New IE exploit for unpatched vuln

http://www.theregister.co.uk/2005/11/22/ie_exploit/

Quote:

---

Hackers have created a potent exploit for a six-month old vulnerability in Internet Explorer which was previously believed to be only a Denial of Service risk. A fresh exploit posted on computerterrorism.com proves that the security bug can be exploited to gain system access, even on systems running Windows XP with Service Pack 2. The flaw stems from a failure by IE to properly handle requests to the window() object.

Successful exploitation involves tricking a Windows user running IE into visiting a maliciously constructed website contain hostile JavaScript code. Users of both IE 5.5 and 6.x are potentially at risk. "Currently, the only way to protect against exploitation of this vulnerability is by disabling active scripting or by using another browser," said Thomas Kristensen, CTO of security notification firm Secunia.

Microsoft's holding statement on the issue can be found here.

---

http://www.microsoft.com/technet/sec...ry/911302.mspx

Quote:

---

This issue was originally publicly reported in May as being a stability issue that caused the browser to close. Since then, new information has been posted that indicates remote code execution could be possible. Microsoft is concerned that this new report of a vulnerability in Internet Explorer was not disclosed responsibly, potentially putting computer users at risk. We continue to encourage responsible disclosure of vulnerabilities. We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed.

---

Yeah.. it's all the evil hackers fault .. it's known for atleast 5 months and still unpatched :cool:

But then again any excuse will do for MicroSoft wouldn't it..
I mean they carn't say hey it's all our fault that our programmers are shiat.
Even though we knew about this vuln for so many months why not just blame it on those evil hackers...


i'm drunk were's that drunk thread at..

I will guarantee you that Microsoft will definetly blame it on the Hackers. Without the "evil Hackers" the World wouldn't know that this whole exists since six Months.

Yeh, this is slick: was only a DOS, now a remote code execution risk. sigh

For you Snort users, BleedingSnort posted a sig. I've deployed it...just note that even reading a news article or CVE link (http://www.cve.mitre.org/cgi-bin/cve...=CAN-2005-1790) about it will trigger an alert because of the regular expression it's using to detect window ( ).

http://www.bleedingsnort.com/cgi-bin...er?view=markup

I think that the term "vulnerability" is too widely abused.

"vulnerability
A weakness in system security procedures, system design, implementation, internal controls, etc., that could be exploited to violate system security policy."
- NCSC-TG-004 Glossary of Computer Security Terms

This for instance is not a vulnerability. Why not? Because there is no violation of the system's security policy. All this does is run code defined by an external entity (which the configuration allows) with the rights granted to it by the user.

Where is the vulnerability? How is the security policy violated?

This is simply a case of poor verification, in not determining if the security policy was adequently reflected in the system's security policy. That said, there is no violation and consequently no vulnerability.

cheers,

catch

Nice job, catch. You were much more -- ahem -- diplomatic than I may have been.

The exploit code was only just released, so Microsoft isn't trying to blame the "evil hackers." They are trying to encourage responsible disclosure. Had Microsoft had the opportunity to evaluate the exploit, they may have been able to more effectively address the issue.

As it is, the computerterrorism.com folks posted it and everyone has to react. Not the most desirable result. Check the links, all the updated dates indicate yesterday or today.

Hi catch

Quote:

---

Where is the vulnerability? How is the security policy violated?

---

Quote:

---

with the rights granted to it by the user

---

I think that you answered your own question there? :)

The "vulnerability" lies with the users rather than the system. In a way Microsoft are caught in a cleft stick? they dumb down their systems to maximise their revenue, and that makes them available to people who have little idea, and even less inclination to learn.

Quote:

---

This is simply a case of poor verification, in not determining if the security policy was adequently reflected in the system's security policy

---

That bit can be laid at Microsoft's door.

:)

Quote:

---

The "vulnerability" lies with the users rather than the system.

---

Exactly, the users failed to map the system's security policy to their own requirements.

Quote:

---

That bit can be laid at Microsoft's door.

---

I believe this is addressed in the same manner... to do otherwise is like blaming the auto maker for a car crash because the driver decided against using the breaks. Microsoft makes the tools availible, the user opted to not use them/use them correctly.

Microsoft provides a usable system. Individual system owners must determine their own security requirements, their failure to do so is exactly that... their failure.

I find it interesting that people how look to blame the OS for allowing the users to do dumb things are typically against the TCPA because it "takes away user choice".

