Several Critical MSIE Flaws Uncovered 388
An anonymous reader writes "Several flaws have been uncovered by security firm eEye in Microsoft's Internet Explorer. The flaws allow remote compromise of computers running Windows Operating Systems and affect IE, Outlook and possibly other MS software. With the next MS Windows security bulletin release scheduled for June 14, 2005 news sources are reporting that in comparison with the Mozilla Foundation's prompt fix for the recently reported Mozilla 1.0.3 vulnerabilities MS appear to be leaving a large window for the possible malicious exploitation of these flaws."
Thanks Microsoft! (Score:5, Funny)
Re:Thanks Microsoft! (Score:5, Interesting)
Vulnerabilities (Score:5, Insightful)
Re:Vulnerabilities (Score:4, Insightful)
Damn this is true! I went to my insurance agent the other day, and he uses IE to access all my account information that is stored on the headquarters's server. Made me want to reconsider my choice of insurance companies.
Re:Thanks Microsoft! (Score:4, Interesting)
Re:Thanks Microsoft! (Score:4, Informative)
Re:Thanks Microsoft! (Score:5, Funny)
No one would be stupid enough to try and make an email client be an applications platform
Ever hear of Lotus Notes?
Re:Thanks Microsoft! (Score:5, Funny)
Yes, I have and it is a nice proof for grandparents statement.
Re:Thanks Microsoft! (Score:4, Interesting)
Notes is a messaging/workflow management application platform that can be trivially used as an email system, a use for which it is overkill, given that the least common denominator capabilities of Internet email systems are so extremely limited.
I think Notes is mispositioned in a marketing sense, given what it is. It completes against Exchange, which truly is an email system that has been overextended into a platform. This naturally leads to a lot of dissatisfaction with the product when it's used for plain old Internet email, which it is 90% of the time. Most IT departments don't have enough on the ball to develop workflow management applications, or even use non-Microsoft products.
It's too bad, because there's a lot of good stuff in there.
Re:Thanks Microsoft! (Score:3, Insightful)
Re:Thanks Microsoft! (Score:3, Insightful)
Notes and I parted ways around R5, when it was clear where the IBM/Lotus people managing the product were headed. They were building a layer of HCI crap over the good stuff in the product, which was nearly a decade old. It was clear to me that the facade they were putting up in front o
Re:Thanks Microsoft! (Score:5, Insightful)
-
Browsers are in general extremely complex apps and complexity leads to security issues
-
Browsers generally contain parsers for a large number of file types, and parsers are notorious for security issues
-
Browsers must deal with cross domain concerns (local system vs. remote sight), which can be very tricky
-
Most browsers were initially developed during the internet boom when features ruled and security was a foreign word
IE in particular has the deck stacked against it because it was pretty much ignored in the MS security push that started in 2002. The team had already been disolved and the app was in maintenance mode. They just didn't commit the resources to dig into the code and do a thorough security review like they did with most of their apps. Instead there were some tacked on fixes like shuffling the zones, modifying ActiveX prompts, and disabling most functionality in Server 2K3. I personally have no question that they regret that decision, and we'll see what happens with IE7 this summer.Re:Thanks Microsoft! (Score:3, Insightful)
I expect that Microsoft's "integration" strategy for subverting interoperability will continue to induce pain points in fresh code just as it has done in legacy code.
In a complex design which combines a tolerance for brittleness and nonmodularity with a strong preference for products to fail open rather than closed, that has to be so. It becomes that much harder to meet functional tests, let alone the nonfunctional ones related to security.
Re:IE7 (Score:5, Insightful)
Re:IE7 (Score:5, Insightful)
I don't see how basically a patch against what is most often just a few lines of code can open more holes, either. That's just dumb.
I see you have never worked on an enterprise-class application, otherwise you would know that just changing the boolean algebra inside an if() statement can have catastrophic consequences. Usually what happens is there is a bug. To fix this bug, the developer must modify this conditional (i.e. a transaction is not always processing because the if() skips it under weird circumstances). However, there is some obscure requirement that, despite being well-documented, is difficult to understand. That if() statement has conflicting requirements, and the logic needs to be expanded to accomodate both situations. However, desparate for a quick, one line fix, the developer changes a single line (or character, e.g. "!" not logic). This breaks a bunch of other stuff.
Some applications are like a house of cards -- precariously perched, even one small error can bring the whole structure down. Good configuration and requirements management can mitigate this risk, but the possibility of error is always there.
