MSN, Word Vulnerable To Shell: URI Exploit 392
LnxAddct writes "InfoWorld is reporting that a few Microsoft products are also vulnerable to the "shell:" scheme vulnerability found in Mozilla last week. These applications include Microsoft Word and MSN Messenger."
Comment removed (Score:5, Insightful)
Open Source vs. Microsoft (Score:4, Insightful)
Re:Word 2004 for OSX Safe? (Score:4, Insightful)
Ready...set...GO (Score:4, Insightful)
I don't see a patch posted with this story so I guess there's no way Microsoft can win the patch-speed race for this bug - all we will be able to do is place bets on just how much slower Microsoft is. Predictions, anyone?
Re:Open Source vs. Microsoft (Score:3, Insightful)
Re:Can only allow programs to be run... (Score:1, Insightful)
Re:Goes to show... (Score:5, Insightful)
Anyway, SP2's memory protection would have prevented the overflow attack. It would not have prevented the most general (and less harmful) form of the attack, however.
What the original poster was probably meaning, if he had a point at all, was that non-Windows systems don't do this sort of "command-line-as-a-protocol" bullshit because it's quite obviously the wrong way to do things. Security through obscurity works in a lot of cases because people think "nobody would EVER design an OS that did THIS" and they never bother to look. Well, now someone's looked and found an ancient kludge coded by someone who probably doesn't even work for MS anymore. And more man-hours are going into fixing this bug than would have gone into creating a proper implementation of whatever this goober was trying to accomplish in the first place.
That said, Open Source isn't pixie dust that makes everything happy and secure. Stupid things happen in Linux. They just happen in the open where people can find them and fix them before applications start relying on them to function.
Difference between MS and the rest (Score:5, Insightful)
I think the handling of this problem demonstrates the difference between Microsoft software and other software like Mozilla. In Mozilla, the problem didn't even require a real patch to fix, just a quick config setting to tell it not to pass things along to the shell: handler. My bet is that fixing Word etc. will require not just multiple registry changes but actual new code to allow shell: to be disabled. And odds on the first thing they try is to just add filters, and we'll see half a dozen iterations of exploits of this using different ways past the filters until MS finally includes a patch to allow it to be disabled.
Easy solution (Score:0, Insightful)
I'm typing this on my computer running Windows 98. This overlooked operating system doesn't have the bloat that other OS's have, and it's a lot more secure. We don't even have the shell protocol, so there's no shell exploit to worry about it. Just turn off file sharing, use Mozilla, and everything's great.
"Exploit" (Score:2, Insightful)
You know, some "it's not a bug, it's a feature" things really are features. I dont see how this is worse than while(true) { window.open(document.location); }
Re:Goes to show... (Score:3, Insightful)
Good. Go download it [microsoft.com]. Or don't. But at least don't be a hypocrite like half the people here and say that sp2 "doesn't count" until it reaches final release form, while firefox "counts" even though it's also in pre-release form (not even at 1.0 yet). Sort of like when people claim that IE on xp doesn't have popup blocking but firefox does.
Re:Mozilla Bug 163767 (Score:4, Insightful)
Every application that uses this scheme is vulnerable.
Maybe someone should check to see if IE has this "bug" as well.
Mozilla flaw? (Score:5, Insightful)
Misleading title - "...Mozilla flaw" (Score:5, Insightful)
"Microsoft products also vulnerable to Mozilla flaw"
If it was a Mozilla flaw to start with, my linux boxes would be vulnerable. I know its picky, but the title is not accurate IMHO as Mozilla is being used to take advantage of a Windows feature, rather than the flaw itself existing in Mozilla.
Even more reason.... (Score:5, Insightful)
Maybe its about time for some people to concider some alternate producivity suites - not just openoffice - even some suites like Corel have some intriguing software that lacks the user base of microsoft.
Rant>./rant
On a sidenote.. Corel lost a big share of its market to MS Office around the same time Netscape was crushed by IE. I remember my highschool used Corel at the time. Netscape was very smart to start the Mozilla Foundation insead of trying to beat MS, they are letting their supporters promote for them, gaining them some brand awareness if nothing else. Perhaps It wouldn't be so strange if Corel was to support a open source initiative, or merge with OpenOffice. The next best thing since frozen coffee for the computer geeks would be firefox and corel. Corel could sure use some geek to geek praising around now
For those of you not very firmiliar with Corel, at one point they were doing fairly well, then they kinda fell thru - had to lay off alot of people and are now trying to get back into the market.. but I personally think they face the same fate as Netscape.
In the real world, If you loose a customer, it takes twice as long to get that customer to come back to your business, and that customer is a big factor keeping other possible business from you, as they will tell at least 10 people of their experiance.
