Oops! Missed One Fix — Windows Attacks Under Way 292
CWmike writes "Microsoft says attackers are now exploiting a critical Windows bug that it didn't get around to fixing in its biggest batch of security patches in more than five years, issued yesterday. Microsoft said that 'limited and targeted' attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter, a tool included with all versions of Windows. If Microsoft patches the WordPad problem on its monthly schedule, the first opportunity for fixing the flaw would be Jan. 9, 2009." Update: 12/10 22:28 GMT by T : OK, there might have been more than one: reader Simon (S2) writes "There is an even more serious flaw ... From SANS: 'There is a 0-day exploit for Internet Explorer circulating in the wild. At this point in time it does not appear to be wildly used, but as the code is publicly available we can expect that this will happen very soon. This is a brand new exploit that is *not* patched with MS08-073 that was released yesterday. I can confirm that the exploit works in a fully patched Windows XP machine. The exploit is a typical heap overflow that appears to be exploiting something in the XML parser.'"
::yawn:: nothing to see here, as usual. (Score:5, Informative)
From the article (i know I know, slashdot...), Windows XP SP3, Vista, and Windows Server 2008 aren't vulnerable. I didn't read how the exploit actually works to see if it can realistically be used to attack Windows Server 2003 (which is quite popular), but for people at home, if your machine is up to date, you're fine.
So seriously, whats the big deal?
Re:I don't understand (Score:5, Informative)
How can code in the wordpad text editor leave a machine vulnerable?
It can be used to execute a malicious program that makes the system vulnerable. Wordpad just works as a launcher for the malicious program.
Re:I don't understand (Score:3, Informative)
Re:WordPad exploitable? (Score:4, Informative)
Send a specially crafted word document (i.e. code embedded) and trick the user into opening it with WordPad (i.e. using the .wri file extension).
Re:WordPad exploitable? (Score:5, Informative)
Its not remotely exploitable. From the article, a user has to open a maliciously crafted file. So its just the fairly typical exploit where a document viewer poorly handles documents it can open.
It needs user interaction to work, someone has to open a file that they don't trust (I guess it MAY be possible to trick a user into opening the file from the web, since there is a Word viewer that potentially use the same file converter that is responsible for the exploit).
Also, XP SP3, Vista and WinServer 2008 aren't vulnerable at all.
Re:I don't understand (Score:5, Informative)
Re:I don't understand (Score:5, Informative)
The attacker sends you a .wri file in an email. By default this will be opened using WordPad. WordPad will attempt to decode the Word97 content of the .wri file and in doing so will trigger some sort of attack code (the article and security advisory are vague about this part).
Basically, don't open weird files that you find on the internet.
Re:::yawn:: nothing to see here, as usual. (Score:5, Informative)
Well, considering that like many businesses that rely on specialized pieces of software to function (mine in particular being a law firm), we have held off on deploying both XP SP3 and not even put thought into Vista because our document management software and change-tracking/metadata scrubbing software are incompatible with anything above XP SP2 for the moment.
We can't keep entirely up to date because it breaks the software my firm relies on, and replacing them isn't an option. From my experience at the law firms I've worked at, they move at one of two speeds: slowly or not at all.
Re:WordPad exploitable? (Score:5, Informative)
Word files are not binary executables. They are (pre OOXML) binary file formats. I don't know what the exact exploit is (probably some sort of buffer overflow) but the idea is to craft a Word document such that it contains executable code and exploits the flaw in wordpad that causes the executable code to execute.
Re:I don't understand (Score:5, Informative)
It's easier to get someone to open a .wri or .doc file than a .exe file.
Re:WordPad exploitable? (Score:3, Informative)
This type of bug relies on "glitches" in the memory management (simplifying it a bit...) of the program, not on any high-level misses in the actual mechanisms of the code. Any program written in a programming language without automatic memory management can be exploited in this way, if the programmer "misses his step" somewhere. They can also be devilishly hard to find, because data can be structured and handled in memory in very complex and abstract ways.
Corrupt Memory, and it works on server 2003 (Score:4, Informative)
The info page shows that it does indeed affect Server 2003, one of the more populat versions out there, as noted by another comment
Re:WordPad exploitable? (Score:1, Informative)
Like the 'Bush hid the facts' bug?
Re:WordPad exploitable? (Score:5, Informative)
Wordpad does not have the capability to execute those macros, because it does not have an embedded VBA interpreter. The macros are binary gibberish without the VBA runtime, much like a Perl file is just text without the Perl interpreter.
Re:::yawn:: nothing to see here, as usual. (Score:4, Informative)
If you have servers that old that you can't upgrade, thats fine (I mean, Win2k Server is still supported until 2010 I think? So thats fair).
