Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Bug Internet Explorer The Internet

IE 7.0/8.0b Code Execution 0-Day Released 131

Posted by kdawson from the cross-zone-scripting dept.
SecureThroughObscure writes "Security blogger and researcher Nate McFeters blogged about a 0-day exploit affecting IE7 and IE8 beta on XP that was released by noted security researcher Aviv Raff. The flaw is a 'cross-zone scripting' flaw that takes advantage of the fact that printing HTML web pages occurs in the Local Machine Zone in IE rather than in the Internet Zone. Quoting McFeters's post: 'This is currently unpatched and in all of its 0-day glory, so for the time being, beware printing using the "print table of links" option when printing web pages.' McFeters and others will be presenting at Black Hat on the link between cross-site scripting and cross-zone. Rob Carter has been hitting this hard over at his blog, pointing out cross-zone weaknesses in Azureus, uTorrent, and the Eclipse platform."
This discussion has been archived. No new comments can be posted.

IE 7.0/8.0b Code Execution 0-Day Released More

IE 7.0/8.0b Code Execution 0-Day Released

Comments Filter:

  • 0-day (Score:5, Insightful)

    by Anonymous Coward on Friday May 16, 2008 @09:51AM (#23432500)
    0-day? This term seems to have lots all meaning. Could we please stop using it?

  • A Disturbing Trend, But Not Unforeseen... (Score:5, Insightful)

    by blcamp ( 211756 ) on Friday May 16, 2008 @09:51AM (#23432506) Homepage

    The more complex the software releases become, the more complex and insidious the exploits of them become also.

    • The more complex the software releases become, the more complex and insidious the exploits of them become also.


      Exactly, this is why the most complex OS in history, Vista...

      Oh wait, Vista is NOT affected.

      (Sorry to the MS Haters Club, especially considering the obscurity of this exploit, compared to ANY of the last 5-10 major flaws found in FireFox.)

    • The more complex the software releases become, the more complex and insidious the exploits of them become also.

      I'm not sure if that statement will hold up to scrutiny. If complex software is the issue, then you'd expect exploits to be consistent across platforms when comparing software of similar complexity. I haven't seen any research supporting that observation. I have seen research that says more complex software will likely contain more coding errors and potential exploits but haven't seen a correl

      • So you're argument is that some complex code is inherently less secure than other complex code? Sorry, I don't buy it.

        As far as security being an after-thought in Windows, that's not true. DOS and the Win9x line weren't designed to be networked, certainly not on an untrusted network. To some extent that was true of the earlier NT line as well; although security was needed and built in, it likely made the assumption that the network was at least somewhat safe.

        Modern Windows (I'd say Win2000 and higher) ha
      • And if we ever have an OS with equal market share we'll be able to evaluate the truth to that statement; for right now, there isn't another OS with the same level of scrutiny from developers, white hat and black hat hackers, so there's very little chance that we'll get a fair comparison.
    • Which is exactly why we should stop using software!!

  • Amazing (Score:5, Funny)

    by duplicate-nickname ( 87112 ) on Friday May 16, 2008 @09:53AM (#23432544) Homepage
    I didn't even know that "Print table of links" was an option for printing in IE until today. My guess is that no one actually uses that feature, and this 0-day exploit affects roughly 0 people.

    • Re:Amazing (Score:5, Insightful)

      by CastrTroy ( 595695 ) on Friday May 16, 2008 @10:00AM (#23432652)
      Even if you did know about the feature, I'm not sure of it's usefulness. Saveing a spreadsheet of links might be useful, but printing them out? Most URLSs are pretty hard to type back in, and wouldn't be all that useful on paper. Look at the url I'm no right now.

      http://it.slashdot.org/comments.pl?sid=555236&op=Reply&threshold=1&commentsort=0&mode=nested&pid=23432544 [slashdot.org]

      Why you would want that printed out on a piece of paper is beyond me. It might possibly somewhat work on a PDF printer, but even then, it's use is limited.

    • Re: (Score:3, Insightful)

      by Penguinisto ( 415985 )
      Actually, I could see uses for it - but mostly for web designers as an audit tool, and for corporate security types who want to gin up a list of naughty links with which to show the employee and his/her boss.

