Microsoft confirms code execution bug in Windows
0days R Us
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Microsoft has confirmed reports that several versions of Windows are vulnerable to exploits that allow remote attackers to take full control of users' computers using booby-trapped emails and websites.
In an advisory issued Tuesday, Microsoft said it was investigating “new public reports” of vulnerability in the XP, Server 2003, Vista, and Server 2008 versions of Windows. In fact, the first known report of the bug in the way those operating systems process thumbnail images came on December 15 at a security conference in South Korea. On Tuesday, exploit code was added to the Metasploit software framework for hackers.
“This is a remote code execution vulnerability,” the Microsoft advisory stated. “An attacker who successfully exploited this vulnerability could take complete control of an affected system.”
The flaw resides in the Windows Graphics Rendering Engine and can be exploited when victims view a specially manipulated thumbnails on network-shared folders or drives or in online WebDAV-shared folders. It can also be targeted when email users open or preview Microsoft Word or PowerPoint files that contain the doctored images.
There are no known reports of attacks in the wild that exploit the vulnerability, and Windows 7 and Server 2008 R2 aren't susceptible.
“The vulnerability is exploited by setting the number of color indexes in the color table to a negative number,” Johannes Ullrich, chief research officer at the Sans Institute, blogged. Slides from the December 15 conference provide hints that the exploits can bypass security measures such as data execution prevention and safe exception handling, he added.
In a blog post, Microsoft Senior Marketing Communications Manager for Trustworthy Computing, Angela Gunn, said Microsoft was working on a patch, but that for the time being “the circumstances around the issue do not currently meet the criteria for an out-of-band release.” Microsoft's next patch release is scheduled for January 11, but it's highly unlikely a bug fix will be ready by then.
Workarounds include configuring Windows Access Control List to be more restrictive, which will interfere with the way the Graphics Rendering Engine displays media files.
The bug is at least the third unpatched vulnerability in a piece of Microsoft software. Two weeks ago, the company warned of a vulnerability in Internet Explorer that creates a means for hackers to inject malware onto vulnerable systems. On New Year's Day, security researcher Michal Zalewski disclosed a separate bug in the Microsoft browser that he believes also allows attackers to hijack user PCs. ®
COMMENTS
Repeat with me now...
The starting point for being secure is to reduce as much as possible your attack surface. The less entry points you expose, the better.
Moving the graphics driver to kernel space was done in W2000 in the name of performance. But was a very very bad security decision. It increased the attack surface by orders of magnitude. Same for that monstrosity of executing natively compiled code from your browser. Hello, ActiveX.
Windows has been, and will be, plagued with the consequences of those two decisions. If there is a ranking of bad software design decisions, those two should be at the top. There's not an easy way out of these, and Windows is likely to suffer forever from them, in the name of the sacred backwards compatibility.
One only hopes that those mistakes are not repeated elsewhere. Yes, Linux, I'm looking at you.
Windows Graphics Rendering Engine
How many times has a bug in the Graphics Rendering Engine allowed attackers to root the entire system? Why is this still possible!!?
I'm not a computer scientist, so correct me if I am wrong, but shouldn't the Graphics Rendering Engine run with ordinary user privileges?
“The vulnerability is exploited by setting the number of color indexes in the color table to a negative number,”
Do Microsoft not sanitise input? WTF?
"exploits can bypass security measures such as data execution prevention and safe exception handling"
So what is the point in these security measures that don't work?
Basic sanity checking
“The vulnerability is exploited by setting the number of color indexes in the color table to a negative number,”
Lets face it, colour indexes in a colour table are never negative values so what is the point in performing a check to see if such values are negative.
I was under the impression that some of the worlds best coders are employed by MS. Perhaps they let some 1st year student on a placement code the GRE.
Scroogle "Windows Graphics Rendering Engine". The search results speak volumes about MS' commitment to secure coding.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
