Extremely Critical IE6/SP2 Exploit Found 595
Spad writes "Secunia is reporting on three vulnerabilities in IE6 running on XP SP2. Any of these, in combination with an inappropriate behaviour where the ActiveX Data Object (ADO) model can write arbitrary files, can be exploited to compromise a user's system. Moreover, the vulnerability can be used to delete files from the user's system. Secunia says 'Solution: Use another product.'"
Test site (Score:5, Funny)
No, you click it first.
Re:Test site (Score:3, Funny)
Never thought I'd be saying that... *sigh*
Daft headline too... (Score:3, Insightful)
Re:Test site (Score:5, Funny)
Re:Test site (Score:3, Funny)
I know we all want to blame Microsoft for breaking compatibility, but face it, IE is the de facto standard. It is up to us to ensure that if it works in IE then it will work in Firefox just as well, if not better.
-
No luck with Safari, either (Score:4, Funny)
Re:Test site (Score:5, Funny)
I think that the Firefox developers should give credit where its due. They should organize another pledge campaign to raise $10,000.00 to give to Microsoft as a token of good will for all of the advertising that Microsoft has done for Firefox. Although the actual advertising contribution of Microsoft is at least a thousand times greater, this would help coax Microsoft toward continuing their generous support and [this is the serious part] the press would eat it up, contributing another $5M worth of free advertising.
Re:Test site (Score:3, Funny)
Uhmm, without checking, just remember that most of the holes IE has are years old. Who cares whether Firefox had more bugs in a time period, if those get damn quickly corrected, and btw most of last years' FFox holes are only pre-1.0.
And one more thing: the dogs ass, maybe that's not the worst place one can be
No explanation about what the test does... (Score:5, Insightful)
What's scary is that page doesn't even detail what the test will do on your machine! Clicking the link is risky enough even if you did know what it was going to do (ie. how do you know their server hasn't been compromised and the test altered).
All it says is "The test requires that you have Windows installed in 'c:/windows/'." Uh... Why? is it actually doing something in there? Does it just need to access cmd.exe?
Click at your own risk, indeed. I suggest running it on a machine that you plan to reformat or under an emulator like VPC.
Comment removed (Score:5, Informative)
Re:No explanation about what the test does... (Score:5, Interesting)
Re:That's exactly my point... (Score:5, Informative)
Re:No explanation about what the test does... (Score:3, Informative)
Re:No explanation about what the test does... (Score:3, Interesting)
Re:No explanation about what the test does... (Score:3, Informative)
\Program Files\Internet Explorer\Iexplore.exe
Sounds like youve got a virus
Re:No explanation about what the test does... (Score:3, Informative)
"c:/windows/help/ntshared.chm"
Once this help object is loaded, it can be activated, and malicious code can be injected using a second instance.
Without a known help file location, the script is useless.
Re:No explanation about what the test does... (Score:3)
I don't know anything about this subject but I guess that IE doesn't have access to any system variables like %windir% and the code can't do %windir/cmd.exe and thus also exploit Win2k or NT4 with IE 6 installed?
Re:No explanation about what the test does... (Score:5, Informative)
The JMCardle test does something similar, but calls this script [jmcardle.com] instead, which just runs in Command Prompt
Re:Test site (Score:5, Informative)
From the article:
Secunia Advisory: SA12889 Print Advisory
Release Date: 2004-10-20
Last Update: 2005-01-07
Changelog:
2004-10-21: Updated advisory.
2004-10-28: Added another workaround in "Solution" section and linked to Microsoft Knowledge Base article.
2004-11-02: Updated with additional information in "Description" and "Solution" section.
2004-11-29: Updated "Description" section with additional information from Paul.
2004-12-23: Added link to US-CERT vulnerability note.
2004-12-25: Updated "Description" section with additional information from Paul and Michael Evanchik.
2005-01-07: Increased rating. Added link to test. Updated "Description" and "Solution" sections.
So they upped the severity rating and added another workaround. This isn't really news. You've been vulnerable to this for almost 3 months now.
Re:Test site (Score:3, Interesting)
What you mean is that we have been vulnerable to this since IE6 was available waaayyyyy back, but it wasn't known until 3 months ago, and that they just realised how easily exploitable it is 2 days ago.
So what you're telling me is that (Score:5, Interesting)
Lucky me that I use firefox, and just got IE out to try out that test. And don't give me stuff about "turn off activeX" or some bs like that. The point is, how many non-tech savvie people think they're safe because they've done what we told them to do and kept their computers patched?
Re:So what you're telling me is that (Score:5, Insightful)
You are still vulnerable because Microsoft has determined that this vulnerability is:
a) unpatchable without ruining the functionality of the product
and / or
b) not a large enough threat to worry about.
