Slashdot Log In
.ANI Vulnerability Patch Breaks Applications
Posted by
CmdrTaco
on Wed Apr 04, 2007 09:25 AM
from the this-is-only-gonna-hurt-twice dept.
from the this-is-only-gonna-hurt-twice dept.
Jud writes "Microsoft's fix for the .ANI vulnerability was part of Patch Tuesday yesterday. However, all is not well with the update. Reportedly, installing the patch will break applications such as Realtek HD Audio Control Panel and CD-Tag, which mentions they are affected by the problem on their main page. A hotfix is currently available from Microsoft, however their current position is this is an isolated problem and the fix is not planned to be pushed out through Microsoft Update. "
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Hehe (Score:2, Insightful)
Weird, 'cause I hear about one of these stories almost every week. Isolated in what sense?
Re:Hehe (Score:5, Interesting)
Parent
Re: (Score:2)
Inside Microsoft, the MSDN Magazine Camp has won the battle...."
From one of the best articles [joelonsoftware.com] a guy can read
Re:Hehe (Score:4, Informative)
Parent
Was the DLL base address ALL they changed!? (Score:3, Interesting)
You see, moving where a DLL is stored in memory might break the proof of concept, but it might not actually fix the vulnerability. Sure, the code it hooked into before in order to hack the machine won't be in the same place, but it might well be possible to fix the exploit to point to the code's new location.
In short, I wonder if they're playing tricks to make it more difficult to exploit without actually fixing th
Re:Hehe (Score:4, Insightful)
Sarcasm aside, how exactly did it come to pass that the guy who wrote the code for animated mouse cursors managed to open an "extremely critical" security vulnerability in the process... and then how did it become so important that fixing it breaks applications which relied on said bug?
I'm sorry, I'm not entirely 100% anti-MS (XBox Live owns, Visual Studio
Parent
Re:Hehe (Score:4, Interesting)
I have a fairly new Dell XPS600 (1 year old) and the update borked my machine due to the realtek program. I got some obscure message about how rtdcpl.exe was performing an illegal access trying to move some OCX DLL.
I was able to solve the problem by Google Searching and installing the MS hotfix. The only problem now is that "hotfix" makes it so I have to wait about 1 minute longer after I log in before I can access the internet. I used to be able to pop-up IE right away and surf but now if I do that, I get the error page for site not found for about 1 minute before things start working normally.
I don't know how isolated it can be since Dell alone has sold millions of PC's with realtek audio chipsets.
Parent
Re:Hehe (Score:5, Funny)
That is your root cause of the problem. Stop using IE, all your problems will go away.
Parent
Other affected programs: Tugzip... (Score:5, Informative)
Anyone's surprised? (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
Re:Anyone's surprised? (Score:5, Insightful)
If you read the hotfix page you'd see this:
Parent
Re: (Score:2, Insightful)
It's not only possible. It's mandatory. It's called input validation, and everybody else is doing it. The only reason I can see why Microsoft is an exception is that they have convinced people like you that it's not their fault if *their* software breaks. Get a clue.
Re:Anyone's surprised? (Score:5, Funny)
Parent
This was not patch Tuesday (Score:5, Informative)
Re: (Score:2)
So what you're saying is that they've got 6 days left to patch the patch?
Re:This was not patch Tuesday (Score:4, Funny)
Parent
Except for down under (Score:2, Funny)
Before all the lame bashing.. (Score:4, Insightful)
This is exactly why it takes Microsoft so long to put out patches sometimes. Unlikely all these free and open source packages, Microsoft Windows is actually used by tons of users at home and in the business world. People need their machines to do their daily activities and jobs. This is why so much testing is needed before something can just be shoved out there. This is why you tend to see this sort of thing from patches released out of cycle. It obviously has not and could not have been tested as much (and yes sometimes problems occur with patch Tuesday patches).
You might not see as many issues with *nix based systems. Why? Well, there just are as many users. This might sound like a cliche but it is a fact. Look at when official Redhat patches and other updated packages actually come out. They come out days, weeks, and months later. Sure there is some patch that some random guy hatched together -- the power of open source!! However, if you were to apply that untested P.O.S. across the world in tons of real environments, you'd probably have a shitton of problems.
This does not excuse problems with patches, but at least it came quicker. Remember, M$ has to release stuff that fortune 1000, government, home users, and everyone else can live with. Pushing some patch 30 minutes later for an OSS package that 2000 rag tag home users use.. just isn't the same.
