Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security Internet Explorer The Internet

IE Download.Ject Exploit Fixed 421

Posted by simoniker from the round-and-round dept.
Saint Aardvark writes "Just in time for the weekend, the Internet Storm Center is reporting that Microsoft is providing a fix for the Download.Ject vulnerability that hit IE late last month. The press statement says that it'll hit Windows Update later today..."
This discussion has been archived. No new comments can be posted.

IE Download.Ject Exploit Fixed More

IE Download.Ject Exploit Fixed

Comments Filter:

  • FYI (Score:4, Informative)

    by arieswind ( 789699 ) * on Friday July 02, 2004 @12:31PM (#9593706) Homepage
    This configuration change to the Windows XP, Windows Server 2003 and Windows 2000 operating systems improves system resiliency to protect against the Download.Ject attack.

    In addition to this configuration change, which will protect customers against the immediate reported threats, Microsoft is working to provide a series of security updates to Internet Explorer in coming weeks that will provide additional protections for our customers.

    Please note that this isnt a fix, it is only a configuration change to help defend against the problem and nullify the threat from the known places it is spreading from. No doubt that within a short time, whoever is behind the virus will find other places to have the virus attack from. This is just another "this will help for now, please wait for the real fix" incident from Microsoft.

    • Re:FYI (Score:5, Informative)

      by Anonymous Coward on Friday July 02, 2004 @12:35PM (#9593763)
      Nope:

      Critical Update for Microsoft Data Access Components - Disable ADODB.Stream object from Internet Explorer (KB870669)
      Adodb.stream provides a method for reading and writing files on a hard drive.

      Quick Info
      File Name:
      Windows-KB870669-x86-ENU.exe

      Download Size:
      104 KB

      Date Published:
      7/2/2004

      Version:
      870669

      Overview
      Adodb.stream provides a method for reading and writing files on a hard drive. This by-design functionality is sometimes used by web applications. However, when combined with known security vulnerabilities in Microsoft Internet Explorer, it could allow an internet web site to execute script from the Local Machine Zone (LMZ). This occurs because the ADODB.Stream object allows access to the hard drive when hosted within Internet Explorer.

      It has nothing to do with known threats.

      • Re:FYI (Score:5, Funny)

        by Tackhead ( 54550 ) on Friday July 02, 2004 @01:02PM (#9594054)
        > This by-design functionality is sometimes used by web applications. However, when combined with known security vulnerabilities in Microsoft Internet Explorer, it could allow an internet web site to execute script from the Local Machine Zone (LMZ).

        Ah, once again, "Security Zones" rears its ugly head. Wasn't integrating the browser into the operating system a brilliant move?

        Ah, once again, the assumption that users are using Web-based apps in a trusted environment such as the office LAN, rather than the Real World(tm), rears its ugly head. Services listening on 135? 137? 139? 445? 5000? But how will you share files, printers? Doesn't everyone want to share every file with every other user on their network segment? Doesn't everyone want to automatically sniff out and configure their machine to work with every network-attached peripheral?

        Open Letter to Windows design team, in monosyllables so you get the fucking point, because you sure as fuck haven't over the past nine years

        Code. Code belong on hard drive. Code tell a C.P.U. to do stuff. You get code, you save code, you tell box to run code! O.S. do what code say, so if you get owned, is your fault cuz you tell O.S. to run code! This just fine!

        Web Pages. Made of H.T.M.L. You get by click link. to make words and pics on screen. You got H.T.M.L.? I.E. for turn the H.T.M.L. into pics on screen. I.E. good for show text. I.E. good for show click link. I.E. good for show boobs.

        Heap Big Clue: I.E. MADE OF CODE. I.E. CODE RUN ON LOCAL MACHINE. THEREFORE ALL ZONE ARE LOCAL. You no grok? Here two by four. Hit self in head until you grok, dumb ass.

        This isn't chocolate and peanut butter. Executables and Web Content are not two great tastes that taste great together. Just because you can do something, doesn't mean you should.

        Security "zones" are one of the dumbest fucking ideas ever to come down the pipe.

