open at the time or even previously opened. This is because it doesn't clear memory before using it, and the fast-save file format is really more a memory dump. This may have been fixed in the latest version of MS Word; I certainly hope so...)
Parent
Re:Wait, who still uses M$ 0ffice? (Score:4, Insightful)
(Insert random application name here) with vulnerability running as root is the problem. MS Word hole only amplifies it because it's widely used. But the problem is that everyone and their dog is running Windows as administrator.
Parent
Re: (Score:2, Insightful)
Open Office is unusable on such a machine. It's probably 'coded better' with C++ and what-not, creating bloated structures and resource piggishness. There is probably an old version of StarOffice that would run fine on the '486, but the notion that OpenOffice is magically 'less of a load on the machine' is just
Re: (Score:3, Informative)
It is not. M$Office is much more optimized (by all means) product. StarOffice itself was based on previous work - so the code base was already split even before Sun acquisition. And then add development of Sun and OO.o which do not perfectly fit each other.
And Sun's following development effort which threw in Java to the backet didn't help either.
The result is buggy bloated mess. Don't argue w
Re: (Score:2, Funny)
Suddenly, up pops: Hackie (Score:4, Funny)
Parent
Re: (Score:2)
The ones that will actualy shell out for Office are high end corporate customers. And beleive it or not, these features are very useful when you get to that point.