Re:Before all the lame bashing.. (Score:5, Insightful)
Having millions of users might be an excuse, but having a bad design can't, if you claim to be developing best software.
I really find it just plain spreading FUD to compare open source software equivalent microsoft software with those metrics. Blah, blah, but it's used by millions, see what happens when open source is used by millions. Just wondering how many in those millions compare design decisions taken during software development of product they use. What's lame is not seeing how broken design of some parts of the software, not bashing due to these flaws.
Parent
Re: (Score:3, Interesting)
Yes, you mightn't need a full development environment inside of your word processor or web browser, but they didn't spend time and energy putting those features in there for nothing. Someone determined that the bloat would make them more money...based o
Re: (Score:2)
But that's the whole problem.
Re:Before all the lame bashing.. (Score:4, Interesting)
Uh, several of our enterprise webapps used animated cursors to let the user know that something is being processed. Maybe to a clueless geek user feedback is a useless feature, but to anyone who knows about UI design it is a requirement. The real sin with this patch is that this bug was already patched TWO years ago, but they meerly patched the codepath for the known vulnerability and left it at that, they did not look at the actual cause of the problem and so we have the same vulnerability with a twist come out two years later.
Parent
Re:Before all the lame bashing.. (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
A security exploit in animated cursors and then they stuff up a number of other applications trying to patch the exploit.
This isnt Internet Explorer. Its a simple animated cursor.
And yeah I am using Linux and have been for years. Happy?
Re:Before all the lame bashing.. (Score:4, Insightful)
Parent
Re: (Score:2, Funny)
Re: (Score:2)
Yeah, it's not like MySQL or Apache are used by anyone. Or PHP, Perl, Java, Firefox ...
Re:Before all the lame bashing.. (Score:5, Insightful)
2000 ragtag home users? You are smarter than that, I can tell by the quality of your writing and sentence structure alone. While some OSS packages serve small communities, there are lots of packages that serve large and diverse communities. (PostgreSQL, Apache, the Linux kernel, Firefox, the list goes on). Those packages have, on occasion introduced vulnerabilities due to the natural vicissitudes of software development. And when their vulnerabilities are discovered, they get fixed quickly. (And this one hit me this morning: I don't need Linux Genuine Advantage for permission to receive updates to my damn software!!!)
It is worth noting, however, that such vulnerabilities are nearly always limited in scope due the inherently modular nature of the OSS world. Microsoft built a highly integrated system to support its business model. They are welcome to their high integration approach. And those of use who do not appreciate the effects of that way of doing business are welcome to complain when it wacks the shit out of our families' productivity when we are trying to get some proprietary fix.
Parent
I don't need Linux Genuine Advantage... (Score:4, Funny)
But of course it's available if you do want it [linuxgenui...antage.org].
Naturally Linux Genuine Advantage is open source, and not to be outdone by Microsoft platform hackers a hack is available to auto-certify LGA without actually contacting the LGA server.
Parent
In actual fact (Score:3, Informative)
Yeah, WGA sucks, but software updates will come either way.
Also, to say Linux is completely independently modular isn't entirely accurate either (although, in fairness it's not like I completely disagree). Upgrading kernels (due to 'serious' security vulns) will break more things than I'd like for instance - my (yes I
...you will make your own bashing (Score:2)
Perhaps you have not noticed that a majority of fortune 500 companies are using Linux in some capacity.
Rag Tag home users? You don't have a job, do you?
Point of Order: (Score:2)
Now - forget the dazzling array of hardware and software to check against. This .ani thingy is a UI issue that should --at worst-- munge the way an app's mouse cursor animation looks, but not munge the app itself, or even think of touching OS stability.
