Another Critical Microsoft Hole 601
gmuslera writes "Not was enough that recent vulnerability in IE that can run any program in an unpatched windows system. Now there is another
related to an ActiveX control that can make IE and IIS to run any code in the system. The Microsoft solution? kill the related ActiveX control and replace it with a safe one. The Microsoft problem? As this control is Microsoft signed, any site can require it, upload it and replace the "good" one with the vulnerable one. The final recomendation from Microsoft? Don't trust/run ActiveX controls signed by Microsoft." Gimble points to the appropriate locations on Microsoft's website: "Another buffer overrun (that allows arbitrary code to be run) has been admitted to by MS, and it affects IIS and IE on clients (but not on XP), and they have a patch available here Security Hotfix for Q329414. The kicker is that a patched system can be rendered vulnerable again by a hostile web site or HTML email. The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
Microsoft Security Bulletin MS02-065 (Score:3, Informative)
The admission is in the faq section. (Score:5, Informative)
What steps could I follow to prevent the control from being silently re-introduced onto my system?
The simplest way is to make sure you have no trusted publishers, including Microsoft. If you do that, any attempt by either a web page or an HTML mail to download an ActiveX control will generate a warning message. Here's how to empty the Trusted Publishers list:
1. In Internet Explorer, choose Tools, then Internet Options.
2. Select the Content tab. In the Certificates section of the page, click on Publishers.
3. In the Certificates dialog, click on the Trusted Publishers tab.
4. For each certificate in the list, click on the certificate and then select Remove. Confirm that you want to remove the entry.
5. When you've removed all entries from the list, select Close to close the Certificates dialog, then click on OK to close the Internet Options dialog.
Re:why? (Score:5, Informative)
FWIW: .NET may help this... (Score:4, Informative)
Looking forward, I recently picked up
Mobile code that runs in the
Frustratingly, you can't run
Anyway... here's some additional links to M$ references on mobile code:
Security in
Security in the
Install MDAC 2.7 (Score:4, Informative)
Here's a URL for you, even...
MDAC 2.7 Refresh [microsoft.com]
Keeping Windows secure is hard, but it's easier if you install the recent components...
Re:More Bias (Score:1, Informative)
So they are requesting that people do what most people here recommend already - don't trust anyone.
A mountain of sloppy code? (Score:4, Informative)
While researching the article linked below, I developed the impression that Microsoft has for years allowed its programmers to submit sloppy code. Now bugs are not easily found or fixed because everything is a mess.
Windows XP Shows the Direction Microsoft is Going [hevanet.com].
Re:why? (Score:5, Informative)
I guess the same reason that...
Security Vulnerabilities in KDE 2.1-3.0.4, 3.1 RC3 [slashdot.org]
Trojan Found in libpcap and tcpdump [slashdot.org]
Bind 4 and 8 Vulnerabilities [slashdot.org]
and
Vulnerability In Linksys Cable/DSL Router [slashdot.org]
were posted?
i.e. this particular article would have been posted were it about windows, redhat, solaris or pretty much any other "widly used" system
And while where at it... (Score:4, Informative)
However, I am getting a little tired at all the MS bashing on Slashdot. It has been said before, but do we really need to have a story posted each time an Outlook/Explorer security breach, no matter how insignificant, is made public?
Re:why? (Score:5, Informative)
Nearly half of
This would seem to validate the need to have stories about Microsoft software bugs, especially those as grevious as this, on
And in the future (Score:1, Informative)
Re:Better fix (Score:2, Informative)
It sucks, though. but you didn't say anything about the FTP client needing to be good..
Re:Question (Score:5, Informative)
Create a shortcut to Internet Explorer.
Right-click the shortcut, choose "Run As.."
The option "Current User" and "Protect my computer and data from unauthorized program activity" should be checked.
Click OK to run Internet Explorer in "secure mode".
Caveats to running in this mode:
Your bookmarks or links won't appear, but they'll still be there if you run it in normal mode.
Other web-based programs may not run correctly.
You can test to see if it's working by going to Windows Update - if it's secure, you'll see something about having to run Windows Update as an administrator.
Re:MS buffer overrun theory (Score:4, Informative)
RTFM : lol... Try Runas.. (Score:5, Informative)
Unsafe at any release? (Score:5, Informative)
So, to fix this particular little problem needs a hardware replacement "upgrade" :-(
Re:Install MDAC 2.7 (Score:3, Informative)
However, the issue is that even after you've installed the patch, you're still vulnerable, because the vulnerable version will be downloaded and executed as soon as you hit a Web page requesting that version, since it's signed by Microsoft, and most installs trust stuff signed by Microsoft.
Sheesh, now /.er don't even read the blurb anymore?
Score one against DRM !!! (Score:5, Informative)
Q: Why would an attacker be able to silently re-introduce the old version of the control? Shouldn't there be a warning message?
A: A warning message is generated anytime there's an error associated with a digital signature (e.g., a bad signature or expired certificate) or the signer isn't trusted. But in this case, the digital signature on the old version of the control is still valid, and the signer is Microsoft - which is a trusted publisher in many cases. Because of this, most users would not see a warning message of any kind if the old control was re-introduced.
Ha! Microsoft is now providing very well written ammunition to the Anti-DRM movement; this makes me very happy.