Exerpt from "The Devil's DP Dictionary" (Score:3, Funny)
Recursion: See recursion.
Re:IE7 (Score:5, Informative)
Re:IE7 (Score:4, Informative)
MS does the same thing with office to make it start faster.
There's more than simple buffer overflows (Score:4, Interesting)
Of course, there's a lot of fertile territory in parsers for all sorts of non-buffer related exploits. Cross domain context and external includes were both used in the most recent Firefox exploits. These issues are not unique to XML and HTML formats. I've seen exactly the same problems occur in binary OLE document handlers. This is why I stated that the parsers as a whole are complex issues. They touch so many areas and intermingle so many other concerns that they can be a security nightmare.
Re:Thanks Microsoft! (Score:5, Funny)
Dupe? (Score:5, Funny)
I could swear I read about security problems in MSIE before...
Re:Dupe? (Score:2, Funny)
Deja-vu (Score:2, Funny)
Re:Dupe? (Score:5, Funny)
Great.. (Score:4, Informative)
Re:Great.. (Score:5, Funny)
Re:Great.. (Score:4, Funny)
Re:Great.. (Score:4, Insightful)
Re:Great.. (Score:2, Interesting)
Their apps basically round trip everything to the server for processing. Never mind how friggin' slow it is, they insist on avoiding doing anything "client side."
And they do *just* enough to make it IE specific.
I totally agreee with you that if your going to do some type of internal app, most people would use all the resources available to them.
Not where I work, though. Drives me nuts. ARG!
Block IE from connecting to the outside world (Score:5, Interesting)
I wish there was a "corporate" browser with minimal features to reduce exposure. Sort of like IE lite.
It's called denying iexplore.exe and other apps known to embed the IE OCX the right to connect to the public Internet on port 80, using a software firewall on each machine or a proxy server that only Firefox knows about.
Re:Great.. (Score:2)
Re:Great.. (Score:2)
Re:Great.. (Score:2)
I think that's essentially the idea of IE in Server 2003, which has a reduced featureset for security. I think it's only available for 2003 though, which kinda negates its usefulness in the context you want it.
But thats not fair! (Score:5, Funny)
I hereby demand that everyone only look for security flaws the week before the scheduled security update so that Microsoft can continue to claim it patches all their flaws in a timely manner!
Re:But thats not fair! (Score:2)
Re:But thats not fair! (Score:5, Insightful)
This seems akin to scheduling firefighter visits every two weeks, and if your house catches fire in the meantime, being told to wait it out.
Re:But thats not fair! (Score:3, Interesting)
Re:But thats not fair! (Score:2)
Re:But thats not fair! (Score:3, Interesting)
The scheduling is meant for enterprises (Score:4, Informative)
Marketing... (Score:2, Interesting)
Re:But thats not fair! (Score:3, Insightful)
If a Prince is going to distribute benefits, be sure they are annoucned singly and prominently, no matter how trivial, to maximize their seeming importance. If a Prince will announce taxes or bad news, be sure to collect them into groups and hit the people al at once, so that each has lessend overall impact.
MS has no trouble telling you about new products and features, no matter what day or week of the month. Bu
Good for bidness (Score:5, Funny)
http://www.microsoft.com/windows/onecare/default.
Re:Good for bidness (Score:2, Informative)
Re:Good for bidness (Score:2)
they forgot to mention "patching all those OS holes so they can't be exploited by clicking on a random link in somebody's AIM profile"
IE is not a Browser (Score:4, Insightful)
Re:IE is not a Browser (Score:2)
Re:IE is not a Browser (Score:5, Funny)
Re:IE is not a Browser (Score:2)
I've been using Firefox since it was called Phoenix, but I don't really buy that argument.
While Internet Explorer is overly integrated into the operating system, the fact that your computer can access the internet means that your OS is on the internet too. Just that doing so with IE is believed to be more dangerious.
Re:IE is not a Browser (Score:2, Insightful)
At least with other browsers you can disable internet behaviour. IE runs with so many things open it's far from funny. Microsoft doesn't want to fix it, or it would be done.
Re:IE is not a Browser (Score:5, Insightful)
Although Windows has non-privileged user accounts, they are essentially useless. I tried to set up my mother and my daughter with these, and they were just a pain in the neck. So they, along with just about everybody else, run administrator-privilege accounts.
If I'm running as a non-privileged user, the most a javascript hack can do is mess up my account.
So for most Windows machines, any old application program (and Firefox is just any old application) is an open wound.