      Now for a real use? Well, maybe one. To save having to scribble them down, you could waste a couple reams of paper printing out, oh, maybe a dozen MS Sharepoint links to an overly-anal supervisor who demands that you include reference links in a printed report.

      /P

  • Proof (Score:5, Insightful)

    by morgan_greywolf ( 835522 ) * on Friday May 16, 2008 @09:54AM (#23432560) Homepage Journal
    This is proof of what I've said from the beginning -- the whole concept 'zones' in IE is stupid and pointless. Scripts should be allowed only what you allow them, period. You should be able to give permissions down to the individual site (ala NoScript) or even down to the individual script.

    • Re:Proof (Score:5, Insightful)

      by ScentCone ( 795499 ) on Friday May 16, 2008 @10:02AM (#23432682)
      You should be able to give permissions down to the individual site (ala NoScript) or even down to the individual script.

      Look, for most people, the zone idea actually makes sense. Basically, don't trust ANY web site to do the tricksy stuff, but add (for example) your company's intranet to the safe zone, where it can do more desktop-ish stuff. I don't think that's such an awkward concept, and it spares people from having to think through what to allow, or not, on a site by site basis, as they surf. Most people are not this audience. And being able to enforce zone policies at the enterprise level makes a lot of sense, since average users are routinely shown to be spineless and witless: they'll add a poisonous Russian casino spam site to the safe list if that site pops up a tutorial on the steps the have to take to do so, if they want their free emoticon package.

      Fiddly, granular systems only work for fiddly, granular people.

      • Re:Proof (Score:4, Insightful)

        by morgan_greywolf ( 835522 ) * on Friday May 16, 2008 @10:12AM (#23432822) Homepage Journal
        Pffft. So tell me-- why when I browse a site in the "Internet-zone" and then print a table of links, does that function run in the 'Local Zone'?

        I'll tell you why: because it has to. You can't access local devices in the Internet Zone. That's the point. Granular approaches would allow you to print without accidentally giving other permissions to something that shouldn't have them.

        At the enterprise level, with something like NoScript, you can just allow entire domains, say intranet.example.com or whatever your organization uses.

        Next thing you're gonna tell me is that you think Microsoft should do away with ACLs at the individual file level or even the directory because users are just too stupid to figure that out. They should just have "file zones" and people will just have to stick their files in the right zone. Pffft.

        • Re:Proof (Score:4, Funny)

          by keytoe ( 91531 ) on Friday May 16, 2008 @01:45PM (#23436734) Homepage
          Your markup is incorrect - you left the slash off your closing Pffft. tag.

        • Re:Proof (Score:4, Insightful)

          by knarf ( 34928 ) on Friday May 16, 2008 @05:39PM (#23440384)
          While it may be true (and it *better be true*) that untrusted zones can not directly touch local devices the question still remains why there is any processing being done on data from a lower-trust zone *inside* a higher-trust zone. That is the wrong approach. Had they formatted the document to be printed inside the lower-trust zone and handed a formatted document to the higher-trust zone (in whatever format is used to print documents: metafile, postscript, etc) to be printed this problem would not have occurred. That is, given that the print spooler does not goof up with the data to be printed of course...

      • Re: (Score:3, Interesting)

        by CastrTroy ( 595695 )
        Why would you want special permissions on stuff in your intranet? Couldn't any disgruntled employee set up a webserver on their computer, send out a mass email, telling people to visit the url. and infect a large portion of the computers in the office? If you want special permissions for intranet servers, install your own CA, and let the browser run stuff only signed by that CA.
        • Not if your Intranet is one domain and your desktop PCs are in another domain, no.

          Furthermore, you can make it is as granular as you want. If you want list individual servers, do it, or if you want to control it by CA, do it that way.

          • Re:Proof (Score:5, Insightful)

            by CastrTroy ( 595695 ) on Friday May 16, 2008 @10:47AM (#23433474)
            And for IE the defaults allow special permissions to your entire intranet. By default all the permissions should be low. There's no reason to grant higher permissions to the entire intranet. If you need something like that set up at your organization, you should have to enable it per server, or per domain.

