Microsoft Zero Day security holes being exploited

[Leythos]

[snipped most, as I agree with Roger]

Please, take the conspiracy theorist motivated part of this discussion
to alt dot something.

This thread should be about the present risks, workarounds, and
degrees of exposure in the wild - that is, keep to YOUR subject.

I don't think I've seen this stated better (all that you said, not just
want I kept) in thousands of posts I've read this weekend.

 

[Roger Abell [MVP]]

Microsoft Zero Day security holes being exploited

"Microsoft has issued warnings about a serious flaw in Internet Explorer
that allows attackers to hijack a PC via the popular browser

[snip]

Workaround:
regsvr32 -u "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll"
I've done that and tested successfully (see below).

A non-Microsoft fix: <http://isotf.org/zert/download.htm>.

To test, see (at your own risk) <http://www.isotf.org/zert/testvml.htm>.

Nice job...

Actually, it is not that good to the world however.

regsvr32 -u "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll"
which is the first workaround mentioned in the MS advisory,
may fail in some locales.

As Jesper (and others) have indicated,
it should use %CommonProgramFiles%
http://msinfluentials.com/blogs/jes...Block-VML-Zero_2D00_Day-Vuln-on-a-domain.aspx
http://tinyurl.com/mtcbd
<quote>
Update Sept. 21, 2006
Uploaded a new version of the archive that uses %CommonProgramFiles%
instead of %ProgramFiles%\Common Files to specify the file location.
This helps make it work on non-English systems that have translated the
name of the Common Files directory.
</quote>

Those interested should see his Friday's blog that not only discusses the
third-party patch route, but also outlines another approach to the current
(and the Direct Animation control's path) vulnerabiltiy
http://msinfluentials.com/blogs/jes...gainst-the-VML-vulnerability-on-a-domain.aspx
http://tinyurl.com/h3buq

 

[imhotep]

If you are a skilled car driver why would you choose to use only an
inferior, cheaply made, sardine tin of an auto that could not meet the
safety standards of many governments of the day ?

Why did safe sting classes come about?

Would you choose to go back to GO TO based programming?

Use of a language that enforces safe code is a good thing.

Remember Dijstra? The set of 4 constructs proved sufficient for
any general purpose language? Remember the arguably academic
language Pascal (Wirth?) designed to show this? Remember how
that ushered in a new era in programming and vastly simplified
software lifecycles?

Are you saying that languages designed to not allow major problems
plaguing the sofeware industry are worth naught ?

You surely do sound to be doing so.

Let's review some things. Ian replied by blaming the C language for security
vulnerabilities. To which I replied BS!!!!!!

A language does what the programmer tells it to do. If you tell the program
to do something stupid, it will. If you do not posses good programming
style or technique neither will your program. And if there is a security
vulnerability in the software it is the programmers fault. Inept
programmers will always try to blame someone or something else. After all
it is much easier to blame someone else, or something else, than to admit
you are crappy programmer....

Now you can try and spin anything you wish. However, it seems to me that
debating something so obvious as this only servers to make you look
foolish. But by all means go ahead....

Imhotep

 

[imhotep]

Microsoft Zero Day security holes being exploited

"Microsoft has issued warnings about a serious flaw in Internet Explorer
that allows attackers to hijack a PC via the popular browser
[snip]

Workaround:
regsvr32 -u "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll"
I've done that and tested successfully (see below).

A non-Microsoft fix: <http://isotf.org/zert/download.htm>.

To test, see (at your own risk) <http://www.isotf.org/zert/testvml.htm>.

Nice job...

Actually, it is not that good to the world however.

regsvr32 -u "%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll"
which is the first workaround mentioned in the MS advisory,
may fail in some locales.

As Jesper (and others) have indicated,
it should use %CommonProgramFiles%
http://msinfluentials.com/blogs/jes...Block-VML-Zero_2D00_Day-Vuln-on-a-domain.aspx
http://tinyurl.com/mtcbd
<quote>
Update Sept. 21, 2006
Uploaded a new version of the archive that uses %CommonProgramFiles%
instead of %ProgramFiles%\Common Files to specify the file location.
This helps make it work on non-English systems that have translated the
name of the Common Files directory.
</quote>

Those interested should see his Friday's blog that not only discusses the
third-party patch route, but also outlines another approach to the current
(and the Direct Animation control's path) vulnerabiltiy
http://msinfluentials.com/blogs/jes...gainst-the-VML-vulnerability-on-a-domain.aspx
http://tinyurl.com/h3buq

I will pass this along to the helpdesk guys. Thanks.