        • > Heap Big Clue: I.E. MADE OF CODE. I.E. CODE RUN ON LOCAL MACHINE. THEREFORE ALL ZONE ARE LOCAL.

          My bad. Forgot to monosyllablize the heap big clue; there's no one-syllable word for "local internet zone", so...

          "I.E. made of code. I.E. code run on your box. Since I.E. code run on your box, all zone known to I.E. are "SELF"!"

        • Re:FYI (Score:3, Interesting)

          by Temporal ( 96070 )
          Are you trying to suggest that web sites should not be allowed to contain scripts? Or that sandboxing code with different levels of trust is not a useful ability? Or what? Because either of those assertions is pretty dumb. Microsoft's problem is that their API's are a mess and security checks aren't always performed or performed correctly. There's too many places in the API where security checks need to be performed, so it's hard to test them all. If they had said from the start that any API component
          • > Are you trying to suggest that web sites should not be allowed to contain scripts? Or that sandboxing code with different levels of trust is not a useful ability?

            Yes to the former. No to the latter -- but with the caveat that the thing that should be sandboxing code is the operating system, not the web browser.

            A web browser is not an operating system. It has no business doing anything other than turning HTML into boobies.

            > Microsoft's problem is that their API's are a mess and secur

            • Remote execution of untrusted code is bad.

              Not if it's sandboxed.

              Tools that enable untrusted code to run in an unsandboxable environment are bad.

              What makes an environment "unsandboxable"? We're not talking C code here, where you can access any object in memory if you know where in might be likely to reside. We're talking about scripting languages where you can only access the functionality provided by the API.

              No to the latter -- but with the caveat that the thing that should be sandboxing code is t

              • Re:FYI (Score:4, Insightful)

                by Anonymous Coward on Friday July 02, 2004 @08:01PM (#9597108)
                "What makes an environment "unsandboxable"?"

                follow along, because perhaps you're a clueless MS programmer and don't get it.

                1) IE really is integrated into windows. Sure, delete that icon on the desktop, but the entire help system is based around IE, the email client is based around IE, in fact every feature of the GUI is based around IE. You can't swing a memory mapped file without hitting a couple of IE API's.

                2) IE itself contains provisions called BHO's and ActiveX controls that let you add new functionality to IE.

                3) Therefore if IE is part of the operating system, and IE can be significantly altered either in advertantly ("Hey buddy, click here to win 1 million dollars!") or through a buffer overflow or similar trick, then you've given untrusted code a relatively easy path to alter the core OS.

                4) Lets go through this again, because you're slow.

                5) IE is core to OS, IE can be easily corrupted by executables on the web, therefore, the core OS is subject to security breaches simply by a user browsing the web.

                I don't know how to make this clearer. The things I've seen IE do to Windows XP in the past 4 weeks make my hair stand on end. A simple click by a friend, who tried to close a popup, missed by 1/4" and basically allowed an ActiveX control to run rampant, cost us an entire two days work.

                * The virus protection saw the problem but wasn't fast enough to fix it
                * Spybot S&D 1.3 with latest patches was *BLIND* to this infection
                * SpySweeper was able to kill things off, but only after we disabled system restore because guess what, every new piece of malware hijacks system restore and the system continuously reinfects itself.

                Lets step by and see what's happening.

                By design, IE has set up the entire Windows OS so that one inadvertant click in a user process can completely corrupt the OS.

                *AND ITS DONE ON PURPOSE*

                Honest to god, if someone told me that MS was that stupid 10 years ago, I'd laugh. But I've seen it with my own eyes. IE is so awful that it should not be used. The US government now recommends you shouldn't use it.

                I like Windows XP, but IE is fatally flawed and must be rewritten. But hey, its so integrated in the OS that guess what... you have to rewrite the OS.

                Holy cow, open your eyes. Its BAD out there!

    • Re:FYI (Score:5, Insightful)

      by quadra23 ( 786171 ) on Friday July 02, 2004 @12:36PM (#9593784) Journal
      This is just another "this will help for now, please wait for the real fix" incident from Microsoft.

