Windows XP Flaw 'Extremely Serious' 630
scottott wrote to mention a Washington Post article with the news that the security hole we mentioned on Wednesday has widened. Computers can now be infected just by visiting infected web sites, or looking at images in the preview panel of older versions of Outlook. From the article: "At first, the vulnerability was exploited by just a few dozen Web sites. Programming code embedded in these pages would install a program that warned victims their machines were infested with spyware, then prompted them to pay $40 to remove the supposed pests. Since then, however, hundreds of sites have begun using the flaw to install a broad range of malicious software. SANS has received several reports of attackers blasting out spam e-mails containing links that lead to malicious sites exploiting the new flaw, Ullrich said."
Re:Late breaking news from the article: (Score:2, Informative)
Browser appliance (Score:5, Informative)
http://www.vmware.com/vmtn/vm/browserapp.html [vmware.com]
Temporary Solution (Score:5, Informative)
until a patch is released.
Real easy (temp) fix. (Score:3, Informative)
You lose thumbnail view, and a few other (minor) built-in-Windows-picture-viewing tools break, but you use IrfanView anyway, don't you?
Come on, "editors", let's try to edit properly (Score:5, Informative)
There are two major factual errors here. One, the security hole has not "widened" - the scope of exposure is exactly what we read about Wednesday. Using shimgvw.dll to view a specially constructed WMF file results in system compromise (web site viewing of malicious WMF, previewing, opening w/MS picture and fax viewer, etc). The hole is exactly the same - exposure has increased, but the hole has not widened. Two: the web sites are not infected, they are malicious. The system is infected after visiting a malicious web site.
The full (well, as full as it is now) MS advisory is here [microsoft.com]. I'm not very pleased with how MS is handling this at all, but that does not excuse this shoddy "journalism". How hard is it to state facts correctly? All you had to do was change a few words, and it would have read much more accurately:
scottott wrote to mention a Washington Post article with the news that the security hole we mentioned on Wednesday is now affecting many more users. Computers can now be infected just by visiting malicious web sites, which are now rapidly increasing in number, or looking at images in the preview panel of older versions of Outlook.
For the last sentence, note that I sent mysefl WMF files win Outlook 2000 and 2003 while running Sysinternals process explorer and never saw shimgvw.dll called. Opening a WMF attachment called it, but not previewing, so there might be three errors, but I didn't test all versions that way, so I don't know...
Re:Temporary Solution (Score:5, Informative)
It isn't a bad idea to do, but before you do it in an enterprise environment, be sure you test it and are ready for the calls it will cause.
Not a total solution... (Score:5, Informative)
Okay, really, she said Arkanoid, but you get my point.
Re:Is it IE or Windows? (Score:4, Informative)
Using Firefox with Adblock installed one can stop all files of this dangerous type by adblocking them until a patch is available.
Re:Late breaking news from the article: (Score:3, Informative)
MOD PARENT UP (Score:5, Informative)
Re:Solution (Score:5, Informative)
This is not an ie flaw. This is a Windows flaw. You can still be affected with other browsers, you just have to try harder. Anything using the Windows DLL that does the WMF processing will be affected.
RootKit Revealer (Score:3, Informative)
Re:Real easy (temp) fix. (Score:3, Informative)
Re:Is it IE or Windows? (Score:3, Informative)
Older versions of Firefox doesnt help (Score:2, Informative)
Re:RootKit Revealer (Score:5, Informative)
You can't even be reasonably sure of it without at least some checksumming system like tripwire.
All you are doing is scanning for certain known rootkits. That's a weak strategy that's reactive and guaranteed to fail some of the time.
Re:Another /. dupe (Score:3, Informative)
http://www.securityfocus.com/archive/1/420378/30/
Re:Real easy (temp) fix. (Score:5, Informative)
Good idea. But how do you "reactivate" this feature once a patch is released? I use Ifranview, but I also depend heavily on the thumbnail feature in explorer.
Sigh. I do wish people would offer some information with their click here/type-this instructions so people would understand WTF they're doing.To register (or re-register) the dll:To run the command, you can use a console window (cmd.exe), or the Run dialog box (accessible from the Start Menu).
Re:Not a total solution... (Score:5, Informative)
The flaw can be used with a JPG file (read; the image of the button, or the site seal, or the photo) in the web page.