Now I'm _not_ going argue whether either of these points is correct or not. But to present these as "New exploits" is typical Slashdot anti-journalism. they did the same thing when they announced the "New" vulnerabilities for Firefox [slashdot.org] a few days ago. Those were not new either, but neither the submitters or editors bothered to read the articles that were submitted.
Re:Test site (Score:3, Insightful)
Re:Test site (Score:3, Interesting)
Re:Test site (Score:3, Insightful)
If I were a black-hat planning to exploit this vulnerability, I'd put a remote control program like Back Orifice and a HTTP tunnelling program onto the web for BO to use for connectivity. Then the exploit downloads and install
But can it be used to... (Score:5, Funny)
or maybe install Firefox?
Script? Written -- Enjoy! (Score:3, Interesting)
It downloads firefox, and begins the installation -- that's it.
I could've very easily move iexplore.exe and adjusted icons and everything, but let's play this the white hat way. Enjoy amigos!
Re:But can it be used to... (Score:3, Interesting)
Not working (Score:2, Interesting)
The jmcardle site gets past IE, but Norton detects it and immediately blocks access. Nothing happens.
Re:Not working (Score:2, Funny)
An error has occured in the script on this page.
Line: 2
Char: 324
Error: Unterminated string constant
blaablaablaa
Do you want to continue running scripts on this page?
Hell no!
Re:Not working (Score:2)
It fries Safari (Score:5, Informative)
Pardon the technical terminology
With Safari 1.2.4 (v125.12), I get a "Safari cannot find the Internet plug-in." error dialog and then the beachball of death. Joy. Well, at least it's not opening the terminal.
Re:It fries Safari (Score:2)
Re:It fries Safari (Score:5, Funny)
Re:It fries Safari (Score:4, Funny)
Blue sky
Bright yellow sun
White fluffy clouds
Cheezy rainbow across the sky, and under the arc of the rainbow:
A FATAL EXCEPTION 0E HAS OCCURRED AT 0157:BF7FF831
Green grass
Smiling happy sunflowers
Pink fluffy bunnies hopping around and singing happy happy songs and dancing with the sunflowers.
PRESS CONTROL+ALT+DELETE TO RESTART YOUR COMPUTER. YOU WILL LOSE ANY UNSAVED INFORMATION IN ALL APPLICATIONS.
HAVE A HAPPY DAY!
-
Re:Not working (Score:3, Funny)
Heh (Score:3, Funny)
Re:Heh (Score:5, Informative)
That's right, Microsoft "we take security very seriously" Corporation has known about this vulnerability for almost two months, yet they leaved it unpatched? Why?
Re:Heh (Score:5, Interesting)
I think this exploit deserves a bit more attention than "serves clueless n00bs right". Although to be fair my default browser (FireFox) was unaffected ;)
Re:Heh (Score:3, Insightful)
Re:Heh (Score:5, Funny)
Re:Heh (Score:5, Insightful)
And a car with the wheels nailed to the ground, the doors welded and all the windows painted over is pretty safe from theves. When you saw those precautions advised in the manufacturer's literature, would you buy the car?
Re:Heh (Score:3, Insightful)
Right - and Granny isn't supposed to be able to run Linux, but she can do all that security stuff on Windows, right?
Well, I actually believe she can IF someone tells her she needs to...
And she can learn Linux, too, if she decides Windows is a piece of bloated, unreliable, unstable, expensive, insecure CRAP...
How many YEARS pas
Non-admin won't help you much (Score:3, Insightful)
Delete files? (Score:3, Insightful)
Re:Delete files? (Score:4, Funny)
If they reported the evening news the same way it would sound like this: "Today terrorists announced they have armed an atomic bomb in the middle of Los Angeles. They also announced that they have control of several hand grenades and also some water balloons and cap guns, and they're not afraid to use them!"
Re:Delete files? (Score:5, Funny)
Re:Delete files? (Score:3, Informative)
Not necessarily. If the arbitrary code is run in a restricted security context (e.g. Guest User, sandbox, restricted zone/role/capability) it shouldn't be able to delete files it has no acces to. The exploit would need to run a second exploit for privilege elevation.
Thankfully, in Internet Explorer's ActiveX security model none of all that is necessary, greatly speeding up the development of worms.
A worm that deletes everything. (Score:4, Insightful)
Re:A worm that deletes everything. (Score:2, Insightful)
Re:A worm that deletes everything. (Score:2)
Re:A worm that deletes everything. (Score:3, Interesting)
Change a few fields in spreadsheets too might be fun.
Post stored usernames and passwords to newsgroups..
Re:A worm that deletes everything. (Score:5, Insightful)
Similarly, we need a firebug to go around lighting people's houses on fire to show how having smoke detectors should be a high priority.
I realize you're not being 100% serious, but this reasoning is stupid.
