IE 7.0/8.0b Code Execution 0-Day Released

SecureThroughObscure writes "Security blogger and researcher Nate McFeters blogged about a 0-day exploit affecting IE7 and IE8 beta on XP that was released by noted security researcher Aviv Raff. The flaw is a 'cross-zone scripting' flaw that takes advantage of the fact that printing HTML web pages occurs in the Local Machine Zone in IE rather than in the Internet Zone. Quoting McFeters's post: 'This is currently unpatched and in all of its 0-day glory, so for the time being, beware printing using the "print table of links" option when printing web pages.' McFeters and others will be presenting at Black Hat on the link between cross-site scripting and cross-zone. Rob Carter has been hitting this hard over at his blog, pointing out cross-zone weaknesses in Azureus, uTorrent, and the Eclipse platform."

0-day

[by Anonymous Coward]

0-day? This term seems to have lots all meaning. Could we please stop using it?

Re:0-day

[Fast Thick Pants (1081517)]

Zero is the answer to the question "How long has the vulnerability that this exploit exploits been patched?" I suppose you could call it a -24 since it probably won't be patched until next month's black Tuesday.

Re:0-day

[tyler.willard (944724)]

That's what the term seems to have mutated into, but it wasn't its original intent.

The whole point of coining the term in the first place was to be able to discuss the unknown; i.e., to be able to assess the potential danger of currently unknown threats. Day-1 refers to disclosure, as such there's no way to talk about a specific 0-day because if you know what it is than it has to at least be day-1.

Sure it's abstract, but it's an important concept for developing security technologies and security procedures.

Between product buzzwords and the abstract nature of the term it's almost lost all meaning.

Re:0-day

[Lincolnshire Poacher (1205798)]

> The whole "day thing" is about the time between disclosure and patch/signature release.

Do you have any citation for your assertion?

The term derives from warez "0-day boards". These were populated by the most elite crackers who had cracked software on the 0th-day of release; that is, the software hit the shelves and was already cracked.

Try doing a web search for ``0-day'' with a date threshold prior to, say, 1995. You won't find any hits for your interpretation:

http://www.alltheweb.com/search?advanced=1&cat=web&jsact=&_stype=norm&type=all&q=%220-day%22&itag=crv&l=en&ics=utf-8&cs=iso88591&wf%5Bn%5D=3&wf%5B0%5D%5Br%5D=%2B&wf%5B0%5D%5Bq%5D=&wf%5B0%5D%5Bw%5D=&wf%5B1%5D%5Br%5D=%2B&wf%5B1%5D%5Bq%5D=&wf%5B1%5D%5Bw%5D=&wf%5B2%5D%5Br%5D=-&wf%5B2%5D%5Bq%5D=&wf%5B2%5D%5Bw%5D=&dincl=&dexcl=&geo=&doctype=&dfr%5Bu%5D=on&dfr%5Bd%5D=1&dfr%5Bm%5D=1&dfr%5By%5D=1990&dto%5Bu%5D=on&dto%5Bd%5D=16&dto%5Bm%5D=5&dto%5By%5D=1995&hits=10 [alltheweb.com]

Try USENET for certainty ( blocked in work ).

Re:0-day

[An ominous Cow art (320322)]

Yeah, the term has definitely been bricked.

A Disturbing Trend, But Not Unforeseen...

[blcamp (211756)]

The more complex the software releases become, the more complex and insidious the exploits of them become also.

I'm not sure that holds up

[HangingChad (677530)]

The more complex the software releases become, the more complex and insidious the exploits of them become also.

I'm not sure if that statement will hold up to scrutiny. If complex software is the issue, then you'd expect exploits to be consistent across platforms when comparing software of similar complexity. I haven't seen any research supporting that observation. I have seen research that says more complex software will likely contain more coding errors and potential exploits but haven't seen a correl

Amazing

[duplicate-nickname (87112)]

I didn't even know that "Print table of links" was an option for printing in IE until today. My guess is that no one actually uses that feature, and this 0-day exploit affects roughly 0 people.

Re:Amazing

[CastrTroy (595695)]

Even if you did know about the feature, I'm not sure of it's usefulness. Saveing a spreadsheet of links might be useful, but printing them out? Most URLSs are pretty hard to type back in, and wouldn't be all that useful on paper. Look at the url I'm no right now.

http://it.slashdot.org/comments.pl?sid=555236&op=Reply&threshold=1&commentsort=0&mode=nested&pid=23432544 [slashdot.org]

Why you would want that printed out on a piece of paper is beyond me. It might possibly somewhat work on a PDF printer, but even then, it's use is limited.