And since the flaw is in data in the header of the WMF file type, it can be executed even if the file extension is not WMF.
In other words, if you are seeing images on web pages with Windows, you can get this. No downloading is necessary even in other browsers. Until it's patched, the only true safe method is unregister the DLL or don't get on the internet with Windows at all.
As an FYI, I had to deal with this thing several weeks back when it was rare. (The bimbo doesn't remember what web site did it.) IF you do, just pull the drive, mount it on another machine, get your data, and wipe the damn thing. It's a really really tough infection to clean. It screwed the OS more ways than Courtney Love and ate so much CPU it was unusable. PLUS it downloaded other stuff and started to try to infect other machines on the network.
Shoot to kill this one guys, the patient is already dead.
IDS signatures (Score:5, Informative)
Snort sigs have been available from BleedingSnort [bleedingsnort.com] for some time now; I pushed them out to our corporate IDS yesterday morning.
(Warning, mangled by Slashcode - remove newlines)
t afile.pm.php; classtype:attempted-user; sid:2002734; rev:1;)
0 05/3086; sid:2002733; rev:1;)
#by mmlange alert tcp any any -> $HOME_NET any (msg:"BLEEDING-EDGE CURRENT WMF Exploit"; flow:established; content:"|01 00 09 00 00 03 52 1f 00 00 06 00 3d 00 00 00|"; content:"|00 26 06 0f 00 08 00 ff ff ff ff 01 00 00 00 03 00 00 00 00 00|"; reference: url,www.frsirt.com/exploits/20051228.ie_xp_pfv_me
# By Frank Knobbe, 2005-12-28 alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE EXPLOIT WMF Escape Record Exploit"; flow:established,from_server; content:"|01 00 09 00 00 03|"; depth:500; content:"|00 00|"; distance:10; within:12; content:"|26 06 09 00|"; within:5000; classtype:attempted-user; reference:url,www.frsirt.com/english/advisories/2
Once again it looks like Microsoft are going to escape the 'perfect exploit' meltdown by the skin of their teeth. This is exploitable remotely, but Dr Evil can't sit at a console typing in arbitrary IP addresses to 0wn with the exploit. On the other hand you can get close to that sort of thing using Metasploit Framework [metasploit.org].
more serious (Score:5, Informative)
Re:Browser appliance (Score:5, Informative)
Re:Temporary Solution (Score:1, Informative)
Re:What's the real lesson here? (Score:5, Informative)
Re:Sorry to say it got me (Score:5, Informative)
Re:Not a total solution... (Score:3, Informative)
Not necessarily. I think Firefox at least uses its own image-rendering library, which is why it's harder to get infected if you're using it. (You have to open an infected file in some other suitable viewer i.e. one that uses the affected library).
Re:MOD PARENT UP (Score:3, Informative)
runas
Note: 'root_user' is whatever you have renamed your 'Administrator' account. You have renamed your 'Administrator' account, right?
If you need a command prompt use
runas
If you need IE for a Windows update use
runas
and then go to the Windows Update site. If you need to do filebrowsing as a superuser use the same command, but then type "c:" in the address box.
There is almost nothing that you can't do with runas. Additionally, XP makes it easier for most programs with "Run As" being a left-click item. While there are some programs that you need to log in to install (itunes was one for me), and there are some minor config issues to get certain applications to work (the ones that assume you are an Administrator). Nonetheless, I haven't used the Administrator account for normal user operations for about 7 years.
Re:Is it IE or Windows? (Score:3, Informative)
This comment [slashdot.org] says that you can't block it (ny blocking a file extention as is done in adblock), as Windows will execute the file as a
Re:What's the real lesson here? (Score:4, Informative)
Because the WMF rendering code *is* GDI. Seriously - a WMF file is basically a list of GDI functions to call in order, along with the parameters to pass to them.
Depends. (Score:1, Informative)
However, if you configured FF such that the dialog no longer comes up (automatically opens files in default viewers), you're screwed.
Also, there was a post back on Wednesday from a guy saying that he did, in fact, click "Cancel" but still got infected...
Re:Temporary Solution (Score:5, Informative)
From http://www.microsoft.com/technet/security/advisor
I have software DEP enabled on my system, does this help mitigate the vulnerability?
