Microsoft Flip-Flops On URI Protocol Handing Flaw 126
a-twitter writes "After months of insisting there is nothing to patch, Microsoft has done a complete 180 on the URI protocol handling vulnerability, announcing in a security advisory that a Windows update will be released to revise URI handling code within ShellExecute() to be more strict. The MSRC blog explains the background and offers more details on this issue."
like a dervish, they are (Score:5, Funny)
If it took them that many months, it sounds like they did a 1260.
Re:like a dervish, they are (Score:4, Funny)
And here I'm still saving to buy the 360...
Sigh...
Re:like a dervish, they are (Score:4, Funny)
Re: (Score:1, Interesting)
But, you can still buy a disposable 360 once a monthfor five years, for less than half the price of a single PS3!
Re: (Score:2, Funny)
True enough, but will my glow-stick and cereal box be repaired under an extended warranty [xbox.com] when it inevitably falls apart, or I add milk to the contents?
I don't think Mr. Kelloggs will be forthcoming...
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Good. (Score:5, Insightful)
Re: (Score:3, Insightful)
Who's gonna be held accountable for that?
Re:Good. (Score:4, Funny)
Re:Good. (Score:4, Informative)
Re: (Score:3, Insightful)
Re:Good. (Score:5, Interesting)
Be afraid. Be very afraid.
[1] OB
Only a problem if you omit the http: (Score:3, Informative)
Visiting www.slashdot.org [slashdot.org] is broken
Visiting http://www.slashdot.org/ [slashdot.org] works fine
IE seems to store the http: in favorites etc., so it's not much of a problem.
Also it doesn't affect Firefox so almost nobody will notice.
Re: (Score:3, Informative)
www.slashdot.org is the name of a file in a location that IE searches for named shortcuts.
What IE is doing in this case is preferring an exact match over an autoguess.
The only arguement here is if IE should be searching the desktop for URL shortcuts, and considering how many people use their desktop in lieu of the favourites menu, I don't think that it's
Re:Fanboy Bullshit at it's Finest. (Score:5, Insightful)
You must have slept through that whole anti-trust thing, where the Federal government proved that M$ did everything in it's power to break Netscape.
Psst. Netscape is not a competitor to Windows. Never was.
MS cripples themselves when they try and lean on Windows to get IE, or Office, or Visual Studio more market share. But Windows itself -- well, there's been to date, what, four serious attempts at competting with MS, and they haven't even managed to get half the market between them?
BeOS, UNIX et al, OS/2, and the Mac. All told, maybe 30% of the worldwide userbase. Microsoft is doing something right -- or else the "here, you can have this for free" crowd is doing something even worse than MS.
Re: (Score:2, Insightful)
Psst. Netscape is not a competitor to Windows. Never was...
MS cripples themselves when they try and lean on Windows...
Well, the grandparent never said that Netscape was a competitor to Windows, but it sure was a competitor with Internet Explorer. Considering that Internet Explorer completely crushed Netscape due to it being free and bundled with Windows (and, eventually, a better product), I think that Microsoft's plan of leaning on their Windows dominance to sell their other products seems like a pretty successful one. Of course, of these, only IE is "bundled". For Office and Visual Studio, it's really a two-way stre
Re: (Score:1)
Unfortunately, the thing they're doing right is wrong (they're a monopoly, remember?)
Re: (Score:2, Insightful)
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Firefox? (Score:1, Troll)
Did you really say and believe that? Congratulations, you have outdone M$ themselves. Let's review:
How is that Firefox again? Yes, I saw in the recap where "MSRCTEAM" mentions their previous friendly blame cast, I mean "advice", to the Firefox team. Can you tell me how that intersects reality again?
Re: (Score:1, Informative)
But it was still Firefox that installed the vulnerability. Without Firefox, NOTHING was vulnerable.
So, yes, they're fixing Firefox's bug.
Re:Firefox? (Score:4, Informative)
Rubbish.
There's a whole shopping list of apps, including IE7 [secunia.com] itself that were exposed to this vulnerability. Firefox was just the first to be accused.
