Forgot your password?
typodupeerror
Security Windows

Microsoft Plugs "Drive-By" and 14 Other Holes 189

Posted by kdawson
from the clip-clop-clip-clop-bang dept.
CWmike writes "Microsoft today patched 15 vulnerabilities in Windows, Windows Server, Excel, and Word, including one that will probably be exploited quickly by hackers. None affects Windows 7. Of today's 15 bugs, Microsoft tagged three 'critical' and the remaining 12 'important.' Experts agreed that users should focus on MS09-065 first and foremost. That update, which was ranked critical, affects all still-supported editions of Windows except Windows 7 and its server sibling, Windows Server 2008 R2. 'The Windows kernel vulnerability is going to take the cake,' said Andrew Storms, director of security operations at nCircle Network Security. 'The attack vector can be driven through Internet Explorer, and this is one of those instances where the user won't be notified or prompted. This is absolutely a drive-by attack scenario.' Richie Lai, the director of vulnerability research at security company Qualys, agreed. 'Anyone running IE [Internet Explorer] is at risk here, even though the flaw is not in the browser, but in the Win32k kernel mode driver.'"
This discussion has been archived. No new comments can be posted.

Microsoft Plugs "Drive-By" and 14 Other Holes

Comments Filter:
  • Well... (Score:3, Informative)

    by vistapwns (1103935) on Wednesday November 11, 2009 @09:17AM (#30059070)
    If you patch, you're safe. Too bad so many XP users don't opt-in to patching, a lot of them will be infected, but it's a good thing MS started auto-patching by default with Vista, also since Vista has a lot of anti-exploit code (DEP, ASLR, Protected Mode Sandboxing, etc.) it probably won't see very many infections, although I thought I saw on another site that Vista wasn't affected.
    • Re:Well... (Score:4, Insightful)

      by RiotingPacifist (1228016) on Wednesday November 11, 2009 @09:38AM (#30059250)

      Too bad so many XP users don't opt-in to patching

      This is Microsoft's fault for not offering a security only patch channel and pushing WGA ,etc through as windows updates.

      I know this is probably comes across as trolling but it's not just Microsoft bashing for the sake of it.

      • +5 informative? (Score:4, Informative)

        by vistapwns (1103935) on Wednesday November 11, 2009 @10:09AM (#30059562)

        Good grief. MS offers ALL security patches to EVERYONE, including pirates, and also offers many other patches such as stability and performance updates to everyone as well.

        ---
        "There seems to be a myth that Microsoft limits security updates to genuine Windows users," wrote Microsoft's Paul Cooke, who works in Windows Client Enterprise Security. "Let me be clear: all security updates go to all users."
        ----

        From http://www.tomshardware.com/news/windows-pirate-bootleg-security-patches,7666.html [tomshardware.com]

        • I'm not talking about pirates, there are many cases where legitimate users do not what to apply all patches to their system, but applying only security patches is acceptable.

          For example a company that has ie6 only Intranet sites don't want to test against ie7/ie8 but still want security patches for ie6, without having to comb through all the updates and pick out the security ones.

          e.g. the equivalent of using debian and having the security repo enabled but not backports.

          • by mlts (1038732) *

            If the company has WSUS, they can configure it to grab all the patches required by client machines, and either automatically approve only security updates (explicitly denying IE7/IE8), or holding everything for a sysadmin to approve.

            Windows Update is fine, but businesses should *never* have their production machines point to it. Instead, the machines should be fed off a hardened internal box which stores updates, and where the IT department can control releasing patches in stages (a production replica gets

    • It isn't quite true to suggest people don't "opt-in to patching" on any Windows product. It is more the case the process is arcane and confusing to some users. And worse still, the system trains the rest of the users to blindly accept things that look like "official updates" when they are really malware. I've lost track on the number of times someone asked me what was going on when the WGA thing pops up. The way it is worded and framed seems to freak users out and I see why: Going for months with a legi

      • It was quite messy on XP (especially as WGA was introduced late in its lifetime), but on Vista or 7, you simply get a screen during setup which says "Do you want to enable automatic updates?". The default option is to enable both download and installation, so you'll have it even if you just keep clicking "Next" all the way. And after you do that, it will handle the rest with no user intervention needed.