If Microsoft want to get serious about security, they'll have to change the run-as-administrator culture. To do this they'll have to:
(a) make it easy, and the default, to run
without privilege
(b) make it unpleasant to run with privilege
I won't bet on an attitude adjustment - from Microsoft or from Windows users - any time soon.
Re:IE is not a Browser (Score:5, Insightful)
It has been working OK, except for some thrid-party software. One example, Kodak's EasyShare. Everytime a user logs into their account, EasyShare puts up a modal dialog box stating that some features may not be available unless the user account is raised to admin privilege.
This causes two problems: I get questions about the presence of the dialog box, and I get questions about the missing features.
While it is often correct to blame Microsoft, Kodak is the problem in this instance, not Microsoft.
Re:admin privilege req'd (Score:5, Insightful)
If MS doesn't care about the problem (and these two examples are still present in the latest version without any apparent intention of being fixed), why should 3rd party software develpers care?
Re:admin privilege req'd (Score:2)
Re:admin privilege req'd (Score:5, Informative)
Re:IE is not a Browser (Score:2)
Of course Longhorn's not going to happen until the en
Re:IE is not a Browser (Score:2, Insightful)
The problem comes when one is trying to develop a serious web application that one expects customers to us
Re:IE is not a Browser (Score:3, Funny)
SP2 and Win2k3? (Score:4, Interesting)
Re:SP2 and Win2k3? (Score:3, Interesting)
If Microsoft would care about windows 98 users, they'd have backported some of the XP SP2 features (say, the popup blocker) to windows 98.
Of course they haven't done that (they need to encourage people to switch to SP2 and sell more SP2 licenses). Firefox is the best option for windows 98 users (and they still make 20-30% of the internet population), IE has no place for a windows 98 internet users. In XP maybe, but definitive
Poor choice of slogan (Score:5, Funny)
reminds me of the Simpsons scene where someone is reporting a crime via a radio and says "over" at the end of the transmission. then Wiggum says "thank god that's over". karma for the first person to find the quote, but I only have the real kind not the
Re:Poor choice of slogan (Score:5, Informative)
Chief Wiggum: Whew, thank God that's over. I was worried for a little bit.
Ok, now where is mar karma?
Other Winggum quotes here [thesimpsonsquotes.com].
Re:Poor choice of slogan (Score:2)
The Known Flaws. (Score:5, Interesting)
Re:The Known Flaws. (Score:2)
A large window? (Score:4, Insightful)
I happen to know for certain that Mozilla was aware of the vulnerabilities to which you speak at least 10 days before they were publicly disclosed.
Take your head out of the sand and realize that there's more going on around you than meets the eye.
Re:A large window? (Score:2)
Most developers have a policy one way or the other on it.
I tend to prefer to give them some time to attempt a patch before disclosures, and 10 days is rather fair.
It beats the alternatives of either instant disclosure and allowing the black hats
a good head start on exploits
Re:A large window? (Score:2)
Simple solution: restricted user for browsing (Score:4, Interesting)
Re:Simple solution: restricted user for browsing (Score:3, Insightful)
Re:Simple solution: restricted user for browsing (Score:2)
All desktop and server Linux distros should have ACL support by default, which would make it easier to limit access in special cases like this. That is,
Re:Simple solution: restricted user for browsing (Score:3, Funny)
Ineffective and impossible. (Score:5, Insightful)
It's hard enough to get any of the browser teams to commit to implementing a complete sandbox, even though that could be done without inconveniencing the users.
It's hard enough to get users to adjust the sandbox that they're already using so that it's as complete as possible, even though doing so imposes very little invenvenience.
Getting users to go through a lot of inconvenience to create a new account to run their browser in, that's really tough.
But even if you could do it, it wouldn't be effective.
A restricted account could still be used to compromise their privacy, it could still be used to destroy data they consider important... their bookmarks, information maintained on websites they connect to, and so on.
And that's assuming it would remain restricted: once I can run native code on your machine, getting out of a restricted environment is just a matter of time. It's easiest on Windows, of course, but even your typical UNIX or Mac OS X box has all kinds of mechanisms that a restricted account can use to extract information from your "real" account, or launch code (directly or through a boobytrap) into the "real" environment.
The only "restricted environments" I have used that I would consider secure enough to not treat malware running in that account as an immediate threat, apart from physically separate boxes, are FreeBSD Jails or completely emulated systems (VMware, Virtual PC, etc).