People who blame the users for requiring a security that they choose to not implement are in favor of the TCPA because it simplifies and expands the security capabilities.

cheers,

catch

PS. Got a job for me yet Nihil? :D

Maybe I should talk to Microsoft, they advertise here... and I have been a voice of support for them here for years... prolly far more effective than some banners. ;)

Quote:

---

Originally posted here by Chickenpox2004
I will guarantee you that Microsoft will definetly blame it on the Hackers. Without the "evil Hackers" the World wouldn't know that this whole exists since six Months.

---

this is what we call NET ECOLOGY... :D

Quote:

---

Microsoft makes the tools availible, the user opted to not use them/use them correctly.

---

This is where I do criticise Microsoft. My reason is that I can show you old DOS and early Windows manuals that shipped with the software. They are actually quite comprehensive..............just compare them to what ships with Windows XP today. They can use the help system, I hear you say?...................err no, it is certainly not user friendly and would take a long time for a beginner to find their way around.

I take the view that if you are going to sell a product to idiots, you should at least have the decency to include an idiot's guide in the box. :) It is not really a question of Users opting to do anything, at the moment I do not believe that 90% of domestic users are aware that they have options.

Quote:

---

Microsoft provides a usable system. Individual system owners must determine their own security requirements, their failure to do so is exactly that... their failure.

---

In a corporate environment I would agree entirely, but the majority of problems are found in the domestic environment which is the virtual "biological reservoir" for scumware. I believe that MS have a duty of care to encourage users to think about it. On the contrary, however, MS have even pursued a policy of shipping software with everything "turned on" presumably to cut their helpdesk costs?

Hey, if you went into a local bar and asked Joe Public what he thought of IIS, he would probably freak out because he thought you meant IRS? :D

Unfortunately we live in a "domestic appliance" society...............people go to the electrical store, buy a tv, take it home, plug it in..............it AUTOTUNES and within a few minutes it is good to go. All they have to do after that is change the batteries in the remote? They look on computers in the same way.

OK, this will probably resolve itself in 20 years time because the next generation will all have had computer training. Right now, we have computer illiterates going out and buying them as if they were refrigerators?

Obviously, my comments are directed at the domestic market side of the industry.

Quote:

---

PS. Got a job for me yet Nihil?

---

I have sent a couple of e-mails to cronies in the South, will probably get some feedback early next week :)

Quote:

---

Originally posted here by nihil
I take the view that if you are going to sell a product to idiots, you should at least have the decency to include an idiot's guide in the box. :) It is not really a question of Users opting to do anything, at the moment I do not believe that 90% of domestic users are aware that they have options.
...
Unfortunately we live in a "domestic appliance" society...............people go to the electrical store, buy a tv, take it home, plug it in..............it AUTOTUNES and within a few minutes it is good to go. All they have to do after that is change the batteries in the remote? They look on computers in the same way.

---

You are dead on Nihil. I just recently had to spend a good deal of time convincing my brother-in-law to purchase and plug in a NAT router on his newly installed broadband cable Internet connection. He was complaining about spending $50 US and thought that having anti-virus installed was enough. He thought his computer (Windows 98 even) would protect itself. :eek:

Unfortunately this type of attitude is brought into work. Corporate workers also think that they can do anything (re.; click on attachment in email, download screensaver or clipart - infected with malware) because corporate IT security has got their back.

There almost needs to be a separate Windoze OS for home users that has additional security protections and protects users from stepping on their own reproductive-member. I believe at one point Microsoft was considering this approach.

Frustrating. Sigh.

Ok, I have a simple question as I have little knowledge (trying to learn, though) of administrating a network's security.

How do you protect against this sort of exploit (besides Snort, which would mearly catch the sploit in progress not stop it, if I understand correctly) when there is no patch out yet?

Do you block every website at the gateway and whitelist the websites necessary for work?

Quote:

---

I think that the term "vulnerability" is too widely abused.

"vulnerability
A weakness in system security procedures, system design, implementation, internal controls, etc., that could be exploited to violate system security policy."
- NCSC-TG-004 Glossary of Computer Security Terms

---

"vul·ner·a·ble ( P ) Pronunciation Key (vlnr--bl)
adj.
1
a Susceptible to physical or emotional injury.
b Susceptible to attack: “We are vulnerable both by water and land, without either fleet or army” (Alexander Hamilton).
--snip--"
- dictionary.com (or something)

I think you can safely call it a vulnerability, if you just use the "common" people's definition.

ya know what... lamens terms rock

i noticed when you are telling a client why you patched
" IE is very vulnerable to attack by...." there eyes are like black holes in the sky
their mind goes into " i dont understand anything about computers" mode and forget to interpuret *sp*... if someone thinks they know nothing they do know nothing

there is hole which can take down your computer and send you back to me for another repair

ok back to the bottle of skyy... peace

Quote:

---

How do you protect against this sort of exploit (besides Snort, which would mearly catch the sploit in progress not stop it, if I understand correctly) when there is no patch out yet?
Do you block every website at the gateway and whitelist the websites necessary for work?