Any ETA about the patch/fix from Microsoft?

Imhotep

 

[imhotep]

Enough of this Im.
It IS off-topic.

Besides, contrary to your claim Karl DID answer you.

In my initial post I also indicated this fact of life to you.

But, here goes again, one last time.

An impacted piece of code has a dependency tree, and test coverage
must be directed by that.

When a piece of code has few uses, and especially when those uses
are not complex relative to internationalization, regression testing is
a much smaller task.

When a code is a general library, the dependency tree itself can be
difficult to determine, and coverage testing larger and hence longer.

You have a comp sci background so I would assume you can see
those facts quite clearly (should you decide to).

But, this part I feel you have no real clue about, especially if the code
can impact visual renderings, then the internationalization becomes a
very real part of testing. Once a code change might start changing the
sizes of things it can start changing them differently in the 45 or so
supported locales, and there are a lot of interfaces that need to have
designed sufficiently for the possible size changes.

Please, take the conspiracy theorist motivated part of this discussion
to alt dot something.

This thread should be about the present risks, workarounds, and
degrees of exposure in the wild - that is, keep to YOUR subject.

Regards,
Roger

The Simple question that has NOT been answered:

Now, you claimed to have answered the question but you did not. You
identified, and correctly so, the steps it takes to make a patch and test
the patch. The DRM patch had to go through the same tests. It was done in 3
days. Why can't this one. How about a week?

Now, you might use the excuse of complexity. OK, I will give you a little
room there. However, this patch is most critically needed and releasing it
some 45 days later does not seem proportional when compared to the DRM
patch...

There are no conspiracy theories here. However, it is becoming clear, that
Microsoft takes DRM more seriously than it's users security.

-- Imhotep

 

[imhotep]

[snipped most, as I agree with Roger]

Please, take the conspiracy theorist motivated part of this discussion
to alt dot something.

This thread should be about the present risks, workarounds, and
degrees of exposure in the wild - that is, keep to YOUR subject.

I don't think I've seen this stated better (all that you said, not just
want I kept) in thousands of posts I've read this weekend.

Sure. However, you can not deny that it would be nice to have a patch out in
days instead of months....we know they can do it, they have in the past...

Imhotep

 

[imhotep]

From: "Roger Abell [MVP]" <[email protected]>

< snip >

| Please, take the conspiracy theorist motivated part of this discussion
| to alt dot something.
|
| This thread should be about the present risks, workarounds, and
| degrees of exposure in the wild - that is, keep to YOUR subject.
|
| Regards,
| Roger
|

I totally agree.

Sure. And sorry about that. It's just that this sort of thing is all to
common in the Microsoft Word and even getting worse....when is it going to
stop? The Worlds richest software company can't get more resources to put
patches out in a timely manner? That is just down right sad.

Again, if this happened once-and-a-while, so be it. But it has become all to
common....

Imhotep

 

[Leythos]

[snipped most, as I agree with Roger]

Please, take the conspiracy theorist motivated part of this discussion
to alt dot something.

This thread should be about the present risks, workarounds, and
degrees of exposure in the wild - that is, keep to YOUR subject.

I don't think I've seen this stated better (all that you said, not just
want I kept) in thousands of posts I've read this weekend.

Sure. However, you can not deny that it would be nice to have a patch out in
days instead of months....we know they can do it, they have in the past...

I think you misunderstand regression testing and proper QA methods. If I
want to patch a program that does not interact with any other programs,
then I only need to test the program. If I want to patch a interface,
something that interacts with many programs and services, it means that
I have to regression test all interconnected parts.

MS has no reason to lag in pushing out patches or fixes, they do it as
quickly as possible with the least risk they can manage to end-users.

 

[imhotep]

[snipped most, as I agree with Roger]
Please, take the conspiracy theorist motivated part of this
discussion to alt dot something.

This thread should be about the present risks, workarounds, and
degrees of exposure in the wild - that is, keep to YOUR subject.

I don't think I've seen this stated better (all that you said, not just
want I kept) in thousands of posts I've read this weekend.

Sure. However, you can not deny that it would be nice to have a patch out
in days instead of months....we know they can do it, they have in the
past...

I think you misunderstand regression testing and proper QA methods. If I
want to patch a program that does not interact with any other programs,
then I only need to test the program. If I want to patch a interface,
something that interacts with many programs and services, it means that
I have to regression test all interconnected parts.

MS has no reason to lag in pushing out patches or fixes, they do it as
quickly as possible with the least risk they can manage to end-users.