      I think I lost count at about 1000 when it comes to these "this will help for now..." When it comes to IE most fixes end up as patches that can actually break more than they fix. I think the Dept. of Homeland's Security recommendation of not using IE speaks loud and clear to this.

      Microsoft could start but not allowing web sites to automatically run malicious code, just as Outlook has the same tendency with emails (which incidently, most email viruses spread rapidly with).

      • Re:FYI (Score:5, Interesting)

        by dasmegabyte ( 267018 ) <das@OHNOWHATSTHISdasmegabyte.org> on Friday July 02, 2004 @01:09PM (#9594121) Homepage Journal
        You're making claims that are untrue and short sighted. I call FUD.

        First, to release a patch to a commercial application used by millions of people is inherently troublesome. You've got to make sure you test it thoroughly...because unlike Open Source, the liability is on YOU if people can't get their work done. If there is a change to an existing setting that can defray the effect of the vulnerability and give you more time to test, it would be remiss of you not to inform customers of it. Would you rather they ask customers to wait a few days until the patch is thoroughly QA'd?

        Second, I have never -- that means NOT EVER -- seen an IE fix that broke my machine worse than a virus would. The fix might cause problems with IE, but it wouldn't cause my machine to send spam email against my will. And the VAST majority of IE fixes have had no ill effects whatsoever. On the other hand, emerging the latest from gentoo causes something to break a substantial percentage of the time.

        I do agree that IE isn't the best browser ever, but this doesn't excuse you from putting blame where it doesn't belong. If you're going to fault Microsoft for anything, fault them for not being up front about the patch process. They should let us know at every step of the way what the problem is, how to patch it for now, when a fix will be ready and how to defray such bugs from allowing exploits in the future. That's one cue from OSS they'd be smart to heed. All software is buggy. Pretending it's not is tantemount to pretending you aren't going to fix it.
    • "Fixed" is a strong word, I suggest an alternate title for this article:

      "Microsoft Kind of Does Something Vaguely Related to Download.Ject Exploit"

  • That reminds me... (Score:5, Funny)

    by DaHat ( 247651 ) on Friday July 02, 2004 @12:33PM (#9593732)
    That assumes I remember to run Windows Update... Why do I have to do it myself Microsoft! I want automatic and forceful patch downloading and installation! Sure, you could throw in an extra DRM patch here or there... but I don't care, I'm lazy!

    • Um (Score:3, Informative)

      by Anonymous Coward
      You can have Automatic Update download and even install things on Windows XP.

      • Re:Um (Score:5, Informative)

        by Zed2K ( 313037 ) on Friday July 02, 2004 @12:39PM (#9593811)
        You can make it completely automatic on 2000 also.

      • Re:Um (Score:2, Insightful)

        by ViolentGreen ( 704134 )
        You can have Automatic Update download and even install things on Windows XP.

        While this is great for most home users, a lot of people (including myself) do not do this. I want to know exactly what is being put on my system. I don't need the Euro conversion utility. I don't need windows media player 9. Right now there are 8-10 things that it has wanted to install for over a year that I refuse to put on.

        • Re:Um (Score:5, Informative)

          by sid crimson ( 46823 ) on Friday July 02, 2004 @12:51PM (#9593954)

          I don't need the Euro conversion utility. I don't need windows media player 9.


          Autoupdate only installs "critical" patches. WM9 and the Euro tool are not such updates.

          -sid

        • Re:Um (Score:3, Informative)

          by TheSHAD0W ( 258774 )
          You can set Automatic Update to ask whether you want the updates installed or not. Right-click My Computer, Properties, Automatic Updates tab, check "Keep my computer up to date", and select "Notify me before downloading any updates". (Note that this is for XP; there's a similar setting for 2K. Not sure about 98/ME.)

    • Re:That reminds me... (Score:5, Interesting)

      by WoodstockJeff ( 568111 ) on Friday July 02, 2004 @12:39PM (#9593826) Homepage
      I know your post was taken as FUNNY, but I lost several hours last week installing, then uninstalling, an "important security patch" that took down the my client's Exchange Server. Had it been done automatically, the server would have simply stopped working for unknown reasons, at some MS-selected random time...