C'mon... we're not talking about patching the TCP/IP stack, or patching against ntldr here
Re: (Score:3, Informative)
http://www.w3.org/TR/CSS21/ui.html#propdef-cursor [w3.org]
In other words, *something* has to be able to load and process the mouse cursor. And if the thing that loads and processes the mouse cursor falls prey to a buffer overflow, then you've got yourself a vulnerability. Since it's the OS that handles and draws the mouse (so it's not an IE thing; FF will fall prey to this too), it's the OS that handles the mouse cursor, so a b
The sad life of a Windows developer (Score:2, Troll)
Developers, developers, developers
Many of them trying to keep afloat the bastardized zombie of a legacy project begun in DOS and ported to Win 3.1, Win32, Win64, .NET, Sun Java, MSJava, Sun Java again and Vista. None of them with Microsoft's preferred and undocumented internal APIs for any of those systems. Many of them with no clue how to write good code, managed by non-programmers who can't tell. Each of them insisting that each revision has slain their sacred cow. So many of them that any patch no m
Re: (Score:2)
No, that isn't the issue. There are several matters here. One of them: FOSS software has sources available. It is far easier, for certain types of patches at least, to check if there will be problems by checking source code. Even a simple grep can tell you what apps rely on the element you are changing. Furthermore, the patch's source is shown to the app develo
Re: (Score:2)
This looks like something vendors could fix. (Score:2)
This looks like something vendors could fix without a "hotfix" from MS.
Realtek HD Audio exists on a lot of PCs... (Score:4, Informative)
Seems like this isn't really an "isolated" problem, but a fairly common one if you own a desktop made in the last year or a recent laptop...
Re: (Score:3, Insightful)
Windows comes with a perfectly usable GUI interface to volume controls and other audio hardware settings. Why did Realtek have to create a crapware application to do the same thing?
Re: (Score:3, Insightful)
Anyway, if I want the audio to work in XP on my wife's new laptop, I have to use Realtek's crapware application. That's just the way it is.
I guess this is a good argument for the Linux model, where drivers are
Re: (Score:3, Informative)
I had the Realtek issue..... (Score:3, Interesting)
So.. If the fix is that simple, is this issue really an issue or is this issue blown out of proportion?
To Quote the movie "Brazil" (Score:3, Funny)
"There's been a little complication with my complication"
MS build/release system? (Score:4, Informative)
Normally clashes of base addresses happen all the time. For most DLLs the base address is sort of a suggested location, the OS load the DLL to this area if it can, but will "relocate" DLLs to free memory area if that space is taken. User32.dll isn't allowed to be relocated for some reason (a very good reason, I'm sure). If it's space is already taken (by HHctrl) the program using it cannot load. HHCtrl.ocx has no problem being relocated, but this will only happen if it's loaded after user32.
I'm surprised that anyone could manage to make an application that would load these DLLs in this bad order - but that's not the point I guess. Usually you'd HAVE to call a function in User32.dll long before loading anything COM - esp an HTML help control (which is what hhctrl is).
A big ha-ha to vendors using animated cursors (Score:3, Interesting)
Reminds me of when I bought a little FM radio controlled by a serial link. The crapplet they sent on the CD-ROM was so annoying, the first thing I did was sniff the serial protocol and write my own little non-obtrusive applet. I asked the manufacturer for the proto specs first, but they delined, even after I pointed out how easy it was going to be to reverse engineer them... idiots!
Never thought I'd write something like this, but kudos to MS for saying we're not going to work around your crappy little app.
</rant>
This isn't Microsoft's fault (Score:3, Informative)
The change that broke these applications was changing the base address of user32.dll (from 77D40000 to 7ED10000 I believe). The programs that broke were using the 7ED10000 range. When user32.dll can't load at its desired address, it will fail to start the process. DLLs hard-linked by an EXE will be loaded before user32 or kernel32 if they are the first in the import table. Once loaded, user32.dll can't load at its desired address and will get relocated. user32.dll doesn't like this and aborts starting the process. This happens even if the bad DLL is relocatable, because preferred addresses are first-come, first-serve.
The entire 60000000-7FFFFFFF address range is reserved for Microsoft DLLs and special memory. Don't stick your own DLLs in there! (This address range is true of Win64 as well: just add 8 zeros to the front.)
As for why user32.dll and kernel32.dll don't relocate like other DLLs: so many badly-coded programs that do DLL injection assume that the addresses of LoadLibraryW, etc. in other processes are the same as the ones in their own processes. Almost all DLL injection code snippets assume this, and it's just wrong. The proper way is to use either EnumProcessModules or CreateToolhelp32Snapshot to list all the DLLs in the target to find the one you want. The correct address to use is then remote_function = local_function - local_dll + remote_dll. The types HMODULE, HINSTANCE, and IMAGE_DOS_HEADER * are equivalent, so just cast to a DWORD_PTR.
Re: (Score:3, Interesting)
You simply have to be careful with the address space if you are a library that will be dynamically loaded in plenty of images, especially if you are loaded very early on.
(Heh, last
Re: (Score:2)
http://it.slashdot.org/comments.pl?sid=228751&cid