Not at all. I understand regression testing quite well. You know as well as
I QA testing does not need to be done in a serial fashion. Indeed, most QA
testing can be, and usually is, done in parallel...and often is automated.

The problem I have is the time to patch. Just when you think Microsoft is
getting their crap together by releasing a patch for the DRM security hole
in three days (same testing and QA processes apply) they drop the ball
again by pretty much saying that it will be 45 days for this Outlook/IE
security vulnerability....

The idea that Microsoft is allowing it's users to be unsafe for so long is
inexcusable. Why is it that everyone else can release timely patches but
Microsoft can't. Damn, even open source has a much better time to patch
than Microsoft. The average time to patch for Linux is a couple of days.
And it is free...

So why can;t Microsoft get their sh$t together??? It is not a lack of
money...

 

[Stephen Howe]

PS. can you not control your newreader and its use of followups?

Why can't you prune the conversation to what is relevant?
Too difficult for you?
Must you quote everything?

Stephen Howe

 

[Stephen Howe]

Think we'll only achieve secure computing when C is dropped in favour of a
better language. The list of buffer-overflow exploits in every single
major
software-package gets monotonous.

Your right in one sense. What I don't understand is with MS's trustworthy
programming initiative, why havent they visited all Windows APIs and proofed
them by now? MS 's approach seems reactionary not pro-active.

And note, I don't regard C as inheritently unsafe - it is just it requires
programmer discipline.

Stephen Howe

 

[Leythos]

The idea that Microsoft is allowing it's users to be unsafe for so long is
inexcusable. Why is it that everyone else can release timely patches but
Microsoft can't. Damn, even open source has a much better time to patch
than Microsoft. The average time to patch for Linux is a couple of days.
And it is free...

Your thinking is flawed - most OS vendors don't release patches quickly.
Most of them come out with a workaround until they can get their patches
out after testing. Follow the HP-UX group and see how long they take,
follow the MAC groups and see how long they take....

 

[Roger Abell [MVP]]

The Simple question that has NOT been answered:

Now, you claimed to have answered the question but you did not.

Sorry. I guess I cannot cure your blind spots.

ra

 

[Roger Abell [MVP]]

I will pass this along to the helpdesk guys. Thanks.

Any ETA about the patch/fix from Microsoft?

No, and I have not seen a reason to ask.

MS took the unusually step of detailing workarounds that
crippled functionality in their initial advirory. That was no
doubt in response to analysis showing code availability,
exploit character, and extent of testing that would be needed
(i.e. time to delivery). From that I fully trust resources were
marshalled in appropriate scale.

Typically the owning group of the involved code finishes its
work, which includes review for similar/related flaws, quite
quickly. For something like this, that could have impacts on
non-MS code, the test cycle is where the time gets consumed
(read: not all testing is in-house).

(You trapped me with that dumb follow-up once more !!)

 

[Guest]

I have to agree with Imhotep.

I have been thoroughly p****ed off this week as a result of a virus which
somehow evaded the countless security systems I have in place. In
retrospect, the 'vulnerability' is simply MS stupidity. Imagine allowing
WinLogon to to load arbitrary DLLs into its address space simply by adding
entries into the registry.

WinLogon is supposed to be my first line of defense against security issues.

What are they thinking ?

About money, obviously !

 

[imhotep]

No, and I have not seen a reason to ask.

Surely the critically merits promptness. Does it not?

MS took the unusually step of detailing workarounds that
crippled functionality in their initial advirory. That was no
doubt in response to analysis showing code availability,
exploit character, and extent of testing that would be needed
(i.e. time to delivery). From that I fully trust resources were
marshalled in appropriate scale.

Typically the owning group of the involved code finishes its
work, which includes review for similar/related flaws, quite
quickly. For something like this, that could have impacts on
non-MS code, the test cycle is where the time gets consumed
(read: not all testing is in-house).

(You trapped me with that dumb follow-up once more !!)

Asking if you knew of a ETA? Sorry, but I thought you actually might know.
No trapping this time....

 

[imhotep]

That's a really stupid argument and shows a total lack of understanding of
computer security. Security is risk management. First you assess risks,
and then either you accept a risk, or you mitigate a risk. I assessed the
risk, and backed up my assessment by noting the two next largest IE vulns
to
hit the media. Asking me to put out a monetary guarantee before you'll
accept the validity of my argument, with past examples, is just dumb.

No. What is dumb is making a guarantee that you *can't* back up. It is both
dumb and irresponsible...