Re:A worm that deletes everything. (Score:2)
Re:A worm that deletes everything. (Score:2)
Your comparision is wrong, a lot more people are aware of firehazards in the home. Compare the number of burning houses to systems infected worldwide daily.
When it comes to computers, people are generally ignorant other than to learn what they need to, knowing somewhat that computing as a whole is huge, they just want to get their work done and who can blame them?
Parent is right, we need something really destructive for people to be really pissed off and think about what they are doing or not doing. Y
Re:A worm that deletes everything. (Score:5, Funny)
Re:A worm that deletes everything. (Score:5, Insightful)
What has that to do anything with this story? RTFA and please stop blaming the user for everything.
Running WinXP SP2 and fully patched system. I run Norton anti-virus, spybot, Ad-aware and now MS Antispyware and enabled autoupdate.
Checked out Secunia, ran their test and my system was found vulnerable.
What more should I patch?
Re:A worm that deletes everything. (Score:2, Insightful)
Re:A worm that deletes everything. (Score:2)
You're Microsofts wet dream, aren't you? :)
I admit, this flaw isn't patched. But most of the time, the worm/virus uses old exploits.
Anyway, my point was that it would illustrate the fact that many many people (90%?) are using a flawed OS and browser combo.
Re:A worm that deletes everything. (Score:2)
Re:A worm that deletes everything. (Score:3, Interesting)
Re:A worm that deletes everything. (Score:4, Insightful)
Re:A worm that deletes everything. (Score:2)
Now we use IE6 and XP only for banking (Score:5, Interesting)
Result: Now we use Mozilla for casual browsing and use insecure products only when conducting important business!
Re:Now we use IE6 and XP only for banking (Score:3, Interesting)
Heh. (Score:2, Insightful)
Good work guys, it wouldn't have taken any more than a couple of days to figure out how to get your frigging menubar to work in a way that didn't require the security equivalent of a gigantic Swiss Cheese.
Re:Now we use IE6 and XP only for banking (Score:5, Interesting)
I'm not a big company, I'm just a private user. I very recently switched banks I use for personal finances. I left a "common" bank with its units in in several thousands of locations, and introducing new fees and increasing old ones now and then to maintain them all, and with quite crappy and really expensive Internet service, that was supposed to work in Mozilla/Firefox but it more often didn't than did, and I signed up for an Internet bank. Reduced costs of maintenance resulting in zero fees on all operations and account maintenance, no other fees, (except of withdrawal from ATM, very cheap too), and as they are an Internet bank, finally a REALLY professional Internet service. Working flawlessly in any browser, probably including Lynx
I don't know how it works for big companies but I strongly encourage you to leave your old-fashioned banks and move to "Internet banking". Reducing number of channels where money flows lets them focus on keeping the channels they maintain highest quality.
Whoa (Score:5, Informative)
it's not a vulnerability... (Score:3, Funny)
Surfing with IE (Score:5, Funny)
check if your vunerable (Score:2, Redundant)
is a test page containing a link if you left click on it and a window opens your vulnerable (it didn't do anything in Firefox)
Phew, Slashdot's back to normal (Score:2, Funny)
After today's pro-Microsoft articles, its about time we got back to bashing!
Is anyone still using IE? (Score:2, Troll)
Pff, (Score:2, Funny)
Fairly simple solution (Score:5, Informative)
select Internet Zone; click Custom Level; set just about everything to Disable or Prompt.
select Trusted Sites; click Sites; remove https requirement (because the use of https is no guarantee of safety). Then go to Custom Level, then set some items to Prompt, most to Enable.
This way, anything that isn't in your Trusted Sites list can't get up to any substantial shenanigans. When a page doesn't work, add the site to the Trusted Sites list.
Then, even if the page is one that attempts to initiate a cascade of pr0n sites that only open more up each time you close one, it may be able to open the first level of the cascade, but unless the cascaded ones are also on your Trusted list that's where the cascade will stop.
Some pages redirect you to another site; some have frames on different sites and so on, and this can get a bit tedious, but for the most part this makes IE6 invulnerable to Secunia's tests.
Also I only use IE for secondary browsing, where something REALLY won't work in Firefox, which is also protected by Proxomitron.
Your solution breaks McAfee virusscan (Score:3, Informative)
Great. A virus scanner that contains IE.
(I deinstalled McAfee an hour ago).
Re:Fairly simple solution (Score:3, Insightful)
Sophos Anti-virus detects pages using this exploit (Score:4, Informative)
http://www.sophos.com/virusinfo/analyses/expphela
EXP/Phel-A detects files that exploit the HTML Help Control Vulnerability which affects systems installed with Microsoft Windows XP Service Pack 2.
This vulnerability allows arbitrary code execution on the vulnerable system by bypassing security constraints established by the operating system.