But we do know one thing that does work very well. And that's having a sandbox that has no holes in its design. That means there's no holes that the developer's reluctant to close, and no holes that users are reluctant to see closed. That means that any holes that do occur are bugs, and as such can be quickly fixed without embarassment and without discouraging users from applying them.
It's not perfect, but it works much better than a whole sandboxed account, and it's much easier to implement and MUCH more convenient.
So: the first absolute requirement for building a secure web is for the browser manufacturers to commit to a completely closed sandbox. That means there is no mechanism inside the sandbox to get outside the sandbox even as far as to see information stored about other websites. That means: no XPI installers, no ActiveX or Active Scripting, no "open safe files after download", no use of "Desktop" applications to open documents (even if you think the document is local), nothing. Any application you hand off a document to has to be one that has an equal commitment to maintaining that sandbox. If the user wants to do anything like that, they have to explicitly download the document and so move it outside the sandbox, and THEN explicitly open it in the unsandboxed environment. Those two steps must never be shortchanged.
What does that mean to the user, then?
Not much, in most cases. For Firefox users that means they'll have to download XPI files and then load them from the menu or their desktop file manager. For Safari users, no more "open safe files", and no more warnings the first time they open an app because the browser won't ever be opening apps behind their back. For Windows, there would be a bigger impact: a few tools like Software Update would be separate applications, but the bigger impact is that some third-party applications would need to be redesigned to use the new safe API.
Windows, I can see their reluctance. The rest? I don't get it... they're not gaining all that much by having a leaky sandbox, and the fact that even such small leaks can be exploited is sure a good argument for having at the very least no designed-in holes at all.
Lets take them down hard.. (Score:4, Funny)
Tech team: 349 that we know of, SIR!
BG: Good. All critical?
Tech team: ALL CRITICAL, SIR! YES SIR!
BG: Good. Hey PR team, take the first 10 of them, contact some security firm and 'leak' them.
PR: YES SIR!
BG: Now we will see what firefox is going to do about this.
(Evil laugh all around)
Not just one! (Score:4, Informative)
The oldest one is 60 days old now and still not fixed.
Is MSIE addictive? (Score:2, Funny)
Re:Is MSIE addictive? (Score:2, Insightful)
OOOOLLLLDDD News (Score:4, Informative)
'Mozilla 1.0.3 vulnerabilities'
That would be Firefox 1.0.3.... Mozilla Suite aka just mozilla and FireFox are two separate programs and have very different versions. Saying Mozilla 1.0.3 is very misleading. Please use the correct name or it makes your news story look very silly. Who cares if a version of mozilla from 2002 [archive.org] has security holes.
</rant>
Possible Wishful Thinking, But... Is IE Pointless? (Score:5, Interesting)
To my naive eyes, it seems that IE is more trouble than it's worth. It's earlier bugginess puts a weight on later development to duplicate previous rendering errors, and it is strongly challenged by Opera, Mozilla, and the like. Also, their developers have to take care not to break compatiability too much - or at least, to sort out how to get various plugins to work with newer versions. The whole thing is a running sore with regards to their reputation, and the number of idiots running the browser means everything has to be dumbed down.
It seems that the wise thing for Microsoft to do, simply from a selfish level, is to ditch the IE project. Open source what can be open sourced, develop a light, secure, bare-bones and idiot-proof version for bundling with their OS, and re-dedicate their resources elsewhere.
Internet Explorer has no future.
Re:Possible Wishful Thinking, But... Is IE Pointle (Score:2)
Time for the season finale... (Score:4, Funny)
*cue music*
... Timing! (Score:3, Funny)
Note to security companies: Schedule your next flaw announcements on June 15.
Yes, everyone on the same date.
Re:"Nothing for you to see here. Please move along (Score:4, Insightful)
The linked article with the flaws is about as useful as lipstick on a pig. So even when there's something to see there's still nothing to see. I think there's some Taoist wisdom in there somewhere.
Re:"Nothing for you to see here. Please move along (Score:3, Insightful)
Re:"Nothing for you to see here. Please move along (Score:3, Interesting)
But to say there is nothing to discuss in quite disengenous. What needs to be discussed is why these holes continue to exist in MS products.
Re:"Nothing for you to see here. Please move along (Score:2)
I eagerly await you reponse. Because that is the information I would like to have and feel the need to have in order to discuss them. Without that information we're left to make assumptions.
Re:"Nothing for you to see here. Please move along (Score:3, Informative)
He said Microsoft was alerted to the first vulnerability March 16.
That bug was found in default installations of IE and Outlook and could allow malicious code to be executed, contingent upon minimal user interaction, he explained.
