New Windows Vuln. worse than WMF?

Quote:

---

"This one has massive financial implications if someone exploits it," Litchfield said.

The TNEF vulnerability, which Microsoft spelled out in the MS06-003 security bulletin, is a flaw in how Microsoft's Outlook client and older versions of its Exchange server software decode the TNEF MIME attachment. TNEF is used by Exchange and Outlook when sending and processing messages formatted as Rich Text Format (RTF), one of the formatting choices available to Outlook users.

"All that's required to exploit this is an e-mail message," said Litchfield. No user interaction is needed to compromise an Exchange 5.0, 5.5, or 2000 server; all that's necessary is to deliver a maliciously-crafted e-mail to the server.

---

from: http://www.personaltechpipeline.com/news/175803807

Looks like MS has more problems on their hands now...

Quote:

---

"This one has massive financial implications if someone exploits it," Litchfield said.

The TNEF vulnerability, which Microsoft spelled out in the MS06-003 security bulletin, is a flaw in how Microsoft's Outlook client and older versions of its Exchange server software decode the TNEF MIME attachment. TNEF is used by Exchange and Outlook when sending and processing messages formatted as Rich Text Format (RTF), one of the formatting choices available to Outlook users.

"All that's required to exploit this is an e-mail message," said Litchfield. No user interaction is needed to compromise an Exchange 5.0, 5.5, or 2000 server; all that's necessary is to deliver a maliciously-crafted e-mail to the server.

---

from: http://www.personaltechpipeline.com/news/175803807

Looks like MS has more problems on their hands now...

Name a time and place where they never had problems on their hands.

Name a time and place where they never had problems on their hands.

When only Commodore 64's existed?

:)

When only Commodore 64's existed?

:)

Quote:

---

Originally posted here by mandraketux
Name a time and place where they never had problems on their hands.

---

*L* Very true :)

Quote:

---

Originally posted here by mandraketux
Name a time and place where they never had problems on their hands.

---

*L* Very true :)

FYI,

I already posted this info on the 10th of Jan.

http://www.antionline.com/showthread...hreadid=273115

cheers

FYI,

I already posted this info on the 10th of Jan.

http://www.antionline.com/showthread...hreadid=273115

cheers

My apologies. I only half-way checked for duplicate posts... I am pretty new to AO

My apologies. I only half-way checked for duplicate posts... I am pretty new to AO

Hey Hey,

Relyt: [off topic] I've never mentioned this but that was almost my original internet nick... a friend suggested it.. [/off topic] Now... I wouldn't say that you've already posted about this... I think their substantially different... You posted about the updates being available... this is more of a discussion on the impact of one of the flaws... I'd saw it warrants it's own discussion but then again that's just my opinion...

As for the subject at hand... I don't think I agree with Litchfield.... It's definatey bad... but I don't see it as being worse than the WMF flaw.... This become public when the patch was released.... It wasn't previously published and there's no 0-day available for it... with the WMF there was.... Large corporation which wouldn't or couldn't trust the 3rd party patch were left vulnerable in many cases... in this case they simply have to apply the update... Will some people likely be "owned" by this.... no doubt... but most people will be fully patched (at the exchange level)... before a public exploit (or even a private one) starts circulating and causing damage.. So we're left with home users.. Outlook Vuln vs Outlook/IE vuln... both have patches available now... and the WMF is vulnerable to a broader form of attacks.. if you didn't update your computer... then you are vulnerable to both.. and with the broader scope.. it's more likely that WMF would affect the person...

Then again... Security companies are becoming more and more popular these days... they seem to spring up over night in some cases... and I think that has the existing companies scrambling... before they had labs were they could analyze stuff that the average geek never could... with the latest technology that has changed... I could have a large test environment in my house for reasonably cheap.. anyone can search for and locate vulns... and it just keeps getting easier with some of the tools out there... This means they need a way to convince people that they're still needed.. that there's a reason to pay for software when free alternatives are available... to make people think they are better... NGS discovered TNEF... that's why they're saying it's worse... so that they'll look like the bigger hero.. so they must be smarter... A lot of this is just PR... The patch is out.. therefore it's not the end of the world... They're just trying to drum up business now..

Peace,
HT

Hey Hey,

Relyt: [off topic] I've never mentioned this but that was almost my original internet nick... a friend suggested it.. [/off topic] Now... I wouldn't say that you've already posted about this... I think their substantially different... You posted about the updates being available... this is more of a discussion on the impact of one of the flaws... I'd saw it warrants it's own discussion but then again that's just my opinion...

As for the subject at hand... I don't think I agree with Litchfield.... It's definatey bad... but I don't see it as being worse than the WMF flaw.... This become public when the patch was released.... It wasn't previously published and there's no 0-day available for it... with the WMF there was.... Large corporation which wouldn't or couldn't trust the 3rd party patch were left vulnerable in many cases... in this case they simply have to apply the update... Will some people likely be "owned" by this.... no doubt... but most people will be fully patched (at the exchange level)... before a public exploit (or even a private one) starts circulating and causing damage.. So we're left with home users.. Outlook Vuln vs Outlook/IE vuln... both have patches available now... and the WMF is vulnerable to a broader form of attacks.. if you didn't update your computer... then you are vulnerable to both.. and with the broader scope.. it's more likely that WMF would affect the person...

Then again... Security companies are becoming more and more popular these days... they seem to spring up over night in some cases... and I think that has the existing companies scrambling... before they had labs were they could analyze stuff that the average geek never could... with the latest technology that has changed... I could have a large test environment in my house for reasonably cheap.. anyone can search for and locate vulns... and it just keeps getting easier with some of the tools out there... This means they need a way to convince people that they're still needed.. that there's a reason to pay for software when free alternatives are available... to make people think they are better... NGS discovered TNEF... that's why they're saying it's worse... so that they'll look like the bigger hero.. so they must be smarter... A lot of this is just PR... The patch is out.. therefore it's not the end of the world... They're just trying to drum up business now..