            • Re: (Score:1, Funny)

              by morgan_greywolf ( 835522 ) *
              Exactly. I knew you'd see it my way.
            • Default Intranet Zone Permissions are medium-low. What the fuck is wrong with that? You should be pushing zone security settings via policy on your domain anyway, not using the defaults. Score: 5, Insightful my ass.

        • Couldn't any disgruntled employee

          yes, but which is more likely on a daily basis. When a internal employee attacks and is found, in most company's he gets no more chances to be a ass. When a external attack is found, one of his computers is blocked, a new IP address is all thats needed for him to try again...
          At my work their about 10 people with the ability to do this intentionally, of course the more likely is that they got infected from the internet, but if that was blocked, how did that happen again?
          of

        • Couldn't any disgruntled employee set up a webserver on their computer, send out a mass email, telling people to visit the url. and infect a large portion of the computers in the office?

          At my last employer, setting up a webserver wouldn't have been necessary. Everyone could get read/write access to the real intranet servers via their C$ share. Oh, Windows.

      • Re:Proof (Score:5, Insightful)

        by Penguinisto ( 415985 ) on Friday May 16, 2008 @10:27AM (#23433094) Journal
        Having actually used the 'Zones' concept recently on IE, I gotta say - it needs work. LOTS of work. The first time someone wants to diddle with a MySpace app and discovers that it won't work until you basically ratchet down the settings --often by hand in the advanced options--? Then couple that with the fact that many websites can pull in parts and content from multiple domains, requiring permissions to be set on each and every one? The whole thing would go out the window and the user would promptly ratchet down the whole WWW.

        The concept itself is okay, but the implementation could use a good, solid overhaul.

        /P

        • he first time someone wants to diddle with a MySpace app and discovers that it won't work until you basically ratchet down the settings --often by hand in the advanced options--

          You realize that MySpace is nothing but personal ads for child molesters, right?

          If you're running apps from there... be careful

          • Right - tons of phishing and hacking scams are run from MySpace pages.

            Its almost the last place on the web you should be "ratcheting down" IE's security settings.
        • If you're ratcheting down the zone settings for one site, you're NOT using zones correctly. What you'd want to do is add MySpace to your Trusted Sites zone. Now MySpace has the permissions it needs, but the rest of the internet still is kept on higher guard.

          • If you're ratcheting down the zone settings for one site, you're NOT using zones correctly. What you'd want to do is add MySpace to your Trusted Sites zone. Now MySpace has the permissions it needs, but the rest of the internet still is kept on higher guard.

            Thing is it ain't that easy (ref. a similar post to mine that explains it better). This could apply almost anywhere that has a ton of mixed content (for instance at my work, where one has to do it just to get some of the corp's more bone-headed ActiveX controls to behave normally).

            The problem is, you and I can grok-out a way around it. My wife (or any other non-tech-oriented person) cannot, at least not without a lot of Googling and even more patience (or a more tech-oriented spouse to impose the issue

          • Re: (Score:2)

            by TheLink ( 130905 )
            If you're using Win 2K Pro with some registry tweaks you can add zones and even configure the My Computer zone. I've added "Other Zones", for zones I can't bear to call Trusted Sites, but require active scripting. And I've actually got the "My Computer" zone in a high security setting - but this means that you can't use the new style views for explorer - have to use "classic". I'm not sure if it works on WinXP Pro.

            That said, for stuff like Facebook and MySpace, I'd use a virtual machine ;).

      • Re: (Score:3, Insightful)

        by MobyDisk ( 75490 )
        People just need to stop using web browsers as a way to control the desktop. If you are in a domain, then the domain administrator can push executable apps, policies, and commands down to the computer. HTML, Javascript, and ActiveX are not tools for administering networks.

        Also, having developed desktop applications that used embedded IE, I can tell you the zones system is completely screwed-up. It changes in every version, the APIs are inconsistent across different Windows OS's, and there are crazy looph

    • This is proof of what I've said from the beginning -- the whole concept 'zones' in IE is stupid and pointless.

      IE's zones is a very good thing because it gives different level of security based on zones, "internet zone" has an higher security, "local zone" has a lower security, "restricted zone" has the maximum security.

      Scripts should be allowed only what you allow them, period.

