Microsoft zero-days said to target Office and Windows
Another Patch Tuesday marred
Hot on the heels of yesterday's batch of updates from Microsoft patching five critical Windows vulnerabilities come reports of new zero-day exploits, some that appear to allow the commandeering of a PC. They underscore a growing pattern in which miscreants release their payloads shortly before or after Patch Tuesday.
According to an entry on the McAfee Avert Labs blog, "several" attacks exploiting weaknesses in Office were released in security forums on Monday. Also making the rounds is proof-of-concept code that attacks Windows.
Two of the flaws - one in Office and the other in Windows - involve heap overflow flaws and appear to allow the execution of code on a victim's machine. The Windows POC targets the handling of .HLP files. McAfee didn't provide details on the Office flaws, except to say that all but one appeared to result in a pesky, but much less critical, denial of service.
Microsoft says it is investigating the reports and isn't aware of any customers being targeted by the flaws. It also reiterated an advisory deeming .HLP files as unsafe unless the user is assured they are not malicious.
Among others, yesterday's patch binge fixed flaws in Universal Plug and Play, Windows CSRSS, Microsoft Agent and Microsoft Content Management Server. It also repaired a bug in last week's emergency patch of a critical hole in the way Windows processed animated cursors. Both the cursor vulnerability and CSRSS patch affected Windows Vista, which Microsoft has called its most secure operating system ever.
The simultaneous release of the patches and new zero-days is most likely not by accident. Malicious hackers know Microsoft is reluctant to issue out-of-schedule updates, so timing the release of malware around Patch Tuesday helps ensure a longer shelf life for their precious zero-day exploits. Prior to yesterday's report, Office already suffered from at least two zero-day vulnerabilities, according to eEye Security's zero-day tracker.
According to McAfee, the tally of patches released to date this year well exceeds the number for this time in 2006. Which either means the software behemoth is getting better at identifying and repairing flaws or its security assurances are only so much hot air. ®
There are 9 Linux Kernel Security Advisories for 2007 so far - http://secunia.com/product/2719/?task=statistics_2007 - and 14 for Windows XP Pro (but that is all of Windows not just kernel - Windows do tend to more risk but then you usually have Anti-Virus which often migates the actual attacks)
As of 2003 there are "5,929,913" lines of code in the Linux Kernel 2.6 (if you believe wikipedia) - probably about 1000 thick paperback books - if you think you can get that error free and able to handle every possible situation it is placed into you are a better coder than I
RE: 6 years again
OK, John, even if I agree with everything you've said here, I would have to ask the question: How many of those Mandriva vulnerabilities are kernel-related, and how many are third-party packages? I'm not saying there are no kernel-related fixes. But the number of kernel-related fixes is certainly lower than the number of kernel-related fixes for WinXP every month.
My main point was that your system isn't very good if you're still finding bugs years later. And I don't limit my criticism to Windows, either. If versions of the Apple OS or Linux still contain bugs in the kernel after 3 or 6 years, then it wasn't designed properly. It's just that Windows seems especially poorly-coded when you consider the number of bugs already fixed.
Re: Insecure by Design
Sean Healey overlooks one really insecure design problem - the user. A large number of Windows PC that are compromised are either because they aren't patched or require a user to do some action they have been advised not to - such as send large cheques off to Nigeria. If Windows disappeared tomorrow - all these insecure users will be using something else and not patching them etc.