And if you *really* knew computer security you would understand that risk
management is highly dependant on one's computer systems and the business
that runs on them. What you might call acceptable risk might not be for
someone else....now, not realizing that *is* dumb....

Suffice it to say that past IE vulns have always been widely overrated.

BS Propaganda! I guess their are no problems with spyware on Microsoft
platforms either? Hahahahaha

You're constantly coming here and saying that the sky is about to fall in,
and it never does. You're backing up your baseless panic with "what if"
and
"it could happen" statements. Security and risk assessment just don't
work that way, and for good reason.

On the contrary. I am saying that Microsoft has failed and is failing at
securing their systems (unless it is DRM related). Furthermore, Microsoft's
overall security seems to be getting worse.

I bet the organization where you work has accepted the risk of this
vulnerability, and is doing little to nothing, at least on the client
side,
to lessen the risk. That's a very common real world posture to these IE
vulns.

First, luckily we have not had a Microsoft server in years. The only
remaining Microsoft PCs are a couple of people who have not been converted
to Apple yet. The desktop guys went around and issued the temp fix, that
was listed on their site.

My company deals with large sums of money and security is paramount.

I already did.

No you did not. You, or some else here, tried to use the excuse of patch
management (QA proceedsure and steps). True QA is an important step.
However, the DRM patch *ALSO* went through the same procedures and was out
in 3 days. Please explain that...(this has been the unanswered question)

Without propaganda? That's what I should be demanding of you. A good
example of propaganda is when you said that Microsoft bases its patching
policy on laziness, greed and/or incompetence.

Nice try. Please answer my question above.


Imhotep

 

[Dan]

[snipped most, as I agree with Roger]
Please, take the conspiracy theorist motivated part of this discussion
to alt dot something.

This thread should be about the present risks, workarounds, and
degrees of exposure in the wild - that is, keep to YOUR subject.
I don't think I've seen this stated better (all that you said, not just
want I kept) in thousands of posts I've read this weekend.

Sure. However, you can not deny that it would be nice to have a patch out in
days instead of months....we know they can do it, they have in the past...

I think you misunderstand regression testing and proper QA methods. If I
want to patch a program that does not interact with any other programs,
then I only need to test the program. If I want to patch a interface,
something that interacts with many programs and services, it means that
I have to regression test all interconnected parts.

MS has no reason to lag in pushing out patches or fixes, they do it as
quickly as possible with the least risk they can manage to end-users.

Nice point and even then you get users with tons of posts to the
Microsoft update newsgroup about why the download did not work properly
and folks who suddenly say they hate Microsoft because they can't get
the patch to work right. Sure, Microsoft is not perfect but I feel they
do a darn good job supporting their user base.

 

[Dan]

I have to agree with Imhotep.

I have been thoroughly p****ed off this week as a result of a virus which
somehow evaded the countless security systems I have in place. In
retrospect, the 'vulnerability' is simply MS stupidity. Imagine allowing
WinLogon to to load arbitrary DLLs into its address space simply by adding
entries into the registry.

WinLogon is supposed to be my first line of defense against security issues.

What are they thinking ?

About money, obviously !

Possibly, but Microsoft is not the big evil cooperation that users
associate it to be. Microsoft does have some problems that are common
in a big company but they do try. For example, they had the security cd
for free that has been very help in countless 98SE machines that I service.

 

[Dan]

<snip>

It is interesting that the NT (New Technology) source code was
originally nicknamed the "Not There" source code since it did not have a
true maintenance operating system like the 9x had. Chris Quirke, MVP
can post more information on this because he knows about it extensively.
9x had DOS which was really nice because you could get down and dirty
and solve many problems with commands and it overcame the limitations of
fixing things that are inherent in GUI (Graphical User Interface). I
researched and read about this in a book about Microsoft's early
history. The actual base of 9x has a more secure and solid foundation
than NT.

Check this out for further information:

http://secunia.com/product/22/?task=advisories (XP Pro. -- critical extreme vulnerability)

http://secunia.com/product/16/?task=advisories (XP Home -- critical extreme vulnerability)

http://secunia.com/product/1/?task=advisories (2000 Professional -- critical extreme vulnerability)

http://secunia.com/product/13/?task=advisories (98 Second Edition -- only 3 less critical vulnerabilities)

Well, you people get the idea and all the garbage about XP being so
secure is just plain foolishness if people would just remove the
blinders from their eyes and see the truth then we would be getting
somewhere. BTW, I tri-boot with 98SE, XP Pro. and am testing Windows
Vista Ultimate 32 bit with glass "Aero" interface enabled.