BFD (Score:3, Insightful)
As for the internet, let's be serious. Anyone who, since 1995 (when ActiveX was introduced), has used MSIE on the internet, is just plan stupid, and has never had a reasonable expectation of either security or privacy. This has literally been known for nearly a decade now. "Fool me once, shame on you. Fool me 621498 times, shame on me."
Re:BFD (Score:5, Funny)
GWB said that, right?
Ya I pretty much have to recommend no IE now (Score:5, Interesting)
The security issues are another consideration as well. Active X controls in a webpage were a nice idea, as a way to add neat funtionality, however it simply opens up the possibility of too many exploits. It's not a matter of doing better checking of code or such, it's just too much power for a website to have.
So, even liking MS generally, I have to recommend against IE. Firefox is currently better in all the ways that really matter.
Also, I've noticed some people mention online banking as a problem. Bank of America works fully with Firefox and has generally been a deceant bank. Though I imagine if Firefox grows much more banks will have little choice but to support it.
What did Microsoft do to SP2 (Score:5, Interesting)
The expliot is specifically coded to target SP2 (Score:3, Informative)
Help me!! (Score:5, Funny)
Computer specs: iBook g3 800mhz...
I hope that helps a little
SP2 - any effect? (Score:3, Insightful)
According to their own test... (Score:3, Informative)
Guess it isn't as extremely critical as they say.
McAfee virusscan itself is also affected in a way! (Score:5, Informative)
Clicking the test link with IE proved that my system is vulnerable (if using IE, which I'm not, ofcourse). I had expected McAfee to block this web page, but it didn't. So I went to the internet security options panel in IE, and disabled all ActiveX controls.
But lo and behold, McAfee virusscan stopped working!
All their dialogs and panels seem te be using IE's HTML engine for display, and all I get now is first an error "your current security settings prohibit running ActiveX controls on this page. As a result, the page may not display correctly" and then an empty window when trying to access any of McAfee's information or settings dialogs!!
What a load of crap. I will send them a complaint, and remove their product from my computer right now, to replace it with a good, free virusscanner. Any recommendations? Thanks.
Re:McAfee virusscan itself is also affected in a w (Score:3, Insightful)
Re:McAfee virusscan itself is also affected in a w (Score:4, Informative)
If you'd like to see it in action, go to Trendmicro.com/download [trendmicro.com] and click on "Damage Cleanup Engine", download "sysclean", then go back and click on "Virus Pattern File" and download the latest (currently lpt335.zip). Unzip this into the same directory as sysclean and run it.
This solution won't stay in memory and scan everything that accesses your computer or HDD, but it will find viruses if you have any.
~Will
Re:McAfee virusscan itself is also affected in a w (Score:3, Informative)
Re:McAfee virusscan itself is also affected in a w (Score:3, Insightful)
That's pretty amusing. A virus scanner that relies on a component that may be a vector for viruses and trojans, and a known vector for spyware.
Embedding IE is simple for the programmer, but the security settings are so confusing for the user that it's possible to inadvertantly tighten security too much for local applications, which causes the errors that you speak of. After the existence of security holes themselves, I think the next worst part about IE is its incredibly confusing set of security settings,
Reported to Microsoft ... (Score:4, Informative)
Three months later, no sign of a patch.
good reflexes (Score:3, Funny)
That's almost whole 3 months. And since then no vendor patch for such a critical bug found in a major product. Not even a warning or anything. That must be the service that any microsoft software user would expect. Wondering if this is a promotion campaign for their new virus and spyware tools.
This bug and some recent others again proved that Microsoft embedded Internet Explorer in such a way that you can't distinguish it from Windows Explorer.
Re:liars! (Score:3, Funny)
Re:Nothing to see here.... (Score:2, Funny)
Re:Nothing to see here.... (Score:3, Interesting)
Having a vulnerability is like having a broken lock on a window. An exploit of that vulnerability is a burgular who is going around your neighborhood using windows as the entry point. In my opinion, exploits are a more serious concern than the vulnerability itself and warrant the increased amount of news on the topic.
Re:But... (Score:4, Informative)
Not since December 27 2004, anyway...
"XFocus also reported a hole in winhlp32.exe, the Windows
http://www.esecurityplanet.com/patches/article.ph
I don't recall any security issues with .hlp... (Score:2)
Re:But... (Score:4, Informative)
Why not HTML? Windows help is hypertext, and HTML is the standard for exactly that. I'm all the happier when people use standard formats rather than proprietary ones.
And for the record: HTML is completely secure. It's just data that gets rendered. Security holes are always either in the code that processes the HTML (which is a problem with that code, not with HTML) or in extensions (which is a problem with the extension and the program that uses the extension).
Re:Mac (Score:3, Funny)