      I, for one, do NOT look forward to the coming mandatory auto-patching, but I suppose it is inevitable with Microsoft.

      • Had it been done automatically, the server would have simply stopped working for unknown reasons, at some MS-selected random time...

        You mean the random time like 3:00am that is listed in Automatic Updates by default, or some other random time that's selectable from the drop down box on when to check for and apply critical security patches automatically? I've been using this since it came out and have no problems, but then again, we don't really do anything complicated or mission critical with Microsoft s

    • I want automatic and forceful patch downloading and installation!

      Are you serious about wanting forced, automatic downloading ? Do you REALLY want to give Microsoft full control to change things without your permission ? What happens when you log on and MS "Fixed" IE by not letting Mozilla/FF load ? How about "fixing" MS Office, by blocking Open Office ? I am not a tinfoil hatter, or and MS hater, but I like to decide what/when gets updated on my machine. As an example, I have an old, DRM free version of M

    • Re:That reminds me... (Score:2, Interesting)

      by blindbat ( 189141 )
      I was helping a fellow (via phone) repair his Windows installation that had a couple of viruses (at least), blaster and another worm. He even has the auto download of updates running so he thought he would be safe.

      Problem: he is a dial up user and is never connected long enough at home to keep his system current.

      So Windows will have to hi-jack the internet connection in order to get the downloads or half-knowlegdable users like this guy will still be victims.
    • I must remember to run Windows Update too, so I can get this patch. Oh wait a minute... I don't have to! I'm on a MAC!

  • One down, ??? to go (Score:2, Informative)

    by rjune ( 123157 )
    For the others, Microsoft has provided customers with prescriptive guidance to help mitigate those issues.

  • Got it, but.. (Score:5, Insightful)

    by Dynamoo ( 527749 ) on Friday July 02, 2004 @12:34PM (#9593754) Homepage
    Got it, but in the meantime I switched to Mozilla Firefox [mozilla.org] and I honestly don't see any reason to go back to IE apart from a handful of aggressively IE-only sites.

    • Re:Got it, but.. (Score:3, Interesting)

      by Anonym1ty ( 534715 )
      aggressively IE-only sites

      What? Like sites that do not function if they can't open a thousand windows? or can't force you to agree to download and install something without crashing the browser? (insert zillions of other annoying or dangerous exploits here)

      If a site REQUIRES Internet Explorer perhaps you shouldn't go there. I mean now that the Department of Homeland Security is urging people not to use IE, Your bank better think real hard about requiring you to use it.

  • The press statement says that it'll hit Windows Update later today...

    O get the fix early, HERE. [mozilla.org]

  • Just got my WindowsUpdate popup a minute ago. No restart. Yay!

    What's still frustrating is the amount of time between the identification of a vulnerability and the time a real patch is released. A real patch, not just some KB article telling you to edit the registry.
    • A real patch, not just some KB article telling you to edit the registry.

      The really unfortunate part of all this is that you can run a configuration like I do - treat all of internet as "restricted", disallow all scripting, don't trust any downloads - and not be vulnerable to something like this. My system's configuration requires that I tag windowsupdate.microsoft.com as a "trusted" site in order to get updates!

      But it means that hundreds of common websites stop working. Microsoft decided to join the contr

  • Fix can be downloaded here [mozilla.org].

  • In Other News... (Score:5, Funny)

    by Snagle ( 644973 ) on Friday July 02, 2004 @12:36PM (#9593770)
    The Department Of Homeland Security said it is safe to go back to using Internet Explorer as your main browser...for about 10 minutes, when the next exploit will be released.

    • Re:In Other News... (Score:5, Interesting)

      by chris_mahan ( 256577 ) <chris.mahan@gmail.com> on Friday July 02, 2004 @12:45PM (#9593882) Homepage
      I notice that MS releases a "fix" of some sort when DoHS says: use another browser.

      Can somebody at DoHS recommend switching to another browser every day so MS will start working on the backlog of bugs?