Yes. Windows XP Service Pack 2 also includes software-enforced DEP that is designed to reduce exploits of exception handling mechanisms in Windows. By default software-enforced DEP applies to core operating system components and services. This vulnerability can be mitigated by enabling DEP for all programs on your computer.
Re:Firefox? (Score:5, Informative)
You can be infected whenever Windows uses its default image viewer to display certain image types. This means there is a long list of applications that are vulnerable that rely upon the image viewer code, but as far as I know no one has yet compiled that list. Windows uses this code when previewing images (for example). The current way this is being exploited is to tell your web browser to open an image (wmf and jpg that I have heard about) in the picture viewer. On IE, this behavior defaults to happening automatically. That means you go to a page and it installs whatever code it wants. With Firefox, you go to a page and a dialogue asks to open a .jpg or .wmf file. If you agree, it installs whatever, but if you decline you're in the clear.
Re:Late breaking news from the article: (Score:5, Informative)
1) Yes, Virtual PC and WINE allow you to run Microsoft programs like Internet Explorer and Office.
2) The vulnerability is in the Microsoft Windows Graphics Rendering Engine, which is a part of the Windows kernel, and is why the exploit affects Windows versions from Win98 to WinXP.
3) Virtual PC and WINE running under Linux do not use the Microsoft Graphics Rendering Engine.
4) Even if they did, a Windows program trying to run in a Linux environment is a fish out of water, and can't do much besides SEGFAULT and exit.
5) Therefore, Linux (and Mac) users are safe, even if they are running IE or Office - just like the article said.
Re:MOD PARENT UP (Score:1, Informative)
IIS6 has had 2 vulnerabilities since it's inception three years ago. The most serious of which could allow someone to DOS the webserver.
http://secunia.com/product/1438/ [secunia.com]
Apache has had 29 vulnerabilities, 27 within the same timeframe as the IIS6 comparison. The worst of which allowed for full system access.
http://secunia.com/product/73/ [secunia.com]
If you want to step back in time, IIS5 had 13 vulnerabilities and IIS4 had 6. Apache 1.3.x had 17.
IIS seems less secure because of a handful of very public exploits, all of which happened typically months after the necessary patch was released.
It's not the underlying product, it's the accessability and maturity of the tools available for compromise. In the case of Windows there are a great number of kits already assembled and ready to go that simply need an attack vector. Once a single buffer overflow is discovered people can insert their favorite malware code into the exploit and fire away.
It's also mindset. Sitting back and claiming that Apache is invincible is the mindset that leads to compromise. Overconfidence often leads to complacency in both architecture and administration. I've run both IIS and Apache servers for close to a decade. I treat both like people are just waiting to get in and muck things up and in that time I've never had a single compromise. Nimda and CodeRed bounced right off.
Re:What's the real lesson here? (Score:3, Informative)
Microsoft released patches for the libpng that came with Windows, along with a tool that scanned your hard drive, looking for copies of libpng embedded in third party executables and libraries. Unfortunatly, it would basically only say: "you {have,have not} installed Microsoft's patch for this issue; furthermore you have third party programs on your system, please install any updates available from your vendors". I can't remember a single program that released an update merely to fix the libpng flaw; in all probability every Windows machine with some kind of third party software on it probably still has dozens of copies of libpng and zlib lurking around on it.
Your latter points are interesting. What you are describing is a mandatory access control security scheme, like the one implemented by SELinux [nsa.gov]. This has yet to catch on because it's bloody complicated--and I believe SELinux only restricts what an application can do based on the 'tag' that its executable recieves; I don't know if SELinux policies can grant permissions to a process based on the shared library that is executing at any one time, or even how SELinux policies interact with interpreters like sh, perl, python, and so on.
What about Microsoft's Nov 8 patch? (Score:4, Informative)
Re:What's the real lesson here? (Score:5, Informative)
This isn't a buffer overflow, its a design flaw that allows metafiles to register callbacks with GDI32. And I fail to see what language a programmer uses has anything to do with it. Bad programmers are bad programmers reguardless of the language used. To the CPU its all instructions, it doesn't care if its issued by the crt or the java_vm.