      "allow or cancel" question for each site you visit? are you crazy???? scripting is not dangerous unless there's a flaw in javascript.

      You should be able to give permissions down to the individual site

      you can do it with IE by putting the sites into the different zones. If you want block a site, just put it in "restricted sites" zone.

      (ala NoScript) or even down to the individual script.

      "allow or cancel" question for

      • Re: (Score:2, Informative)

        by morgan_greywolf ( 835522 ) *

        scripting is not dangerous unless there's a flaw in javascript.

        If only JavaScript were the only scripting option on IE. Furthermore, JavaScript is one of the primary vectors of attack for Firefox, IE and Opera: what makes you think that an untrusted JavaScript is NOT dangerous?

        you can do it with IE by putting the sites into the different zones.

        Right. Again, see how NoScript does it. Far easier and more convenient for the user, IMHO.

    • Re: (Score:2)

      by evanbd ( 210358 )

      That's insufficient. The danger from scipts comes from sites you *do* trust that get hacked. And if you grant permission per script, how many people are competent to read a script and judge it to be non-malicious? Of those, how many will feel like taking the time for every single script?

      NoScript is good, and I use it, but it's far from sufficient to secure the browser against script-based attacks.

      • NoScript is good, and I use it, but it's far from sufficient to secure the browser against script-based attacks.
        I agree. That's why browser makers need to focus on writing secure code. Microsoft has proven time and time again that they are most certainly NOT up to the task.

        • Re: (Score:1)

          by nstlgc ( 945418 )

          NoScript is good, and I use it, but it's far from sufficient to secure the browser against script-based attacks.
          I agree. That's why browser makers need to focus on writing secure code. Microsoft has proven time and time again that they are most certainly NOT up to the task.
          That must be why this vulnerability does not result in code execution on Vista. Didn't you mean to write 'Micro$oft'?

    • Re:Proof (Score:4, Insightful)

      by Manip ( 656104 ) on Friday May 16, 2008 @10:17AM (#23432936)
      IE or any other modern browser on the market.

      You would also have every web developer in the marketplace whining about how IE ignores standards if they pulled the plug on scripting.

      Sorry but Zoning in IE is fine. IE 7 is actually a pretty good modern browser and, sure, it isn't perfect but frankly what is?

    • Re:Proof (Score:4, Informative)

      by myxiplx ( 906307 ) on Friday May 16, 2008 @10:24AM (#23433032)
      I disagree, zones are great, I just wish they'd implemented them better. We use zones as a quick way to enforce across the whole organisation which sites can and can't run scripts. The concept is superb, regular sites can't run scripts, activex, or anything. IT designated 'trusted' sites work fine.

      Unfortunately, IE7 has made things a little more difficult:

      - Pages with content from various zones no longer show up as 'mixed'. Since the upgrade to IE7, all sites only show the zone of the main URL, however the content runs according to the security zone for it's own source. It makes it almost impossible to work out whether a site can or can't run scripts, and you end up digging into the pages source code to work out what sites need adding to the trusted zones to get pages to work.

      - Dynamic scripts added to a page in the 'trusted' zone, execute from the 'internet' zone. This is "by design"... The only workaround is to change the way the code works on the server.

      - If you want to lock down the 'internet' zone, you will need to add "about:internet" to your 'trusted' zone

      - You will also need to add res://ieframe.dll to your 'trusted' zone
    • I like the zones; I wish Firefox had them. I love NoScript very much, but I wish I didn't have to authorize, say, slashdot.org, to run java apps. I'd rather configure a middle tier that would allow javascript and nothing else.
    • In theory I'd agree with that, but Joe Random Intarwebs User isn't savvy enough to make those choices in a semi-smart way.

      The zones concept isn't perfect, but for the technically quasi-literate it's generally a better solution to the problem. Golden rule of design: don't build things as though your users are smart, because most of them won't be.

  • Usage (Score:5, Funny)

    by Wowsers ( 1151731 ) on Friday May 16, 2008 @09:56AM (#23432594) Journal
    People still use Internet Exploder?

