IE Download.Ject Exploit Fixed 421
Saint Aardvark writes "Just in time for the weekend, the
Internet Storm Center is reporting that Microsoft is providing
a fix for the Download.Ject vulnerability that hit IE late
last month. The press
statement says that it'll hit Windows Update later
today..."
FYI (Score:4, Informative)
In addition to this configuration change, which will protect customers against the immediate reported threats, Microsoft is working to provide a series of security updates to Internet Explorer in coming weeks that will provide additional protections for our customers.
Please note that this isnt a fix, it is only a configuration change to help defend against the problem and nullify the threat from the known places it is spreading from. No doubt that within a short time, whoever is behind the virus will find other places to have the virus attack from. This is just another "this will help for now, please wait for the real fix" incident from Microsoft.
One down, ??? to go (Score:2, Informative)
Um (Score:3, Informative)
Re:FYI (Score:5, Informative)
Critical Update for Microsoft Data Access Components - Disable ADODB.Stream object from Internet Explorer (KB870669)
Adodb.stream provides a method for reading and writing files on a hard drive.
Quick Info
File Name:
Windows-KB870669-x86-ENU.exe
Download Size:
104 KB
Date Published:
7/2/2004
Version:
870669
Overview
Adodb.stream provides a method for reading and writing files on a hard drive. This by-design functionality is sometimes used by web applications. However, when combined with known security vulnerabilities in Microsoft Internet Explorer, it could allow an internet web site to execute script from the Local Machine Zone (LMZ). This occurs because the ADODB.Stream object allows access to the hard drive when hosted within Internet Explorer.
It has nothing to do with known threats.
Re:Um (Score:5, Informative)
What about ActiveX? (Score:4, Informative)
Re:Um (Score:5, Informative)
Autoupdate only installs "critical" patches. WM9 and the Euro tool are not such updates.
-sid
Microsoft released a fix a long time ago (Score:5, Informative)
Wonder no more. 11 months of IE exploits and at least a year or two's worth of future exploits can be avoided with one simple registry change [microsoft.com]. The problem that MS has isn't that they are incompetent, it's that they insist on leaving default features that are used by 1% of administrators like myself.
98% of spyware released since January 2004 can be avoided with the above registry fix. If you think that statistic is outrageous, I challenge you to find one piece of malware installed without using ADODB.Stream in one way, shape, or form. Be forewarned, I make and research IE exploits for a living and wouldn't make this kind of a claim without having the data to back it up.
Re:Um (Score:3, Informative)
Re:Where is the notice? (Score:2, Informative)
M.S. claims exploits happen AFTER patch is issued (Score:1, Informative)
Re:48 Hours (Score:4, Informative)
He is referring to this Security Focus article [securityfocus.com]
From the article,
Still, speaking at a press conference here Monday, Gates told journalists that Microsoft's patching process compares well with competitors'. "You know, the time -- the average time -- to fix on an operating system other than Windows is typically ninety to a hundred days," said Gates. "Today we have that down to less than forty-eight hours."
I already posted link to this article here [slashdot.org]
Fix not available yet (Score:3, Informative)
I know of at least two very large companies who have moved to Firefox in the wake of this latest episode. I suspect many people are finally fed up, which has prompted MS to announce patches before they're even available.
Considering a recent patch to fix a vulnerability broke the complaince of IE as it relates to embedded uids/pws in URLs, I wouldn't be surprised if this "fix" ends up crippling something else.
We should start collecting wagers on what new problems this upcoming "fix" introduces. Otherwise it would probably be online by now.
Re:FYI (Score:2, Informative)
I agree with most of your post, but I haven't seen many manufacturers care a whit about liability. In fact, the EULA specifically absolves MS of any liability. Most OSS licenses do the same, of course, but you imply that MS can be held liable, which they cannot.
HERE Re:Where is the notice? (Score:3, Informative)
"Use a different web browser
There are a number of significant vulnerabilities in technologies relating to the IE domain/zone security model, the DHTML object model, MIME type determination, and ActiveX. It is possible to reduce exposure to these vulnerabilities by using a different web browser, especially when browsing untrusted sites. Such a decision may, however, reduce the functionality of sites that require IE-specific features such as DHTML, VBScript, and ActiveX. Note that using a different web browser will not remove IE from a Windows system, and other programs may invoke IE, the WebBrowser ActiveX control, or the HTML rendering engine (MSHTML)."
Re:Microsoft released a fix a long time ago (Score:3, Informative)
Re:not a troll (Score:4, Informative)
Re:Where is the notice? (Score:2, Informative)
http://www.kb.cert.org/vuls/id/323070 [cert.org]
the very last suggested solution states:
i'm no web journalist, but i'd hardly call that a recommendation or urging to use a browser other than ie.
Re:Microsoft released a fix a long time ago (Score:4, Informative)
The registry change you point to only affects the ADODB.Stream object. While holes involving ADODB.Stream may have made up a large porportion of successful exploits by spyware (as you claim), there have been other arbitrary-code-execution vulnerabilities in Internet Explorer during the time period you mention.
I'm guessing that there have been several zone-jumping holes, and ADODB.Stream makes all zone-jumping holes into arbitrary-code-execution holes. Is that what you mean by "using ADODB.Stream in one way, shape, or form"?
I make and research IE exploits for a living and wouldn't make this kind of a claim without having the data to back it up.
I find and fix Mozilla security holes as a hobby and I think you're making stuff up.
IE Download.Ject Exploit *not* fixed (Score:5, Informative)
No security vulnerabilities have actually been fixed here; all that's happened is that some functionality (which exacerbated existing security holes and was probably a bad idea to begin with) has been disabled.
Re:Got it, but.. (Score:3, Informative)
jaz
Windows 9x and Windows ME users still vulnerable? (Score:4, Informative)
It does NOT run on Windows 98.
Oh, I remember, Microsoft only produces patches for "supported" (if that's what you can call it) products.
Re:Get the fix early here. (Score:1, Informative)
Yes [codeweavers.com].
Re:That reminds me... (Score:3, Informative)
Re:Windows 9x and Windows ME users still vulnerabl (Score:3, Informative)
Re:not a troll (Score:3, Informative)
If you want to complain, complain about Seamonkey. It suffers from the same bug, yet is at version 1.7.
Oh, and btw, [Ctrl +] (optionally, followed quickly by [Ctrl -]) will cause the page to re-render and display correctly. It's an easy work around until the fix makes it into the official builds.
Re:Got it, but.. (Score:3, Informative)
Instead of disallowing DoubleClick cookies, edit your hosts file to change the address for the DoubleClick sites. These are the relevant ones that I've got in my hosts file--YMMV.
Re:That reminds me... (Score:2, Informative)
30 whole seconds, eh? What if I'm writing the document and took a moment to walk across the room to the bookcase or filing cabinet to consult a reference of some kind? Or someone just walked in and asked me a question. Or the phone rang. Or...
30 whole seconds?