Enjoy,
Re:Firefox? (Score:2, Informative)
"Because the vulnerability exists within a faulty Windows component, security experts warn that Windows users who eschew Internet Explorer in favor of alternative Web browsers, such as older versions of Firefox and Opera, can still get their PCs infected if they agree to download a file from a site taking advantage of the flaw."
Baltika
Re:Confirm trojan with Firefox (Score:2, Informative)
Re:Windows, definitely Windows... (Score:2, Informative)
This is completely untrue. BTW: I've visited many of the sites in question using a virtual session, so I know first hand.
Internet Explorer uses the broken DLL in question to help it rendering the inline WMF in a webpage. Thus, if the site has a WMF as an image, IE can be exploited immediately. On Windows 2003 Server, it should be mentioned, WMFs are blocked by default (because it requires an external renderer, and IE disallows external helpers outside of trusted sites, or by explicitly allowing it with the security bar on a case-by-case basis).
Mozilla/Firefox doesn't render or handle WMF at all. It'll ask you if you want to open the file, encouraging (at least in current versions) you to open it with Media Player. Even if you click OK you're okay, as Media Player won't know what to do with the file.
Opera is in between - if it sees a WMF it will ask if you want to open it, and it'll suggest the Windows Picture and Fax viewer (which uses the affected DLL), so one OK later and you're owned.
Re:Late breaking news from the article: (Score:5, Informative)
The graphics rendering engine is divided between the Win32 subsystem which is a user process (csrss.exe), and the Win32 executive (Win32.sys) which actually runs in kernel space. The portion of the graphics system in the executive is limitted almost exclusively to the actual displaying of images and direct interaction with the drivers that interface with the display hardware. I'm not 100% sure, but I can't ever recall there being a vulnerability found in this part of the executive.
This specific vulnerability, like almost all image processing vulnerabilities, occurs in the image format parser, which is in the Win32 subsystem. As such its not in the kernel and runs in standard user scope. I know this doesn't change the point you were trying to make, which was the vulnerability doesn't occur on other systems. I just wanted to correct the statement about it being a kernel vulnerability.
Re:If Windows Were Open Sourced (Score:5, Informative)
They have no business doing that, people without Admininstrator should be able to play, anything running as Administrator (or in that group) can do great damage (e.g. virus infections, file deletion, even destroy the BIOS), and doing things that require Administrator wrongly can also trash the system (accidently corrupting a DLL, locking up hardware, etc).
There is a RunAs on Windows, and it is useful for doing sys admin stuff only when needed. It would be nice if it could be configured that a browser run by Administrator (lets say to need to Google for a solution to a problem you are working on) would drop privs (but even Linux doesn't do that).
But my main point is games and other user programs should need Administrator.
Re:Temporary Solution (Score:3, Informative)
-Peter
Re:Late breaking news from the article: (Score:5, Informative)
If there ever was a smoking-gun lead-pipe indictment of Microsoft's sloppy love of whizzo features, security, stability, maintainability, administerability be damned; this has GOT to be it. If the filetype API is that flawed, we need to just get rid of .WMF files, period.
Re:RootKit Revealer (Score:2, Informative)
chkrootkit is the same way, it has some generic heuristics like the
A new rootkit that doesn't rely on any old techniques wouldn't show up.
Re:Late breaking news from the article: (Score:4, Informative)
Re:Bad start to my day (Score:3, Informative)
Re:Late breaking news from the article: (Score:4, Informative)
At least in Firefox, you will get a prompt asking you to run the script before it executes. So as long as you always remember to click on "Hell NO", you should be pretty safe.
Re:Late breaking news from the article: (Score:4, Informative)
Re:MOD PARENT UP (Score:3, Informative)
I've said it before (Score:3, Informative)
Use Windows. Get Infected.
It's not restricted to unpatched Windows 98. It affects fully patched Windows XP SP2 running fully updated anti-virus.
Use Windows, and you'll Get Infected.
A firewall will protect you sometimes. Safe browsing will protect you other times. But in the end, something will get you. WMF, or a buffer overflow in IE, a spoofing vulnerability involving Windows Update, a Windows only Firefox bug.
use Windows. Get Infected. Period.
Proxomitron Workaround (Score:3, Informative)
I developed a fix for it (Score:3, Informative)
http://www.hexblog.com/ [hexblog.com]
My fix works for Windows XP systems. I have tested it on my machines.