Default install problem. Minimal user interaction.
According to security alert aggregator Secunia, more than 30 percent of the security holes found in IE remain unpatched.
Re:Funny how the emphasize (Score:5, Insightful)
ALL of the Firefox exploits lately? In the last two years there have been 17 reported Firefox vulnerabilities and 81 reported Internet Explorer vulnerabilities. The browser with the most recent, critical vulnerability is Internet Explorer. Do tell, where does the spotlight belong?
You can't compare like that (Score:3, Informative)
You must also look at the number and criticality of currently exploitable bugs, and the typical speed of the vendor's response.
In Secunia's own words:
Please Note. The statistics below should not be used for a direct comparison of how secure two different products are. This is partly due to the fact that a Secunia advisory often cover multiple vul
Re:You can't compare like that (Score:3, Insightful)
To do a proper comparison, you should rate each individual vulnerability, based on: how critical its is, if there was an exploit released, how long it took to patch, etc.
Just saying 81 > 17 is not an accurate comparison at all. How do you know that the 81 vulnerabilities in IE weren't all very minor things? Have you checked? Adding in a fudge factor doesn't make up for not knowing the facts.
Also IE has been around for a lot longer so of course there has been more time to find more exploits.
Re:Funny how the emphasize (Score:5, Insightful)
People just don't bother with minor problems in IE -- on the other hand, there is much vested interest in digging every smallest issue in Firefox, and dragging it into the press.
Re:Funny how the emphasize (Score:2)
"LATELY" not FOREVER. The rise of Firefoxs popularity has seen the increase of exploits and vulns. Read, dont translate.
You'd do well to take your own advice. The author wrote of taking the spotlight off all the Firefox exploits lately, implying there have been more for Firefox than Internet Explorer. For what period has that been true?
Re:Funny how they emphasize (Score:3, Interesting)
No, it hasn't. The rate of flaw discoveries in Mozilla's applications (Firefox included) has remained statistically level since before Firefox was called "Phoenix." Quite obviously, the Mozilla Foundation's marketshare has not remained steady since then, as you argue.
Security through obscurity doesn't work. It is a fundamentally flawed concept, which I would've thought Slashdotters realized. To suggest that an open-source project like Firefox doesn't know that is simply absurd.
The rapid response of
Please tell me you don't write code. (Score:5, Insightful)
By your logic, a program written by a first year student who didn't pay any attention to any security would have as many flaws discovered as a program written by an expert who tested for vulnerabilities
As long as both of them had the same number of users.
In other words, the flaws aren't errors in code writing, the flaws magically spaw when a certain number of people use it.
Re:Please tell me you don't write code. (Score:3, Funny)
Re:Funny how the emphasize (Score:2)
Well, you have to consider also that, Internet Explorer having somewhere in the range of 90% market share as opposed to under 7% market share for Mozilla, about 13 times as many vulnerabilities would logically be found...
Logically found? That's assuming all other things are equal, such as level of difficulty for discovering vulnerabilities in each. Clearly this is not the case. You can't go to the Internet Explorer home page and download its source code.
Re:Funny how the emphasize (Score:2)
Actually, I'd expect that each version of a piece of software has some finite number of vulnerabilities V, and I'd think that with a user base U that after an amount of time t you'd have found a number of exploits something like E = V(1 - exp(-a*U*t)), where "a" is some constant for that particular piece of software. Yes, I just pulled that out of my ass, but the point is that I'd expect diminishing returns with more users and time, since eventually you will have found all the easy to find vulnerabilities
Re:The remote exploit (Score:2, Funny)
My time is worth it.
Are you a lawyer?
No, NO. (Score:4, Funny)
Better yet, be thoughtful of screen-reader users, and make it a static list [w3.org] that has scrolling abilities [w3.org].
Well, it's not that complex. (Score:4, Interesting)
And now, let's look at the next quote. So what's the administrator thinking on this one? It's pretty simple: "Okay, so now this damnable embedded application, this junk browser that has to be on my operating systems, isn't gonna be patched for a month? The way they did it before would have been acceptable if I could patch the application without worrying about it breaking the OS or making me reboot. But NEITHER of these patching methods works well for me. I've either gotta patch applications that might destabilize my systems all the time, or I've gotta give hackers the keys to my network for a month!"
So, while the point you're trying to make - i.e., that neither of the upgrading options Microsoft has provided are acceptable to admins - is a valid one, it's a situation Microsoft brought on themselves.