Microsoft's only changed it's tune because Adobe's on the case with the Acrobat vulnerability. It's one thing to force a FOSS competitor to unnecessarily patch, but they'll have no luck with trying to force Adobe to fix every PDF reader out there.
Re:Firefox? (Score:5, Informative)
The mistake made by the GP (and potentially yourself, as you refer to the "blame cast" with the Firefox team which from memory only occurred with the issue in June with a malicious URIs terminating the quoted string and including Chrome parameters) is that they assume the second option is the one which is being fixed. It is not. This will potentially still be a problem if applications don't continue to validate their URIs appropriately, as Windows doesn't know exactly what your application does to escape quotes.
One of these is a vulnerability. The other is third party applications violating a basic tenet of development (no input is trusted).
Re: (Score:2, Informative)
OK, let's break down the steps to executing a program here. Now, I know Microsoft has their way of doing it, but really, it's exactly the same fucking thing with the same fucking array of arguments as parameters to the main function.
1) program A decides it wants to run program B with some arguments
2) program A assembles the argument list, and selects a member of t
Re: (Score:2)
What's exec()? Windows has ShellExecute(). ShellExecute for parameters accepts a single blind string. With this string, it passes it straight to an app to decide how it wants to interpret it. In your example, it's because it doesn't need to escape quotes to open "C:\Program Files\Somewhere" - which is good, because it has no idea how your application escapes quotes anyway. Does it use C syntax? Does it use BASIC syntax? Does it use Pascal syntax? Since it doesn't know these, i
Re: (Score:3, Insightful)
OT: Your last blog entry (Score:2)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Be liberal in what you accept and strict in what you emit.
Re: (Score:2)
which is good, because it has no idea how your application escapes quotes anyway.
Well, for a filename (your "C:\Program Files\somewhere" example is not a URL), this issue is mitigated by the fact that filenames cannot contain quotes.
It would not, though, be out of line for applications passing URLs into shellexec to escape quotes (at the very least, double quotes) with URI escaping syntax, in order to guarantee that _they_ do not contain quotes. They should already be escaping spaces, anyway, so this shouldn't have happened regardless
Re: (Score:1)
Re: (Score:1, Flamebait)
And?
"M$" has modified the way it works, which does not mean it's "mistaken". And these are not URLs, they're URIs passed to registered moniker handlers. You don't even know what you're talking about, do you?
They registered a handler with the shell. If they hadn't do
Re: (Score:3, Interesting)
Yes it does.
This is from the Technet mea culpa blog posting by MSRC's Jonathan.
With Internet Explorer 7 installed, the flow is a bit different. IE7 began to do more validation up front to reject malformed URI's. When this malformed URI with a % was rejected by IE7, ShellExecute() tries to "fix up" the URI to be usable. During this process, the URI is not safely handled. IE7 rejects the URI, and on Windows Vista ShellExecute() gracefully rejects the URI. That's not the case on the older versions of Windows like Windows XP and Windows Server 2003 when IE7 is installed.
Spin the facts as much as you like here, but anyone with a clue knows it is Microsoft's vulnerability. That's why they're the only ones who can fix it.
Re: (Score:2)
Most people (yourself included, apparently) don't understand that this is a two-way street. Microsoft can fix errors in their code, but they can do fuck all about what Firefox or Adobe Reader do with the input passed to them. But then it's so much fun to spin that part, isn't it?
Re: (Score:1)
Which platforms does this vulnerability exist on?
Why aren't Firefox, mIRC, Adobe Acrobat, Outlook Express, Outlook 2000 and others vulnerable when they're installed on Linux? On Windows without IE7? On a Mac? Why didn't the vulnerability exist until IE7 was installed?
Your bosses have accepted it's their problem. Why don't you?
Re: (Score:2)
Ooooh, that's so clever. Well, that does it for me. I won't bother you anymore, since surely there are other minions of the evil empire you must do battle with?
Good luck!
Re: (Score:2)
Why aren't Firefox, mIRC, Adobe Acrobat, Outlook Express, Outlook 2000 and others vulnerable when they're installed on Linux? On Windows without IE7? On a Mac? Why didn't the vulnerability exist until IE7 was installed?