    • yes, I use it (Score:2, Informative)

      by thisispurefud ( 1061012 )

      People still use Internet Exploder?
      yes, I use Internet Explorer in Windows Vista that is the safest browser because it runs with the lowest privileges possibile in a sandbox (IE7 Protected mode). In fact IE7 under Vista is not affected by this flaw i.e. remote code execution is not possible (yet another reason to use Vista and UAC).
      • Sorry, I could not keep from modding this funny. I am really a GNU/FOSS/Linux geek :P

        • Re: (Score:3, Funny)

          by Just Some Guy ( 3352 )

          Sorry, I could not keep from modding this funny.

          It didn't take.

          • Re: (Score:2, Offtopic)

            by stubear ( 130454 )
            Because he's a fucking dumbass and posted to the same story he moderated. Granted, not being allowed to comment in other threads simply because I've moderated one already is annoyingly stupid but if you moderate you know this, or should, by now.

      • Re: (Score:1, Troll)

        by A beautiful mind ( 821714 )
        Isn't using Vista for those reasons a bit like being really proud of the great big bolted gate that is sure to keep intruders away, while your fence consists of grass and your house is next to the ultramodern nuclear bunker with built in natural habitat simulation that you have free access to and is frequented by hot women?

        • Re: (Score:1)

          by nstlgc ( 945418 )

          Isn't using Vista for those reasons a bit like being really proud of the great big bolted gate that is sure to keep intruders away, while your fence consists of grass and your house is next to the ultramodern nuclear bunker with built in natural habitat simulation that you have free access to and is frequented by hot women?
          If by this analogy you mean that Linux is frequented by hot women then wow. Just wow. :-)

      • yes, I use Internet Explorer in Windows Vista that is the safest browser because it runs with the lowest privileges possibile in a sandbox (IE7 Protected mode).


        Oh yeah? I use Internet Explorer in XP under non-admin mode in a virtualbox install on Cygwin on a virtualbox install of XP inside a Linux virtualbox install under a SELinux host!

        HAH! Take that!

      • Re: (Score:1, Offtopic)

        by Inda ( 580031 )
        To my siblings: Do people still reply to trolls?

        Oh wait...

      • Well, it protects you from the code execution problem (but is apparently still vulnerable to an "information disclosure" as a result, but I don't know the details) for this particular flaw. But using Firefox or Opera or IE6 also protects you from this particular flaw.

    • Re: (Score:2)

      by stubear ( 130454 )
      People still use immature names for Microsoft and their products?

  • For using IE since 2.X... (Score:3, Funny)

    by AioKits ( 1235070 ) on Friday May 16, 2008 @10:01AM (#23432666)
    I can safely say I did not know this ability even existed. (Don't hurt me! I use FireFox at home! Honest! I even brought some FF t-shirts and the laptop tote.)

  • Irresponsible disclosure (Score:5, Interesting)

    by benjymouse ( 756774 ) on Friday May 16, 2008 @10:01AM (#23432670)
    The vuln. is probably real, but Aviv Raff notified Microsoft the day before he went public with a "treasure hunt" for this bug (celebrating Isreals 60th birthday); thus the fact that it's a 0day vuln. is entirely his doing. Way to go.

    • Re:Irresponsible disclosure (Score:5, Insightful)

      by reset_button ( 903303 ) on Friday May 16, 2008 @10:12AM (#23432828)
      Is it better to keep it secret until a patch comes out and hope that nobody else has discovered the vulnerability, or publicize it and let people know not to use this IE feature until it's patched?

    • Re: (Score:2, Insightful)

      by Anonymous Coward
      The vuln. is probably real, but Aviv Raff notified Microsoft the day before he went public with a "treasure hunt" for this bug (celebrating Isreals 60th birthday); thus the fact that it's a 0day vuln. is entirely his doing. Way to go.
      Yes, as always... blame the whistle blower not the manufacturer of the crap product.

      • *feeds the troll* (Score:3, Insightful)

        by Animaether ( 411575 )
        Nobody is blaming Aviv for the existence of the bug. Nobody is blaming Aviv for telling people about the bug.

        We *might* be blaming Aviv for telling the world, script kiddies and botnet operators alike, about this bug -before- even notifying the manufacturer of the crap product.

