Attacks Against Unpatched Microsoft Bug Multiply 122
CWmike writes "Attacks exploiting the latest Microsoft vulnerability are quickly ramping up in quantity and intensity, several security companies warned today as they rang alarms about the developing threat. Symantec, Sunbelt Software, and SANS' Internet Storm Center bumped up their warnings yesterday after Microsoft announced that attackers were exploiting a bug in an ActiveX control used by IE to display Excel spreadsheets. There is no patch for the vulnerability; Microsoft didn't release one in today's Patch Tuesday. A temporary fix that sets the 'kill bits' of the ActiveX control is available, but experts believe it's likely most users won't take advantage of the protection. Symantec raised its ThreatCon ranking to the second of four steps. "We're seeing it exploited, but currently on a limited scale," said Symantec's Ben Greenbaum. Sunbelt also bumped up its ranking, to high." Firefox users can't be too complacent; Secunia is warning of a 0-day in version 3.5.
Re:Ohh noes.... (Score:5, Interesting)
Apparently, a lot given that the attacks are becoming more intense and frequent.
My guess is that when Office installs, various ActiveX controls are linked into the OS and by extension, the web browser MSIE. But there are lots of places where this should never have happened.
1. ActiveX has been proven time and time again to be a very bad idea. It is not sandboxed. There is no way to keep it away from the rest of the OS.
2. The web browser's integration with the OS. Not only has it been ruled illegal by various nations antitrust courts, but any exploit of the browser also exploits the OS by extension.
Hear Hear, and let me add.... (Score:4, Interesting)
Hear hear on your ActiveX rant, and let me add "What you have said about ActiveX also applies to Javascript."
I see too many sites that will have almost every link be of the form <a href="#" onclick="follow_link(some_damn_link.html)"> - in other words the only way to follow the link is to use Javascript. This is just sloppy and stupid-lazy - such pages are usually machine generated, and there is NO REASON why the tool couldn't have filled in an appropriate href.
Yes, there are good uses for Javascript - but do we really want to be allowing J. Random Website to run code in a Turing-complete[*] language on every potential page load? I don't - and that is why I have NoScript installed, and no web site gets to run Javascript by default on MY browser - and since the Securina exploit against Firefox is Javascript based, that reduces (but does not eliminate) my exposure.
([*] - Javascript is as Turing complete as C/C++/Java or whatnot - the only thing that makes it NOT truly Turing-complete is the absence of infinite storage, just like C/C++/Java or whatnot).
Re:server side scanning (Score:1, Interesting)
Hey, sure. We flush-n-fill workstations, planet wide in corporate offices. Ya know, maybe we could make friends with aliens and have THEM also scan our computers.
OR WE COULD JUST USE SOMETHING LESS FRAGILE.
Look at the risk; we're always hearing of people losing thousands of dollars, spending most of a decade trying to get it back. TWO MILLION active viruses and another 100,000 every month for the last decade.
Where else do you go buy a product, and then *immediately* buy someone else's product to ensure it makes it through the day? Did you ever buy that thing again?
Yeah, all computers have expolits. Only one manufacturer is installing an express lane.
And no, when Linux machines get larger, they probably won't have viruses, because the people who program it won't abide their existence to sell support contracts.
And it won't take more installed systems- there have been more Linux machines than Macs for like, five years now. (Reported here, iirc)
It can't get much simpler; it can't get much stronger. Why on Earth would anyone presume it faulty, just because it's not identical?
Wake up, people! How many stories like this do we have to read?!?!?!!
Re:They have (Score:4, Interesting)
Good thing everyone's bashing Vista like it has no features of value
No, we bashed it because it didn't have features of $200+ value.
Disable JIT for Firefox 3.5 workaround (Score:2, Interesting)
set javascript.options.jit.content to false.
http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/ [mozilla.com]
Re:Ohh noes.... (Score:3, Interesting)
When some one sends me the "Oh please check out my super duper cool Share point embedded Office power point blah blah blah" very important link. I respond.
Sorry Doesn't load on my iPhone.
( I don't really own an iPhone. But iPhone makes them go "Oh crap, iPhones are cooler than this. I'd better re-do it so iPhone's can view it. )
After that it tends to be de-Microsoft'd enough for me to feel comfortable opening the link.