Peace,
HT

Quote:

---

there's no 0-day available for it

---

ERROR: There has been an error in the trust module. Windows XP has prepared an error report. Would you like to send this report to Microsoft.

Quote:

---

there's no 0-day available for it

---

ERROR: There has been an error in the trust module. Windows XP has prepared an error report. Would you like to send this report to Microsoft.

Quote:

---

Originally posted here by Relyt
When only Commodore 64's existed?

:)

---

heh i have one of those ;)

Quote:

---

Originally posted here by Relyt
When only Commodore 64's existed?

:)

---

heh i have one of those ;)

...and before Commodore's there were ZX-80/1's... I remember those fondly.... ;)

...and before Commodore's there were ZX-80/1's... I remember those fondly.... ;)

Yup, had all of those _early_ personal computers:

Vic 20 (with tape deck, 6-port card expansion)
Radio Shack TRS-80 (fondly nicknamed _Trash 80_)
Timex Sinclair TI99/4a
Commodore 64 (with 2 5.25'' disk drives, modem - ran own BBS...remember those)
Texas Instruments TI 99/4A (http://www.vintage-computer.com/ti_99_4a.shtml)

Either I'm old or I'm a geek...err I think I'm both. [me guesses lot of the youngin's here on AO are laughing at me right now] ;)

ah the good ole days....snicker

Yup, had all of those _early_ personal computers:

Vic 20 (with tape deck, 6-port card expansion)
Radio Shack TRS-80 (fondly nicknamed _Trash 80_)
Timex Sinclair TI99/4a
Commodore 64 (with 2 5.25'' disk drives, modem - ran own BBS...remember those)
Texas Instruments TI 99/4A (http://www.vintage-computer.com/ti_99_4a.shtml)

Either I'm old or I'm a geek...err I think I'm both. [me guesses lot of the youngin's here on AO are laughing at me right now] ;)

ah the good ole days....snicker

I don't know if this is worse or not... from what I've gathered, while this exploit has almost zero interaction involved, the WMF exploit targets basically everything from Windows 3.1 up. Moreover, since the WINE project basically copied the Windows API, it effects that as well (but not so badly as the native API, as WINE can be/usually is sandboxed during operation).

Thoughts?

I don't know if this is worse or not... from what I've gathered, while this exploit has almost zero interaction involved, the WMF exploit targets basically everything from Windows 3.1 up. Moreover, since the WINE project basically copied the Windows API, it effects that as well (but not so badly as the native API, as WINE can be/usually is sandboxed during operation).

Thoughts?

Quote:

---

Originally posted here by ric-o
Yup, had all of those _early_ personal computers:

Vic 20 (with tape deck, 6-port card expansion)
Radio Shack TRS-80 (fondly nicknamed _Trash 80_)
Timex Sinclair TI99/4a
Commodore 64 (with 2 5.25'' disk drives, modem - ran own BBS...remember those)
Texas Instruments TI 99/4A (http://www.vintage-computer.com/ti_99_4a.shtml)

Either I'm old or I'm a geek...err I think I'm both. [me guesses lot of the youngin's here on AO are laughing at me right now] ;)

ah the good ole days....snicker

---

Hey Hey,

This is completely off topic.. but I think it's worth mentioning.... I'm still young (23 for those that don't know)... but for Christmas my gf got me, among other things, the Atari Flashback 2... They released the first one last year and the second one this year... it's basically a cheap knock off of the atari with 40 games stored in ROM on it.. you can't change the game but other than that it's a complete system... you select from a menu on startup and then it's like having the real atari... It's pretty sweet... I wanna get Flashback 1 that they released last year.. but that's besides the point.. My roommate had a friend over last night so I asked if they wanted to play pong (it's one of the games)... she had no clue what I was talking about.. and even he had never played it... It's the original code so it's got the clipping problem in the corners of the screen and everything... they looked at me like I was crazy... I just thought it was funny that people wouldn't knowwhat PONG is.

Peace,
HT

Quote:

---

Originally posted here by ric-o
Yup, had all of those _early_ personal computers:

Vic 20 (with tape deck, 6-port card expansion)
Radio Shack TRS-80 (fondly nicknamed _Trash 80_)
Timex Sinclair TI99/4a
Commodore 64 (with 2 5.25'' disk drives, modem - ran own BBS...remember those)
Texas Instruments TI 99/4A (http://www.vintage-computer.com/ti_99_4a.shtml)

Either I'm old or I'm a geek...err I think I'm both. [me guesses lot of the youngin's here on AO are laughing at me right now] ;)

ah the good ole days....snicker

---

Hey Hey,

This is completely off topic.. but I think it's worth mentioning.... I'm still young (23 for those that don't know)... but for Christmas my gf got me, among other things, the Atari Flashback 2... They released the first one last year and the second one this year... it's basically a cheap knock off of the atari with 40 games stored in ROM on it.. you can't change the game but other than that it's a complete system... you select from a menu on startup and then it's like having the real atari... It's pretty sweet... I wanna get Flashback 1 that they released last year.. but that's besides the point.. My roommate had a friend over last night so I asked if they wanted to play pong (it's one of the games)... she had no clue what I was talking about.. and even he had never played it... It's the original code so it's got the clipping problem in the corners of the screen and everything... they looked at me like I was crazy... I just thought it was funny that people wouldn't knowwhat PONG is.

Peace,
HT