Re:Amazing

[by Anonymous Coward]

You're forgetting about another MSIE feature, a TWAIN plugin called "Scan table of links".

Re:

[Penguinisto (415985)]

Actually, I could see uses for it - but mostly for web designers as an audit tool, and for corporate security types who want to gin up a list of naughty links with which to show the employee and his/her boss.

Now for a real use? Well, maybe one. To save having to scribble them down, you could waste a couple reams of paper printing out, oh, maybe a dozen MS Sharepoint links to an overly-anal supervisor who demands that you include reference links in a printed report.

/P

Proof

[morgan_greywolf (835522)]

This is proof of what I've said from the beginning -- the whole concept 'zones' in IE is stupid and pointless. Scripts should be allowed only what you allow them, period. You should be able to give permissions down to the individual site (ala NoScript) or even down to the individual script.

Re:Proof

[ScentCone (795499)]

You should be able to give permissions down to the individual site (ala NoScript) or even down to the individual script.

Look, for most people, the zone idea actually makes sense. Basically, don't trust ANY web site to do the tricksy stuff, but add (for example) your company's intranet to the safe zone, where it can do more desktop-ish stuff. I don't think that's such an awkward concept, and it spares people from having to think through what to allow, or not, on a site by site basis, as they surf. Most people are not this audience. And being able to enforce zone policies at the enterprise level makes a lot of sense, since average users are routinely shown to be spineless and witless: they'll add a poisonous Russian casino spam site to the safe list if that site pops up a tutorial on the steps the have to take to do so, if they want their free emoticon package.

Fiddly, granular systems only work for fiddly, granular people.

Re:Proof

[morgan_greywolf (835522)]

Pffft. So tell me-- why when I browse a site in the "Internet-zone" and then print a table of links, does that function run in the 'Local Zone'?

I'll tell you why: because it has to. You can't access local devices in the Internet Zone. That's the point. Granular approaches would allow you to print without accidentally giving other permissions to something that shouldn't have them.

At the enterprise level, with something like NoScript, you can just allow entire domains, say intranet.example.com or whatever your organization uses.

Next thing you're gonna tell me is that you think Microsoft should do away with ACLs at the individual file level or even the directory because users are just too stupid to figure that out. They should just have "file zones" and people will just have to stick their files in the right zone. Pffft.

Re:Proof

[keytoe (91531)]

Your markup is incorrect - you left the slash off your closing Pffft. tag.

Re:Proof

[knarf (34928)]

While it may be true (and it *better be true*) that untrusted zones can not directly touch local devices the question still remains why there is any processing being done on data from a lower-trust zone *inside* a higher-trust zone. That is the wrong approach. Had they formatted the document to be printed inside the lower-trust zone and handed a formatted document to the higher-trust zone (in whatever format is used to print documents: metafile, postscript, etc) to be printed this problem would not have occurred. That is, given that the print spooler does not goof up with the data to be printed of course...

Re:

[CastrTroy (595695)]

Why would you want special permissions on stuff in your intranet? Couldn't any disgruntled employee set up a webserver on their computer, send out a mass email, telling people to visit the url. and infect a large portion of the computers in the office? If you want special permissions for intranet servers, install your own CA, and let the browser run stuff only signed by that CA.

Re:Proof

[CastrTroy (595695)]

And for IE the defaults allow special permissions to your entire intranet. By default all the permissions should be low. There's no reason to grant higher permissions to the entire intranet. If you need something like that set up at your organization, you should have to enable it per server, or per domain.

Re:Proof

[Penguinisto (415985)]

Having actually used the 'Zones' concept recently on IE, I gotta say - it needs work. LOTS of work. The first time someone wants to diddle with a MySpace app and discovers that it won't work until you basically ratchet down the settings --often by hand in the advanced options--? Then couple that with the fact that many websites can pull in parts and content from multiple domains, requiring permissions to be set on each and every one? The whole thing would go out the window and the user would promptly ratchet down the whole WWW.

The concept itself is okay, but the implementation could use a good, solid overhaul.

/P

Re:

[MobyDisk (75490)]

People just need to stop using web browsers as a way to control the desktop. If you are in a domain, then the domain administrator can push executable apps, policies, and commands down to the computer. HTML, Javascript, and ActiveX are not tools for administering networks.