Well, if you didn't have a computer, then it wouldn't be a problem at all, so I guess it's Charles Babbage's fault. Then again, if he wasn't born, it still wouldn't have happened, so it's his parents fault. I guess also if the Earth didn't exist, then it's the fault of either your chosen deity or science, depending.
Just because a problem can't exist without something else, it doesn't mean it's their fault. Here we go, car analogy - someone smashes into the side of your car and injures you. Once out of hosp
Re: (Score:1)
Re: (Score:2)
Microsoft has been a destroyer of standards, rather than a builder of standards.
You must be new here. They're only doing what titans in the computer industry have done in the past. IBM (with OS 360), DEC (with VMS), etc.
...
Standards have traditionally been whoever has the largest market share. They may change from vendor to vendor, but it has always been this way. Always.
Sigh. When I went through college, there were no computer majors, but now it definitely seems time that there should be computer history majors
Where's the logic? (Score:2)
Re: (Score:2)
Re: (Score:1)
The Point: They're Still Missing It. (Score:5, Insightful)
> For traditionally "safe" protocols like mailto: or http:
And that's where my co-workers heard the cry of "You dumb motherfuckers".
It's been a few years since Microsoft boxes were out-of-the-box exploitable through anything other than rendering HTML content from either a web page or from within an email client.
While the planet is grateful for the lack of uPnP and DCOM/RPC worms of late, it also means that "things that have to do with email or web browsing" are among the least safe things you can ask a computer to do.
If you're at Microsoft, and you still think of "http://" as "safe", you're still part of the problem, not part of the solution.
Re:The Point: They're Still Missing It. (Score:5, Insightful)
And that's where my co-workers heard the cry of "You dumb motherfuckers".
Maybe you should have kept reading (or you're just quoting out of context to sensationalise):
And that's where my co-workers heard the cry of "You dumb motherfuckers".
It's pretty clear from context that the implication is other applications consider those prefixes as "traditionally safe", and not that Microsoft does.
Re: (Score:2)
Umm...no. Your interpretation, while literal, doesn't parse because applications have neither traditions nor opinions on safety, nor do they write themselves. When you expand the original sentence's subject appropriately, it reads like this:
Re: (Score:2)
Umm...no. Your interpretation, while literal, doesn't parse because applications have neither traditions nor opinions on safety, nor do they write themselves. When you expand the original sentence's subject appropriately, it reads like this:
And when you expand my sentence appropriately, you get:
At that point, it re
Re: (Score:3, Insightful)
While the planet is grateful for the lack of uPnP and DCOM/RPC worms of late, it also means that "things that have to do with email or web browsing" are among the least safe things you can ask a computer to do.
Which is really ridiculous, that normal users have come to expect (or should expect) that there are exploit-ridden websites which you should never visit, or else your system may get exploited and spyware/other crap gets installed behind the user's back.
One could pass a web-server ANYTHING as a URI, and the server basically returns you a 'page', consisting of a number of elements which are then rendered for your viewing pleasure. From a conceptual point of view, that's pretty much a READ action, and
Re:The Point: They're Still Missing It. (Score:4, Insightful)
Personally I'd point the finger at the idea of using ShellExecute on inadequately filtered data from the Internet.
Re: (Score:1, Troll)
Re: (Score:2)
Damn you, Microsoft. (Score:2, Insightful)
Re: (Score:2)
The "New" Microsoft (Score:3, Funny)
Simple (Score:4, Interesting)
Re: (Score:2)
That would work if you didn't have to make an exception for the Outlook Web Access Client for exchange. That has all sorts of invalid URL's in it that should never be accepted by a web browser.
Worst thing Netscape and Microsoft ever did is allow their browsers to render
Re: (Score:1)
Re: (Score:2)
I cannot remember what the issue is exactly but it has (had? I have been mercifully spared from exchange 2005) to do with % signs in email subjects or file names.