Re:why? (Score:2, Informative)
Didn't I recently see on the front page an article about unpatched Apache servers? Wasn't this Apache OpenSSL Worm [slashdot.org] article on the front page last month?
Re:did you read the eula? (Score:3, Informative)
In no event unless required by applicable law or agreed to in writing will any copyright holder
Indeminification of software writers is standard practice. There are tons of better things you can use against Microsoft than this lame argument.
Re:More Bias (Score:3, Informative)
Despite, what's wrong with bashing a 40-billion quasi-monopoly that dominates the OS and Office markets while doing its best to destroy the competition by spreading FUD and distributing payolas around? Vocal criticism and boycotting are the sole weapons of consumers in facing this juggernaut, and you'd want us to forfeit these as well? Are you a MS employee or shareholder? If not, then why does MS-bashing annoy you so much? In my view, MS has more than deserved all the bashing it can get!
RTFA (Score:2, Informative)
From the MS TechNet article:
* Customers using Windows XP, or who have installed MDAC 2.7 on their systems are at no risk and do not need to take any action.
* Web server administrators who are running an affected version of MDAC should either install the patch, disable MDAC and/or RDS, or upgrade to MDAC 2.7, which is not affected by the vulnerability.
The "fix" to this vulnerability is installing MDAC 2.7 which is available on all versions of Windows back to 98.
Other than the fact that this is the 50,000th security patch that I have to install on all my machines, what's the big deal?
Bias and the 'solution' (Score:2, Informative)
The 'solution' from MS in Microsoft Security Bulletin MS02-065 recommends that you remove MS from the list of Trusted Publishers."
NO! The 'solution' from Microsoft is that you just patch your MDAC to include the component from 2.7 or that you just update your MDAC to 2.7
For Christ's sake people, if this were a *nix bug, you'd all be beating your "we know how to update our machines" drum complaining that only stupid Windows users don't use updates.
Or perhaps it would be the "at least fixes are available immediately for *nix" argument. MDAC 2.7 isn't new, kids.
Just report the bug, and report the CORRECT fix.
You disagree with me. Mod me down.
Re:RTFM : lol... Try Runas.. (Score:3, Informative)
It pisses me off, because I am doing the company's job. You can usually figure it out and write a script or bat file with cacls to apply the permisions the user needs.
Re:Don't trust Linux either... (Score:3, Informative)
We could look at vulnerabilities per line of code... But then MS has bloated code too... hmmm...
Catch-22 is probably a better description (Score:2, Informative)
Who could exploit the vulnerability?
* Web client. A user could exploit the vulnerability against a web client if he or she were able to construct a web page that would send an appropriate HTTP command, and then convince a user to open it. Typically, this would be done by either hosting the page on a web site that the attacker controlled or sending it directly to users as an HTML mail.
Also:
A warning message is generated anytime there's an error associated with a digital signature (e.g., a bad signature or expired certificate) or the signer isn't trusted. But in this case, the digital signature on the old version of the control is still valid, and the signer is Microsoft - which is a trusted publisher in many cases. Because of this, most users would not see a warning message of any kind if the old control was re-introduced.
HTTP commands are the method for exploiting this vulnerability. By default, IE trusts MS. I must use HTTP commands to visit the MS site and thereby learn not to trust MS (as advised). But in doing so, I accepted anything that may be malicious, before I knew exactly how not to.
From this point of view, it seems to be more of a Catch-22. But then, in that scenario, MS would host the malicious server, which would be horrible PR and therefore improbable.
One last thing, AFAIK it's the "Paradox of the Lie" and not the "Liar's Paradox", since the classic example is a statement (Like: "This statement is false" or my sig: "This is not my sig."), and does not refer to a person or liar. I lost points on a philosophy paper for just that reason. Pissed me off enough that I still remember it today.
This "study" was completely debunked. (Score:1, Informative)
First of all, in their comparison of the number of critical bugs in Linux vs. Windows, they counted application bugs in the Linux totals, but not in the Windows totals. If they had included all the bugs in IE, IIS, Office, etc., the Microsoft numbers would have been MICH higher.
Their other deceitful manipulation of the statistics was that they counted every bug in every Linux package once for every distro they evaluated. So even barring the other deception, you have to divide their Linux bug count by 15 or something to get a meaningful comparison.
A grain of salt ain't gonna cut it with this so-called "study". It's not just bad methodology; it's an outrageous pile of shit. You'd have to be a pointy-haired boss not to smell it.
Re:More design flaws (Score:3, Informative)
Actually I asked if I could see some facts to back up his assertions. It's all very well saying MS is dragging the industry behind, but unless you've got credible sources then it's pure speculation. Give me facts, good solid facts.
So, yea, congratulations, you've made yourself look like a bumbling idiot for picking only the parts of the post you disliked and putting them on the chopping block, while ignornig the point.
Go read his post again. I quoted EVERYTHING. That was the ENTIRE post. I didn't dislike the post, I just wanted some facts.
I don't dispute that MS is a bad thing - but when people start making claims that they drag the industry back then they need to quote some sources otherwise people will just bash it as mindless FUD.
If you can cite a source that backs up your comments, you'll find people are very ready to believe you more. It's all very well screaming "MS is eeeeeevil" till you're blue in the face - but it doesn't exactly help change peoples minds.