Also, having developed desktop applications that used embedded IE, I can tell you the zones system is completely screwed-up. It changes in every version, the APIs are inconsistent across different Windows OS's, and there are crazy looph

Re:

[evanbd (210358)]

That's insufficient. The danger from scipts comes from sites you *do* trust that get hacked. And if you grant permission per script, how many people are competent to read a script and judge it to be non-malicious? Of those, how many will feel like taking the time for every single script?

NoScript is good, and I use it, but it's far from sufficient to secure the browser against script-based attacks.

Re:Proof

[Manip (656104)]

IE or any other modern browser on the market.

You would also have every web developer in the marketplace whining about how IE ignores standards if they pulled the plug on scripting.

Sorry but Zoning in IE is fine. IE 7 is actually a pretty good modern browser and, sure, it isn't perfect but frankly what is?

Re:Proof

[myxiplx (906307)]

I disagree, zones are great, I just wish they'd implemented them better. We use zones as a quick way to enforce across the whole organisation which sites can and can't run scripts. The concept is superb, regular sites can't run scripts, activex, or anything. IT designated 'trusted' sites work fine.

Unfortunately, IE7 has made things a little more difficult:

- Pages with content from various zones no longer show up as 'mixed'. Since the upgrade to IE7, all sites only show the zone of the main URL, however the content runs according to the security zone for it's own source. It makes it almost impossible to work out whether a site can or can't run scripts, and you end up digging into the pages source code to work out what sites need adding to the trusted zones to get pages to work.

- Dynamic scripts added to a page in the 'trusted' zone, execute from the 'internet' zone. This is "by design"... The only workaround is to change the way the code works on the server.

- If you want to lock down the 'internet' zone, you will need to add "about:internet" to your 'trusted' zone

- You will also need to add res://ieframe.dll to your 'trusted' zone

Re:

[Fast Thick Pants (1081517)]

I like the zones; I wish Firefox had them. I love NoScript very much, but I wish I didn't have to authorize, say, slashdot.org, to run java apps. I'd rather configure a middle tier that would allow javascript and nothing else.

Re:

[morgan_greywolf (835522)]

scripting is not dangerous unless there's a flaw in javascript.

If only JavaScript were the only scripting option on IE. Furthermore, JavaScript is one of the primary vectors of attack for Firefox, IE and Opera: what makes you think that an untrusted JavaScript is NOT dangerous?

you can do it with IE by putting the sites into the different zones.

Right. Again, see how NoScript does it. Far easier and more convenient for the user, IMHO.

Usage

[Wowsers (1151731)]

People still use Internet Exploder?

yes, I use it

[thisispurefud (1061012)]

People still use Internet Exploder?

yes, I use Internet Explorer in Windows Vista that is the safest browser because it runs with the lowest privileges possibile in a sandbox (IE7 Protected mode). In fact IE7 under Vista is not affected by this flaw i.e. remote code execution is not possible (yet another reason to use Vista and UAC).

Oh yeah?

[Spy der Mann (805235)]

yes, I use Internet Explorer in Windows Vista that is the safest browser because it runs with the lowest privileges possibile in a sandbox (IE7 Protected mode).

Oh yeah? I use Internet Explorer in XP under non-admin mode in a virtualbox install on Cygwin on a virtualbox install of XP inside a Linux virtualbox install under a SELinux host!

HAH! Take that!

Re:

[Just Some Guy (3352)]

Sorry, I could not keep from modding this funny.

It didn't take.

For using IE since 2.X...

[AioKits (1235070)]

I can safely say I did not know this ability even existed. (Don't hurt me! I use FireFox at home! Honest! I even brought some FF t-shirts and the laptop tote.)

Irresponsible disclosure

[benjymouse (756774)]

The vuln. is probably real, but Aviv Raff notified Microsoft the day before he went public with a "treasure hunt" for this bug (celebrating Isreals 60th birthday); thus the fact that it's a 0day vuln. is entirely his doing. Way to go.

Re:Irresponsible disclosure

[reset_button (903303)]

Is it better to keep it secret until a patch comes out and hope that nobody else has discovered the vulnerability, or publicize it and let people know not to use this IE feature until it's patched?

Re:Irresponsible disclosure

[benjymouse (756774)]

In a word? Yes. Ask Mozilla.

Re:

[MMC Monster (602931)]

Agreed. It's considered good form to give the developers at least some notice prior to releasing a security exploit into the wild.