      Another question: Are there enough of those high-flying MS developers still working on the IE codebase to make the changes in a timely manner or is there an aging skeletton crew to fix the vulnerabilities, not too motivated since they were passed up for work on .NET?

      I wonder.

      Somebody probably lit the proverbial fire under their bums this morning.

      (They know how hard it is to get people to switch browsers. It took a while (2 years) with Netscape, and NS Communicator was a POS). I guess they are at the edge of the cliff and realized there's nowhere but down.
    • While you meant this to be funny, the sad thing is that Homeland went to MS and has been with it since its inception. By doing so, they proved that "Security is job 1" is not true. Now they are saying to stop using MSIE, but nothing about SQL server, IIS, Exchange, or outlook, of which the vast majority of cracks come from.

      It is this very reason why I am so opposed to the patriot act. It gave to Homeland and to DOJ most of the same capabilities as NSA and CIA had together. NSA/CIA are far less political th
      • "the sad thing is that Homeland went to MS and has been with it since its inception. By doing so, they proved that "Security is job 1" is not true."

        Kind of. It actually proved that it is difficult to function as a government. You see, as a government, you CANNOT just have biased opinions, even if those biases are based in experience. It has to run on fact, or at least what qualifies as fact.

        The "fact" is that Windows has much better government certification than Linux. We know that government certific
    • If CERT was doing their job right, they would have recommended against using IE back in the mid-'90s when Microsoft first created the basic design flaw that this is just the latest instance of.

      That's when I banned IE and Outlook at work. Did wonders for our security, and made me look really good when other groups and companies got hammered by Melissa and her zombie children.
      • what are you using for corporate mail, Lotus? I hav had nothing but frustrations with Domino/Lotus Notes.

        Not to say it's not woking out for you, just venting pent-up frustrations ;)

  • The Vulnerability (Score:5, Funny)

    by lousyd ( 459028 ) on Friday July 02, 2004 @12:36PM (#9593776)
    the Download.Ject vulnerability that hit IE late last month. The press statement says that it'll hit Windows Update later today..."

    So, the vulnerability will hit Windows Update later today? How do they know? (Other than the fact that Microsoft is running security at the Windows Update site, of course.)

  • All right!!! (Score:5, Funny)

    by k4_pacific ( 736911 ) <k4_pacific@yahoo . c om> on Friday July 02, 2004 @12:36PM (#9593777) Homepage Journal
    That means all the sys-admins will have to work late on a Friday night making sure its installed.

    Excellent timing.

    • >That means all the sys-admins will have to work late on a Friday night making sure its installed.

      The update is already available and I've already pushed it out to all of my machines without issue.

    • Not me.

      After Blaster I said Screw that and built an Software Update Server on our network here. All I had to do was forcibly sync it, approve the update and away it goes.

      All I have to do is wait, and check the logs (using suslogvewer) on monday to make sure that they updated.
    • Nope--I can't update machines until I know a patch is out. This sys-admin is covering his ears and humming showtunes until 4 p.m. Lalalalaaala...

  • Loaded terminology... (Score:5, Insightful)

    by Anonymous Coward on Friday July 02, 2004 @12:38PM (#9593800)
    "Late last month"

    vs.

    "A week or so ago"

    I know Microsoft is not one for timely updates, but this wording makes it sound like Microsoft has been sitting on this particular problem a lot longer than they have.

    • I know Microsoft is not one for timely updates, but this wording makes it sound like Microsoft has been sitting on this particular problem a lot longer than they have.

      To steal an oft-used cliche of the "Linux fanboys":

      You must be new here.

      Oh, and I figgered I'd not be a looser and mispell something just two make it offishul:Nataly Portman.
    • Wasn't the vulnerability something like 10 months old? Or is that another one? If it's another one, does that mean the 10 month old one still goes unpatched?

      I don't know the answers myself, because I have given up caring about MSIE security holes. The thing _is_ a security hole.
    • Well, it was published on bugtraq 'late last month'.