Just be careful about what you do while you're logged in (as you always should on a server anyway). I agree it IS unacceptable for something like this to happen on a supported OS, but my original post merely pointed out that its not like everyone will get hacked by doing nothing tomorrow. It only affects 2 versions of Windows if you're up to date, and only if you touch a malicious file. The people using these 2 versions still probably know what they're doing (I don't think grandma is using WinServer 2003)
OMG! RLY? How will the human Race Survive?!?!?11 (Score:3, Informative)
Control Panel - Folder Options - File Types - WRI - Edit - Open - Change to Microsoft Word.
Problem solved.
Next!
Re:WordPad exploitable? Just click (Score:3, Informative)
No. Someone has to click an attachment called "biggest breasts ever.wri" while, at the SAME TIME, running a non-updated version of Windows, Windows 2000, or Windows Server 2003. You reduce your attack vector by a significant amount here.
Re:That's good thinking... (Score:5, Informative)
Re:WordPad? (Score:3, Informative)
Actually it's .wri files, which haven't been savable in Windows since 3.1.
You can rename or Save As to whatever.wri in any version of Windows. .doc extension, but only if you don't have Word installed (which is not vulnerable). To broaden the susceptible audience, .wri will likely be used an attack because it is always associated to the flawed program (Wordpad), assuming you haven't changed that behavior.
Inferring from the content of the advisory at http://www.microsoft.com/technet/security/advisory/960906.mspx [microsoft.com] , the extension and format really doesn't matter, except to the extent you can get Wordpad to open the file. It would also work with a
Re:OMG! RLY? How will the human Race Survive?!?!?1 (Score:3, Informative)
I'd recommend Abiword for "Wordpad" fans.http://www.abisource.com/download/ , it is not a "build from source" thing, it is tiny and comes with a installer. Of course, it is a full feature Word processor, not a crippled "Write".
MS figured people happily uses Write for their everyday stuff and even offices so they crippled it and shipped "Wordpad", the naming itself is like "This is like Notepad, use real Word for writing things".
Just install all of the plugins package, it does open and even save them.
Re:I don't understand (Score:1, Informative)
The vulnerability is using WordPad to convert an infected Word document, by getting the user to open an infected attachment. Anyone stupid enough to get infected this way deserves everything Darwin can throw their way.
Re:I don't understand (Score:4, Informative)
TextEdit can read and write word docs too. It supports rich text.
Re:Corrupt Memory, and it works on server 2003 (Score:5, Informative)
If you have an MSDN Subscription and are a developer, thats actually your best bet (well, now its Windows Server 2008, which is superior in every way, but...)
Windows Server editions have been better desktops than their actual "home" or "professional" editions for a while. The only drawback is they are harder to setup initially (2003 and 2008 are fairly locked down by default), and that they have higher hardware requirements (but use the hardware better). Oh, and the price, of course (but if you use it for development purpose, you can use the MSDN version. Even without that, its expensive, but its not 10 grands either)
Add that some stuff only works on Windows Server (let say, Sharepoint), and unless you feel like running Windows XP or Vista, only to spend 99% of your time in a VM, Windows Server is a vastly superior option.
Re:Terrorist computer virus infects hospitals (Score:4, Informative)
They don't have such chance to make it non vulnerable unless they scrap entire backwards compatibility.
A more mad solution would be the thing Apple did. Run the older OS in a virtual machine in its own thread (trublue, MacOS Classic support).
MS can't take such big decisions so, anything claimed for Windows 7 is a joke. If one can run Wordpad from XP in Windows 7, it is not secure.
Re:I don't understand (Score:3, Informative)
Yeah, but it changes them to DOS format when you save, with no option to keep the UNIX line endings :(
Good thing vim has a windows version.
Re:Fedora bug .. (Score:4, Informative)
That's a lot more userfriendly than Windows.
Linux: "There's a problem. If you're technically able, here is a fix."
Windows: "There is a problem. You're boned, sorry."
Re:I don't understand (Score:4, Informative)
Oh please. Wordpad is like Notepad, only it can't make up its mind whether to be richtext or plaintext and it doesn't open files when you drop them into it.
Don't drop the files into the 'document area', drop them onto the 'menu bar' area and they'll open.
I f*cking hate wordpad, but it's the only thing that recognizes and saves unix line-endings and is installed on every windows box since the beginning of time.
Re:WordPad exploitable? (Score:2, Informative)
Mods. Please. Look it up [wikipedia.org].
This must be mod-fucktard day.
Re:I don't understand (Score:4, Informative)