Re:

[by Anonymous Coward]

The vuln. is probably real, but Aviv Raff notified Microsoft the day before he went public with a "treasure hunt" for this bug (celebrating Isreals 60th birthday); thus the fact that it's a 0day vuln. is entirely his doing. Way to go.
Yes, as always... blame the whistle blower not the manufacturer of the crap product.

*feeds the troll*

[Animaether (411575)]

Nobody is blaming Aviv for the existence of the bug. Nobody is blaming Aviv for telling people about the bug.

We *might* be blaming Aviv for telling the world, script kiddies and botnet operators alike, about this bug -before- even notifying the manufacturer of the crap product.

Nor did Aviv wait a reasonable time period for the manufacturer to admit their product's crap state and issue either A. a warning of their own (don't print links) or B. a fix, while providing full credit for discovering the bug to Av

Re:

[Workaphobia (931620)]

Yeah, really. There's no glory in "finding" a zero day exploit; it's not as if it's inherently more severe or damning than any other flay. But it sure looks better on the headlines.

Can it be triggered via javascript?

[foniksonik (573572)]

Can you trigger this behavior in an onload event?

If not it's a rather useless exploit other than as a prank to pull on your secretary... "Hey Sandra... can you print out a table of links for this website?"

5 minutes later "What the F***!"

"HAHAHAHAHAHAHA... I totally got you!"

Re:Can it be triggered via javascript?

[ruiner13 (527499)]

You can certainly trigger the window.print() command in the onload, but setting the properties of the dialog to what is needed for this exploit cannot be done. VBScript may allow further printing options, but I suspect the page would first trigger the standard scripting warnings and the user would still be forced to intervene.

Re:

[CastrTroy (595695)]

Well, could you encode a link properly and post it on slashdot? Would it get through the filters? I imagine quite a few people are trying the "print table of links" feature on this very page, simply because nobody has ever used it.

No

[The MAZZTer (911996)]

The best you can do is window.print() to bring up the Print dialog. The user would have to select the "Print table of links" option manually and then print to any printer.

To view this article on one page...

[Thelasko (1196535)]

please select the printable version.

end sarcasm

I'll be back in a bit ...

[tgd (2822)]

Going to print the article so I can read it on the can. I'll post a response about it when I get back.

Must we highlight every bug in IE?

[Anonymous Brave Guy (457657)]

I appreciate the desire to raise awareness, but there's no practical benefit to running this story other than Windows bashing. It'll get patched, the patch will probably ship on some future Tuesday given this is a feature few people use and the risk of exploitation is relatively low, and that'll be that.

In contrast, a far more dangerous bug [debian.org] in the openssl package used by Debian and its derivatives was discovered earlier this week, and doesn't seem to have made the Slashdot home page at all, even though i

Re:Must we highlight every bug in IE?

[makomk (752139)]

The Debian OpenSSL bug definitely made the Slashdot home page [slashdot.org]; you must've missed it. (It was posted on Tuesday, a couple of hours after the official announcement - that's quite fast for Slashdot. This story, on the other hand, obviously wasn't considered as important - I read about it elsewhere a day or two ago.)

Re:Must we highlight every bug in IE?

[dissy (172727)]

In contrast, a far more dangerous bug [debian.org] in the openssl package used by Debian and its derivatives was discovered earlier this week, and doesn't seem to have made the Slashdot home page at all, even though it's probably relevant to a lot of the Slashdot readership and there is real action they can take to fix things. Go figure...

It was on the slashdot front page on Tuesday

http://it.slashdot.org/article.pl?sid=08/05/13/1533212 [slashdot.org]

Re:

[Vexorian (959249)]

God forbid this site bashed windows.

WTF is a "0-day" ?

[OneSmartFellow (716217)]

...When are we going to be able to read an article written by anyone other than some jerk-off using buzz-phrases whenever possible.

"0-day" doesn't mean a f$%^&ing thing ! There is no information being transmitted by that phrase, it is empty of any meaning and might as well be a punction mark.

Re:

[OneSmartFellow (716217)]

From the Wikipedia article cited

A zero-day (or zero-hour) attack or threat is a computer threat that tries to exploit unknown, undisclosed or unpatched computer application vulnerabilities.

So, it's a newly discovered exploit. Can't we use that phrase instead of the uber-lame "0-day"

Printer-friendly version

[6Yankee (597075)]

here [pwn3d.ru]