  • What about ActiveX? (Score:4, Informative)

    by jZnat ( 793348 ) on Friday July 02, 2004 @12:41PM (#9593834) Homepage Journal
    They might've found one way to prevent the auto-download, but there are still plenty of ways to force a download using ActiveX. Even with that, there are still a few ways to run them too; methods that are still unknown to most assholes trying to get you to buy their pills that give you bigger penis-breasts-ego-wallet-spyware-car-wife-mom-WMDs .

  • late last month means (Score:5, Insightful)

    by Zed2K ( 313037 ) on Friday July 02, 2004 @12:41PM (#9593842)
    Late last month actually means June 25th. Which by my count was only 1 week ago. But it wouldn't be a bash microsoft topic without a little twisting and manipulation.

  • Why Ject? (Score:2, Interesting)

    by Anonymous Coward
    Why is it called Ject? Is the virus writer or the AV firm some kind of closet Final Fantasy X fan? Seriously? Why Ject?
    • " Why is it called Ject?" he interjected
      "Is the virus writer," he conjectured," or the AV firm some kind of closet Final Fantasy X fan?"
      "Seriously?" he objected
      "Why Ject?" he said dejectedly.

      Probably because you weren't projecting your rejection at the time. But more likely due to the fact that it feels uncommon in the English language, but practically falls off the tongue and so is easy to remember. (sorry, I couldn't easily inject abject)

      -Adam
  • This is completely incomprehensible. I'm using Mozilla Dangerphoenix, and ms let me get the download with no hassles at all. Of course it's not one of their usual updates, but I still find it hard to believe that they haven't broken the link for non-IE browsers like they do for the rest of their site. Unless the "Configuration Change" is really just an extension to "fix" my Mozilla Pornopony to behave just like IE. DAMN YOU MICROSOFT, WHEN CAN I TRUST YOU!!!

  • Coming soon... (Score:5, Funny)

    by sleighb0y ( 141660 ) on Friday July 02, 2004 @12:44PM (#9593876) Homepage
    Download.Ject.A
    Download.Ject.B
    Download.Ject.C
    Download.Ject.D..............

  • Can somebody point me to where the ACTUAL official notice from US-CERT is that recommends NOT using IE? I would love to forward it to the head of my agency, but forwarding a link to slashdot is not going to hack it.

    I looked on the US-CERT website but could not find it.

    thanks

    • Re:Where is the notice? (Score:2, Informative)

      by beezly ( 197427 )
      There's a copy at http://www.kb.cert.org/vuls/id/323070 [cert.org]. Right down at the bottom under "Use a different web browser".
    • http://www.kb.cert.org/vuls/id/713878

      "Use a different web browser

      There are a number of significant vulnerabilities in technologies relating to the IE domain/zone security model, the DHTML object model, MIME type determination, and ActiveX. It is possible to reduce exposure to these vulnerabilities by using a different web browser, especially when browsing untrusted sites. Such a decision may, however, reduce the functionality of sites that require IE-specific features such as DHTML, VBScript, and ActiveX.

  • IE Features (Score:5, Insightful)

    by johnhennessy ( 94737 ) on Friday July 02, 2004 @12:48PM (#9593925)
    What use are IEs extra features if they have to be turned off by default.

    ActiveX should never have been embedded into a browser in the way it has been. Yet most of the sites that I have to use IE for is because of ActiveX controls.

    Microsoft tricked a lot of the world into using ActiveX and now they're paying the price.

    I can hear the support conversations already -
    "Yes, if your security zone is set to high your computer won't be vulnerable. But if you want to view anything with ActiveX (read: multimedia) you'll have to turn these vulnerabilities back on."

    Does anyone else find this mildly insane ?

  • Microsoft released a fix a long time ago (Score:5, Informative)

    by Sheepdot ( 211478 ) on Friday July 02, 2004 @12:52PM (#9593962) Journal
    Ever wondered how IE exploits get a whole executable to your computer?

    Wonder no more. 11 months of IE exploits and at least a year or two's worth of future exploits can be avoided with one simple registry change [microsoft.com]. The problem that MS has isn't that they are incompetent, it's that they insist on leaving default features that are used by 1% of administrators like myself.