Based on this, even old Corel users would be hesitant or unwilling to switch back to Corel -so Corel needs a new movement. Open source anyone
Dying Proprietary Software + Open Source = Improved Code + Brand Awareness + "PROFIT" (Donations, Memberships? Support? and Smart Usage Of Your Brand Recognition)
With so many software companies expected to bust with news of the markets this week, I wouldn't be surprised to see a few new related open source projects pop up.
Rant> logout
Re:Goes to show... (Score:5, Insightful)
have a project that's been stable for years and it hasn't hit 1.0 yet. If Firefox suddenly released 2.0 would it sudenly be more mature? How about 3.0? What's the magic happy number? THERE IS NONE. You have to gauge each vendor, and each application, by a consistent set of rules and just forget what version number the marketing people decided it should have.
Re:Word 2004 for OSX Safe? (Score:5, Insightful)
Re:Goes to show... (Score:5, Insightful)
There is a big difference between the degree of risk I take with upgrading Firefox and the major overhaul that SP2 is going to turn out being. Sorry but this hypocrite isn't buying your assertion.
Re:Word 2004 for OSX Safe? (Score:5, Insightful)
On Windows I don't believe you can register a new protocol unless you actually execute a program. If there was a bug that allowed new protocols to be registered it would pretty much mean it is a bug that allowed arbitrary code to be executed, which would be a huge hole whether or not protocols could be registered.
Re:Goes to show... (Score:3, Insightful)
Um, well, the difference here, my friend, is that one is an upgrade for an application (Mozilla Firefox), and the other is an upgrade for an entire operating system (Windows XP). One risks the ability to browse , the other risks the ability to boot .
Prudent people might be willing to risk blowing up their pre-release browser for functionality and security, while not be willing to risk blowing up their entire OS with a pre-release patch just to get their browser updated...
Re:Word 2004 for OSX Safe? (Score:3, Insightful)
That's the first I've heard of it.
The disk: URL would map a n internet enabled disk image into the file system in a known place, and a following file: URL would execute code from the disk. This is the same kind of privilege escalation as on the Windows exploit that involved knowning the name of the temporary file that a web page or mail message was stored in, and then providing a file: URL that would load it with local privileges.
The fundamental problem is that the application, Safari or Internet Explorer, automatically uses all protocol handlers or helper apps anyone has registered, instead of only using those that have been marked (by being registered with the application, or by being registered with a special flag) as 'internet safe', and handling pages itself in a sandbox rather than handing them off to a more gullible application.
There are just so many exploits, no matter what the details, that depend on this charmingly naive "security model' that it should have gone on the junkheap long since.
Re:Goes to show... (Score:2, Insightful)
No, it's a Mozilla exploit. Mozilla was passing unverified user input to the shell (to Windows) and effectively telling Windows "I want you to run this program". Windows would then run the program. The bug here is that Mozilla should not be giving untrusted input to the operating system. The bug is not the fact that it is possible to pass something to the OS in that way, it's that Mozilla was not validating what input it was passing. Not blindly trusting user input is one of the first prinicpals of writing secure code, and Mozilla neglected that pricipal while IE didn't (but apparently MSN and Word did). It was probably a good idea to remove this from the OS (as was apparently done in xp sp2) since it was being abused, but it was not a "bug" in Windows. There was also a pretty short article in eweek [eweek.com] about the topic which you might find interesting.
Re:Fixed in SR2? (Score:3, Insightful)
So you're saying that it's ok for Microsoft to wait two years to fix it?
I didn't think so.
Re:Goes to show... (Score:3, Insightful)
Well, when Microsoft can do the equivalent of:
Run old version.
Install new version.
Run new version.
Decide you don't like it and reinstall old version.
It's not a level playing field. Half-baked open source "counts" whereas Microsoft's "almost" doesn't. Works like the beta of alpha-beta statistical errors.
Re:Difference between MS and the rest (Score:1, Insightful)
Even if they had a patch right away, it would take a while to put it through the QA labs at MS to ensure it doesn't break anything vital. Mozilla just rolled the patch into a nightly build, ran some unit tests and released it. They didn't have to worry about it breaking 6,000 custom designed applications.
It is a little premature (Score:3, Insightful)
Microsoft's MSN Messenger and Word word processing application both support a feature that could give remote users access to functions that could be used launch applications on Windows computers,
Unless the SECUNIA people are stupid, launching an app from within another app is what every Microsoft Application is able to do and has been able to do for many years. However I do not think that such feature exists for Microsoft products only. What I am having a hard time distingushing is between Secunia trying to stay on the news and a real vulnerability here. I am not saying it might not exist, but as of this moment I do not see anyone able to run a Shell() command within your app, unless they have gotten to your app, which means they have gotten to your computer already. Also this has existed for a long time. Why now? I might be completely wrong however, and someone at Secunia knows something they are not sharing. I advise them to share any info as soon as possible. The reason I am a little pissed is because in my company I have thousands of Word and Excel documents with thousands of lines of VBA code. With news like this, I smell a panic meeting early in the morning tomorrow which might be nothing more than FUD from Secunia. Honestly I am at a point where I am having a hard time trusting anyone anymore. Hackers want to be my security gurus, OS makers rant and rave about their respective OSes and how secure and reliable they are(only to issue security patches soon after), whole campaigns asking people to boycot a product because of vulnerabilities and use X product, only to find out that X is vulnerable as well. If you look at the stack of firewalls and security appliances at my company, it looks like we're building the walls of damn Troy. I joke with the security guys about the kind of attack they are preparing against. There is hope of course.....but how long before it's too late?