---

That is definitely IMHO the best way, the old default deny policy - we will only allow you access to the things you can show us you have a business need to access.

The problem with this is the kickback you get from the business areas about IT Security being a "cork in the butt of progress" - not my words but something Security has been called in our organisation.

If you can get your organisation to implement this type of policy you are lucky and your job as a network security professional will be much easier with this type of support. What happens in most places though is you continually put out spot fires (such as this 'vulnerability') until something really bad happens, the organisation blames IT Security and then lets you do what you wanted to do in the first place :rolleyes:

I know I am being very synical but in my experience realistic.....

The same thing happens with IE vulnerabilities all the time - you will find that the one common thread of these vulnerabilities is - "If the user accesses a malicious webpage ......" what is the easiest way to protect yourself from these vulnerabilities - DONT LET THE USERS GET TO THE MALICIOUS SITES.

Quote:

---

I think you can safely call it a vulnerability, if you just use the "common" people's definition.

---

So you think it makes more sense to use a general's term in lieu of a computer security term in order to define a computer security issue?

Without a clear and concise language there can be no communication... as such it makes no sense to use a superset when and appropriate subset answer exists.

cheers,

catch

Quote:

---

So you think it makes more sense to use a general's term in lieu of a computer security term in order to define a computer security issue?

---

I would prefer that they use English terms instead of leetspeak.
Computer people are infamous for misusing the English language, as though
they majored in mathmatics (or gaming) and skipped their English classes.
Just for entertainment, try to look up how the term "social engineering" is
used outside of the computer biz.

Having said that, I would say, concerning this vulnerability, everyone
involved could share the blame, but the OS vendor could have shipped
the system with active scripting disabled by default. Then, when the
user enables it, a dialog with a pithy warning pops up. Sounds reasonable
to me.

I know, catch will go apoplectic at the mere mention of defaults,
as if they were irrelevant and tangential, but I think you gotta be pragmatic.
I used to carefully config my MS-DOS systems, but windzz is a bit more
complex.
:cool:

I am sorry... but I hardly see "Glossary of Computer Security Terms" as leetspeak. Every industry has its own lexicon... in medicine you wouldn't mix them up... why do so with computers?

The fact of the matter is, that this isn't a vulnerability because the system never does anything that it isn't supposed to do.

You can bitch about default setups all you like... really only two solutions exist:
1. Require a license to operate a computer. (Now who's being elitist?)
2. Remove the users' ability to damage their systems (TCPA anyone?)

Clearly the first option is simply not viable... as for the second option. The same people who bitch the most about microsoft not enforcing stricter controls over their systems' configurations are the same people who are against TCPA.

So... I'll put the question back on to you rcgreen:

How is my grandmother going to figure out how to enable active scripting? Will a warning pop up or will she need to find the same documentation that currently tells her how to toggle this functionality? Will she have to activate it for every new site she goes to or will accessing her favorite site with scripting unlock everything, leaving her no different off than now, except the vendor can directly blame her?

How do you make a system that my grandmother can easily use and expand while removing "vulnerabilities" where no actual policy violation occurs? I already know that you hate TCPA despite the fact that it does this perfectly, so what do you suggest?

To the serious user, much less the policy controlled organization defaults are irrelevant. Every aspect as system functionality must be defined with regard to the policy... regadless of whether or not the desired setting is the same as the default setting.