    98% of spyware released since January 2004 can be avoided with the above registry fix. If you think that statistic is outrageous, I challenge you to find one piece of malware installed without using ADODB.Stream in one way, shape, or form. Be forewarned, I make and research IE exploits for a living and wouldn't make this kind of a claim without having the data to back it up.

    • I believe Spyware Blaster [javacoolsoftware.com] is a program that adds this key, as well as several others that will protect your system.

      The bonus about this program is that it doesn't run resident in memory. It just changes some regkeys and the hosts file to confuse/prevent spyware from running. Installing/uninstalling changes are just a click away, too.

    • Isn't this exactly what he current fix is doing? I checked my registry after applying the fix and that key listed on that page seems to have been added.

    • Re:Microsoft released a fix a long time ago (Score:4, Informative)

      by jesser ( 77961 ) on Friday July 02, 2004 @01:52PM (#9594540) Homepage Journal
      11 months of IE exploits and at least a year or two's worth of future exploits can be avoided with one simple registry change.

      The registry change you point to only affects the ADODB.Stream object. While holes involving ADODB.Stream may have made up a large porportion of successful exploits by spyware (as you claim), there have been other arbitrary-code-execution vulnerabilities in Internet Explorer during the time period you mention.

      I'm guessing that there have been several zone-jumping holes, and ADODB.Stream makes all zone-jumping holes into arbitrary-code-execution holes. Is that what you mean by "using ADODB.Stream in one way, shape, or form"?

      I make and research IE exploits for a living and wouldn't make this kind of a claim without having the data to back it up.

      I find and fix Mozilla security holes as a hobby and I think you're making stuff up.

  • Yippee! (Score:5, Interesting)

    by callipygian-showsyst ( 631222 ) on Friday July 02, 2004 @12:52PM (#9593965) Homepage
    Despite all our whining and moaning, (and the fact that this bug was the straw that broke the Camel's Back and I switched to mozilla and thunderbird [robert.to]) Microsoft did act pretty fast here. It was less than a week, wasn't it?

    And, while it's unfortunate that many people don't (or can't) run Windows Update, it works well for people with fast connections who are behind firewalls so their systems don't get screwed up before they can patch them!

  • I'm already patched! (Score:5, Funny)

    by SnarfQuest ( 469614 ) on Friday July 02, 2004 @01:05PM (#9594085)
    Microsoft e-mailed me the patch some time ago, like they do with all their other security updates. I install them all as they come in, and keep my system virus free!

  • Is this just coincidence? (Score:4, Interesting)

    by Anonymous Writer ( 746272 ) on Friday July 02, 2004 @01:06PM (#9594095)
    It was only mentioned two posts before this that CERT advised [slashdot.org] people to stay away from IE, even though CERT released that advisory on June 10 [cert.org], and it was even reported on BBC on June 14 [bbc.co.uk]. Now this story comes along mentioning the patch will be available later today? The CERT advisory could have been published on Slashdot nearly a month ago, but conveniently is published on the same day as the fix is released. Was it intentional to keep information about the CERT announcement off of Slashdot until the fix was released?

  • Dear Microsoft, (Score:5, Funny)

    by stienman ( 51024 ) <.adavis. .at. .ubasics.com.> on Friday July 02, 2004 @01:16PM (#9594204) Homepage Journal
    Dear Microsoft,
    I am writing concerning downloading the most recent Windows Updates. I am unable to obtain them as your site requires IE, and the government recently suggested that users cease use of IE.

    Please help!

     -Adam

  • Fix not available yet (Score:3, Informative)

    by mabu ( 178417 ) on Friday July 02, 2004 @01:19PM (#9594222)
    Talk about damage control... they don't have the fix on their site at the time of this writing... so it's vaporware for now.

    I know of at least two very large companies who have moved to Firefox in the wake of this latest episode. I suspect many people are finally fed up, which has prompted MS to announce patches before they're even available.

    Considering a recent patch to fix a vulnerability broke the complaince of IE as it relates to embedded uids/pws in URLs, I wouldn't be surprised if this "fix" ends up crippling something else.