        Nor did Aviv wait a reasonable time period for the manufacturer to admit their product's crap state and issue either A. a warning of their own (don't print links) or B. a fix, while providing full credit for discovering the bug to Av
    • Yeah, really. There's no glory in "finding" a zero day exploit; it's not as if it's inherently more severe or damning than any other flay. But it sure looks better on the headlines.

  • Can it be triggered via javascript? (Score:5, Interesting)

    by foniksonik ( 573572 ) on Friday May 16, 2008 @10:08AM (#23432774) Homepage Journal
    Can you trigger this behavior in an onload event?

    If not it's a rather useless exploit other than as a prank to pull on your secretary... "Hey Sandra... can you print out a table of links for this website?"

    5 minutes later "What the F***!"

    "HAHAHAHAHAHAHA... I totally got you!"

  • To view this article on one page... (Score:5, Funny)

    by Thelasko ( 1196535 ) on Friday May 16, 2008 @10:13AM (#23432854) Journal
    please select the printable version.

    end sarcasm
    • I'd just use Print Preview if I saw something like that, and you can't do the table of links thing in the Preview. Which seems sorta dumb in and of itself, since you can't Preview what it's gonna look like.

    • You can't grep dead trees.

  • Going to print the article so I can read it on the can. I'll post a response about it when I get back.

  • I appreciate the desire to raise awareness, but there's no practical benefit to running this story other than Windows bashing. It'll get patched, the patch will probably ship on some future Tuesday given this is a feature few people use and the risk of exploitation is relatively low, and that'll be that.

    In contrast, a far more dangerous bug [debian.org] in the openssl package used by Debian and its derivatives was discovered earlier this week, and doesn't seem to have made the Slashdot home page at all, even though i

  • ...When are we going to be able to read an article written by anyone other than some jerk-off using buzz-phrases whenever possible.

    "0-day" doesn't mean a f$%^&ing thing ! There is no information being transmitted by that phrase, it is empty of any meaning and might as well be a punction mark.

    • Re: (Score:1)

      by Artuir ( 1226648 )
      You might know this and were just venting, but for those readers out there that don't know, I'll attempt to clarify.

      "0-day" typically is used in the warez/cracking scene. 0-day releases are essentially programs or games or whatnot that are cracked or released for download the same day (or even before) they hit retail shelves. So you've got 0-day games, 0-day cracks, etc. - but in the context the summary uses the term it doesn't really seem like it means anything unless it coincides with a brand new release
      • Correct "0 day" refers to the release date. "0-day" = previously not publicized http://en.wikipedia.org/wiki/Zero_day_virus [wikipedia.org] for details.

      • Re: (Score:3, Insightful)

        by OneSmartFellow ( 716217 )
        From the Wikipedia article cited

        A zero-day (or zero-hour) attack or threat is a computer threat that tries to exploit unknown, undisclosed or unpatched computer application vulnerabilities.

        So, it's a newly discovered exploit. Can't we use that phrase instead of the uber-lame "0-day"
        • Once it becomes publicly disclosed it is no longer 0-day. We shouldn't even be having this discussion.
  • I can't even find this "print table of links" feature.
  • By definition, this is no longer 0-day now is it?
  • So I guess the Russian Business Network will now start developing malware to make printers print non stop costing companies money in paper resupplies?

  • 0 Day on IE (Score:1, Offtopic)

    by misterhypno ( 978442 )
    Some random thoughts on this:

    IE - It Executed

    0 Day - 0 Productivity. Nothing works.

    So It Executed 0 Day and nothing works and there was no productivity.

    And ol Br'er Mac User, he jus' sits back and LAFFS!!
  • IE has them and they don't work, Firefox doesn't have it and it still works. I personally think the entire concept is flawed and provides no real security. It is just a UI for managing permissions, which appears to be broken more often than not. Very complicated permission schemes have always been an issue with Windows compared to the Unix world. You average desktop really just needs a few flags for permissions on each object rather than a hierarchy.

  • Printer-friendly version (Score:3, Funny)

    by 6Yankee ( 597075 ) on Friday May 16, 2008 @01:22PM (#23436350)
    here [pwn3d.ru]

Slashdot Top Deals

I tell them to turn to the study of mathematics, for it is only there that they might escape the lusts of the flesh. -- Thomas Mann, "The Magic Mountain"

Close