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
IE isn't a web browser. It's a quasi-web browser. The second Microsoft chose to leverage non-standard features in disregard to how it would cripple the platform-independent design of the web, IE became a quasi-web browser. Of course, one could argue that most "web browsers" fall into that category (Netscape, Firefox, Opera, etc all adding-on Java, Flash plug-ins, etc). At that point, though, one can rational argue that each quasi-web browser falls into its own category, so the
My Flaw (Score:2)
My flaw is much more personal
Pay attention (Score:5, Informative)
Re:Pay attention (Score:5, Interesting)
Though I can't think of a reason why Microsoft would WANT to fix a problem in Firefox, unless IE's market share has dropped below 1% ;-)
Re: (Score:3, Insightful)
So uhmm what was the point of this post at all? Anyone in Microsoft's position wouldn't want to fix their competitors' software, it being OSS or not.
Firefox isn't just a browser competing to IE on Windows. It's a browser on Windows that works the same on Mac and Linux. That's horrible for MS as the browser becomes th
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Nothing new here (Score:2, Interesting)
Re: (Score:2)
Welcome to reality. If you made a mail daemon that worked according to spec nobody would be able to use it.
If you saw the errors in SSL browsers ignoered just to they look like they're working you'd shit.
Did the submitter read the links they included? (Score:4, Informative)
1) an exploit in firefox URI protocol handler
2) an exploit related to how explorer handles rejected URIs from IE7 on XP/Win2k3
Apparently the submitter isn't able to differentiate #2 from #1.
The advisory is for item #2. Item #2 is going to get fixed. The advisory does not cover item #1. Item #1 will need to be fixed in the protocol handler itself.
Re: (Score:3, Informative)
Summary is wrong (Score:1)
Whole thing reminds me of PHP XSS attacks... (Score:2)
This is the exact same situation. There are problems with un-escaped data and Microsoft doesn't want to bother much like the PHP team did before they changed their minds about the situation.
The only difference here is the way the code executes. I personally think it's not Microsoft's fault but they should fix it anyway.
Re: (Score:2)
Is it PHP's fault that people don't escape their data before executing MySQL statements? No. Still it's such a wide problem that PHP is now going to escape all data in later versions of PHP.
wtf does "escape all data" even mean? Data coming out of the database gets escaped? Data read in from files? Contents of string literals? Arguments to "echo"? How does it know whether to escape for SQL, for HTML [< etc], or for something else? magic? You put "XSS" in the subject line, yet talk about MySQL in the body, which have nothing to do with each other (hint: XSS attacks are usually caused when you actually WANT the other person to be able to write HTML generally, but fail to prevent them from
Re: (Score:2)
See www.php.net and look up mysql_real_escape_string() and pg_escape_string(). There are other functions for other purposes, but proper use of one of these two will save you lots of pain.
Re: (Score:2)
"Flip-Flops"? (Score:1)
Re: (Score:2)
It's a philosophical bug nonetheless.. (Score:1)
So who is guilty? Program A for allowing to pass those parameters? or Program B which doesn't sanitize input from other programs?
I'd say, both.
Hmmm.... and I was modded as Troll (Score:2)
My post:
"Is it really an Adobe vulnerability? Seems more like it's an IE vulnerability that has been blame-shifted to whoever writes the plugins that might expose it for what it is."
Replies:
"From what I understand, and there isn't much in the way of technical details available, this is not an IE flaw. IE, correctly, doesn't assume that a URI is invalid just because it looks odd. This is correct, because there is no way IE can kn
What, me worry? (Score:1)
Re: (Score:1)
Few weeks later..
The company says "We have discovered an issue with bla bla bla, please visit bla bla bla to get the update".
The terms `flip-flop` and `Microsoft` together? (Score:2)
Usually, the terms `flip-flop` and `Microsoft` together in a sentence bring out the MS-bashers and Linux advocates. But to be frank, this is a good thing for Microsoft to do. Their previous argument was pretty solid, because how are Microsoft to anticipate each and every URL registration made by a third-party application writer? Answer: they can't.
So by now admitting to plans to write a more strict handling routine for the shell URI interpreter, Microsoft is not kowtowing to pressure from the free mark