    We should start collecting wagers on what new problems this upcoming "fix" introduces. Otherwise it would probably be online by now.

  • Attack and solution known since Aug. 2003 (Score:5, Interesting)

    by weld ( 4477 ) on Friday July 02, 2004 @01:50PM (#9594524)
    See Full Disclosure list for an attack that used same technique back in Aug. 2003:

    FullDisclosure: ADODB.Stream object [seclists.org]

    Any attack vector that relies on an ActiveX control can be stopped by setting the killbit. This is IE security 101.


    -weld

  • IE Download.Ject Exploit *not* fixed (Score:5, Informative)

    by yeremein ( 678037 ) on Friday July 02, 2004 @02:05PM (#9594646)
    ... this update is actually just a configuration change [microsoft.com] that disables the ADODB.Stream object from within Internet Explorer.
    The stream object contains several methods for reading and writing binary files and text files.
    When this by-design functionality is combined with known security vulnerabilities in Microsoft Internet Explorer, an Internet Web site could execute script from the Local Machine zone.

    No security vulnerabilities have actually been fixed here; all that's happened is that some functionality (which exacerbated existing security holes and was probably a bad idea to begin with) has been disabled.

  • Security and MS "Getting it" (Score:5, Interesting)

    by geomon ( 78680 ) on Friday July 02, 2004 @02:21PM (#9594797) Homepage Journal
    Okay, everyone has had a great deal of fun at Microsoft's expense today with the stories of Dept of Homeland Security dumping IE, and Microsoft taking nearly a month to fix a BIG exploit in IE. But I wonder if Microsoft's problems are less a function of them 'getting it' as much as it is a case of them being a 'victim of their own success'. Follow along with me for a minute.

    When MS started its rise to the top, they hired as many of the brightest minds as they could to make their software the best of class. While many of us probably find the corner-cutting a bit too much to take, it is possible to have both world-class software while meeting a marketing deadline. It happens, but less frequently than MS or its defenders/supporters would like to think it does (lightning striking the same point twice *without* a lightning rod).

    They continued to compete heavily in the OS market despite the fact that they initially wanted to be nothing more than a computer language business. The OS was to be the cash cow that would allow them to be a more effective language business. But now they own the OS business and are driving their business model into other ventures (consoles, entertainment centers, telephones, automotive brainboxes, etc). They just follow the same formula that lead to their smashing success in moving into the OS and office app market: buy the best brains in the field and use their project management skills and VOILA!, they are the new masters of the [insert market segment].

    But consider the sandbox their bright minds play in: a homogeneous computing environment with computer scientists guarding the facility from outside intrusion. As has been noted in another slashdot article [slashdot.org], Microsoft's products work wonderfully inside of Microsoft's campus.

    They have extremely talented people working with the highest-end equipment in an environment where everything works nearly 100% of the time. Is it so surprising that they do not view the world the way we do?

    After all, most of the companies that I have worked for are staffed with (largely) computer-illiterate people and whose firewall is maintained by a PFY with a high-school diploma.

    Perhaps it would be better for Microsoft if they force their developers to create their products in environments that their customers use. In fact, maybe they should send their developers to test their products in the heterogeneous environments of their customers for a month or two.

    Let them work the bugs out on their time for a change.

  • Windows 9x and Windows ME users still vulnerable? (Score:4, Informative)

    by prandal ( 87280 ) on Friday July 02, 2004 @02:26PM (#9594850)
    According to SecuritiyFocus [securityfocus.com]. Windows 95, 98 and ME users are also vulnerable. So why is this patch only for Windows NT, 2000, XP, and 2003?

    It does NOT run on Windows 98.

    Oh, I remember, Microsoft only produces patches for "supported" (if that's what you can call it) products.
    • Chuck this into a .reg file and import.. The bit in square brackets is one line only - substitute a space for any linebreaks...

      REGEDIT4


      [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA 4}]
      "Compatibility Flags"=dword:00000400

Slashdot Top Deals

Business is a good game -- lots of competition and minimum of rules. You keep score with money. -- Nolan Bushnell, founder of Atari

Close