Lastly, to the security expert default secure settings can be quite a pain because it is harder to calculate the change in system policy when something is unlocked than something being locked. And when something needed is locked, the user is informed right away, if a flaw in the policy is created that grants undesired access, the user will not know until... at the earliest a system audit. For example

Subjects (s1, s2, s3...)
Objects (o1, o2, o3...)

s1 +rwx(o1)
s2 +rwx(o2)
s3 +rwx(o3)

In this situation each subject can read, write, and execute to one object for a very secure default setting. Now, let us grant a little more access...

s1 +rwx(o1, o2)
s2 +rwx(o2, o3)
s3 +rwx(o3, o1)

Now each subject can write to two objects... directly however now we have an issue of transitive rights. Each subject actually has the ability to read and write to every object...

s1 writes maliciously to o2, s2 executes o2 which tells s2 to read o3 and write the results to o2. This is possible for every combonation. Now think what wuld happen with a more complex system? What if we take rights away?

s1 +rwx(o1, o2) -wx(o2)
s2 +rwx(o2, o3) -wx(o3)
s3 +rwx(o3, o1) -wx(o1)

Here we have added in deny write and execute for several objects. This configuration means that shared objects cannot be written to in one direction to prevent malicious modifaction and cannot be executed the other direction to prevent the execution of malicious modification the other direction. Granted this is not a very real world example it does show how removing access yields no unpredictable flaws in policy and functionality may be tested for immediately. (if an object needs to be access in some way and can't be... the system will make a fuss)

cheers,

catch

Quote:

---

The fact of the matter is, that this isn't a vulnerability because the system never does anything that it isn't supposed to do.

---

That's very true. However, one could argue that all flaws in programming could fall under this category. Computers are simply unable to do anything they were not told to do. If the code does something unexpected, then it is simply the computer following the programmer's flawed instructions.

Quote:

---

Every industry has its own lexicon... in medicine you wouldn't mix them up... why do so with computers?

---

While this is true, there are terms used by the medical community that are, for lack of a better term, "dumbed down" for non-medical people. A fair number of people would look at you funny if you said you had a Myocardial Infarction, but tell people you had a Heart Attack and everyone understands. Also, even "specialized" subsets of lanugage are subject to ambiguities and interpretation; such is the limitation of language as a whole.

Quote:

---

You can bitch about default setups all you like... really only two solutions exist:
1. Require a license to operate a computer. (Now who's being elitist?)
2. Remove the users' ability to damage their systems (TCPA anyone?)

---

Option 1 isn't necessarily elitist. One must have a licence to drive a car, because it is a powerful tool, capable of causing a great deal of damage in untrained hands. How is that different from a computer, other than it might be less likely to directly cause someone's death? The computer is the most powerful communications tool yet concieved by humanity, and can provide a person with the capability of causing intentional (viruses/worms/identity theft/etc) or unintentional (botnet/worm distribution) damage. Option 2 is a more realistic approach though, since people would get in an uproar about having to be licenced to use a computer (and governments would be liable to make this a big cash-grab).

Quote:

---

How is my grandmother going to figure out how to enable active scripting? Will a warning pop up or will she need to find the same documentation that currently tells her how to toggle this functionality? Will she have to activate it for every new site she goes to or will accessing her favorite site with scripting unlock everything, leaving her no different off than now, except the vendor can directly blame her?

---

That's a good philosophical question, with analogies in politics, law, ethics and religion.
How can we have a world where people have powerful tools at their fingertips?
How can we allow your grandmother to vote if we suspect she will not vote wisely?
Isn't that a more potent weapon that could be used to harm herself and others?

Maybe the voting machine should always default to the Republican candidate, unless she can
find the hidden switch that will permit her to choose a Democrat. The fact is that there is no
technological solution to moral, ethical or political problems. Our long-standing tradition
is to wait till something breaks, breaks often enough in a particularly nasty way, and then
fix it, test the results and see if there are any unintended consequences.

People have to be permitted to make their own mistakes, at least until it is demonstrated
that the consequences of the Laissez Faire approach are intolerable. Then, and only then
do you write policy. Live and learn. So maybe after being embarrassed by these things
often enough, Bill will tighten up those defaults just a tweak.
:cool:

Ok.. enough with the esotherical blabbering..;)

There's an actual trojan out for this now

http://www.theregister.com/2005/12/0...xploit_trojan/
http://www.microsoft.com/security/en...:Win32/Delf.DH

And still no patch..

So I'd still like to call it a vulnerability in the default installation of Windows
(except for server 2003 which has ActiveScripting disabled by default)

Yey.. more exploits..

http://www.zdnet.com.au/news/securit...9225674,00.htm

Quote:

---

Sutton also warned computer users to be on guard for exploitation of the unpatched bug. "The one to pay attention to is the vulnerability that remains unpatched. Microsoft has released an advisory for this but no patch yet," he said. Microsoft may issue a fix outside of its monthly patching cycle for this problem, Sutton said.

Microsoft's next monthly patch release is scheduled for December 13.

---

So still 11 days to go ??