I know you're a troll, but... (Score:4, Insightful)
This is not a flaw in Mozilla, nor is it a flaw in IE, Outlook, Word, or any other part of Microsoft Office.
This flaw is a flaw in Windows, and is typical of flaws in Windows in that the OS is expecting it's applications to handle security, will run any peice of crap handed to it by any app, and we can expect to see more flaws that are similar in nature due to the heavily integrated design of the Windows operating system.
Re:Mozilla flaw? (Score:3, Insightful)
Of course, they could whitelist, say "Okay, only telnet:, ssh:, and aim: can go through." But this really isn't viable because it breaks the principle of things just working because future additions won't work.
The simple truth of it is, without adding layers to the system, like a shell: blocker, is to be accountable when programming a protocol.
Re:What other programs are vulnerable? (Score:3, Insightful)
(I didn't see anyone say that on Full Disclosure.)
You're wrong. Neither of the programs I tested raised a warning dialog. A newer version of Word does, though, as pointed out by several Slashdotters.
In neither case does the link "self execute" -- you need to ation on it to cause the problem.
The only action required in both programs is activating a link. Activating a link is supposed to be safe.
Chasing a link that raises an error box, and then clicking "OK" -- that's stupid and dengerous.
Depending on the wording of the warning dialog, it might not be stupid.
If the warning is 100% jargon, as in "This link uses the shell: protocol. Do you want to proceed?", only someone very geeky or very paranoid would click Cancel. I think AIM or Gaim or Trillian has a dialog like this.
If the warning says "Hyperlinks can be harmful to your computer and data. Do you want to continue?", many users will think "Huh? Hyperlinks have to be safe; I click them in web pages all the time." and click OK. Word 2003 has a dialog like this and doesn't show it for "safe" protocols. [slashdot.org]
Re:Mozilla is Slow to Respond! (Score:5, Insightful)
If your flash plugin had a security hole, would you expect Mozilla, Opera, IE, etc to filter certain access so that security hole could't be exploited?
No, MS is responsible for the security of their own products.
Re:Goes to show... (Score:3, Insightful)
Re:Mozilla Bug 163767 (Score:2, Insightful)
As always, I like how the last paragraph shows Microsoft's dislike for people to post Microsoft security flaws for the world to see.
Re:Mozilla is Slow to Respond! (Score:3, Insightful)
Do you know the first rule of secure programming?
DO NOT trust input data.
If browser gets data and blindly passes it to the OS, well.. that's a bad browser. I don't see MS fault at all.
Re:Mozilla is Slow to Respond! (Score:3, Insightful)
I don't understand what the problem is here. The OS in OSS means "Open Source". You have the source so (if you have the ability) you can fix the bug - and if you are civic minded enough you can submit your patch and give something back to the project. This is why OSS does stand a chance.
"Use the SOURCE Luke"
Re:Mozilla is Slow to Respond! (Score:5, Insightful)
Re:Mozilla is Slow to Respond! (Score:4, Insightful)
First there shouldn't even be a shell uri in the OS! Second, there is a vulnerability IN THE SHELL URI which escalates the priv level to that of the user.
If Mozilla passed the data along and said, here ya go it's good stuff, completely trusted. That would be one thing, but mozilla passes it along and says I have no clue what this is or where it's coming from and have no reason to believe it safe in any fashion. You have any ideas?
If it's the RIGHT data, then windows tells itself it was the current user and not some untrusted guy off the web who gave it that data. The bug is in windows!
Hell the entire scheme or uri handling in windows is fscked up. There shouldn't be any uris which cause local execution!
Re:Mozilla Bug 163767 (Score:3, Insightful)
And the whole reason the browser is passing it is because it's NOT a known uri type (who would expect there to be a shell uri, what kind of idiot comes up with the brilliant idea for a shell uri to begin with?).
This is windows, remember that most uri types aren't documented. Since we are only talking about unknown datatypes, it's a safe bet the browser will never know how to treat them. Which is why it does what it's supposed to do and passes it to the OS clearly labeled as hazardous nuclear waste.
Rarely useful?! At least half the media types you load are able to function due to this feature? (assuming you use Mozilla).
There is a security scheme in place in windows for this type of content for just this purpose. Mozilla handles this the way a windows application is supposed to do it. If the security scheme is broken it's 100% a microsoft issue.