    • If you patch, you're safe. Too bad so many XP users don't opt-in to patching, a lot of them will be infected, but it's a good thing MS started auto-patching by default with Vista, also since Vista has a lot of anti-exploit code (DEP, ASLR, Protected Mode Sandboxing, etc.) it probably won't see very many infections, although I thought I saw on another site that Vista wasn't affected.

      Many people turned it off because of the automatic reboot.

      I can't count the number of times I'll be playing a game with someone, and then *poof*, they're gone.

      • Many people turned it off because of the automatic reboot.

        I can't count the number of times I'll be playing a game with someone, and then *poof*, they're gone.

        Automatic reboot, with default settings, is configured to happen at 3am. Or rather check for updates is configured for 3am, and reboot is after it finishes installing.

        It may be that you're playing with people for whom staying up at that time is a norm, but I think that, on large scale of things, "many" is probably quite an overstatement.

  • by bcmm (768152) on Wednesday November 11, 2009 @09:17AM (#30059076)

    "Anyone running IE [Internet Explorer] is at risk here, even though the flaw is not in the browser, but in the Win32k kernel mode driver."

    Anybody else think something is integrated with something else in a deeply, deeply wrong way here?

    • by eldavojohn (898314) * <eldavojohn&gmail,com> on Wednesday November 11, 2009 @09:30AM (#30059170) Journal

      "Anyone running IE [Internet Explorer] is at risk here, even though the flaw is not in the browser, but in the Win32k kernel mode driver."

      Anybody else think something is integrated with something else in a deeply, deeply wrong way here?

      I most certainly do! This is unfair! When will Firefox and Opera have such privileged access to kernel space. It results in a bad user experience when the Javascript code I slave over can only help you manage your user files, registry keys and kernel libraries if you're using IE.

      Yours truly,

      Crafty McStealsYourShit

      • Come now. If you, say, run the EOT plugin for Firefox from PDMS, FF can be used to exploit the vulnerability. Clearly the answer is to drive-by install that software to improve the l33t exploiter experience.

        In all seriousness, the issue isn't that IE has access to the kernel, but that IE can request that an EOT font be rendered. Apparently, something about the EOT font rendering pipeline hits win32k.sys, and if that EOT font is properly constructed, it can cause remote code execution at that point. Any prog

    • Re: (Score:2, Interesting)

      by jspenguin1 (883588)

      According to Microsoft, the Windows kernel improperly parses Embedded OpenType (EOT) fonts, which are a compact form of fonts designed for use on Web pages.

      One question: Why is the kernel parsing fonts?

      • Re: (Score:3, Informative)

        by b4dc0d3r (1268512)

        From what I understand: GDI functions are in the kernel for speed reasons - constantly switching to usermode just to draw things slows down the system.

        Vista moved it into userspace, and lots of users complained about slowness. Looking at the vulnerability details, this just gives you privilage elevation on Vista (and related servers), not remote code execution.

        For Windows 7, MS moved GDI back into the kernel, with some redesign. So they apparently fixed this issue when they returned GDI to user mode.

        Again

    • by Ralish (775196) <ralish@gma i l . c om> on Wednesday November 11, 2009 @11:13AM (#30060438)

      Anybody else think something is integrated with something else in a deeply, deeply wrong way here?

      No, not really, at least, not in the way you're insinuating. The Win32k kernel mode driver is essentially the major component of the Windows kernel responsible for kernel-mode graphics related processing. Put more succinctly by MS from the MS09-065 [microsoft.com] security bulletin:

      Win32k.sys is a kernel-mode device driver and is the kernel part of the Windows subsystem. It contains the window manager, which controls window displays; manages screen output; collects input from the keyboard, mouse, and other devices; and passes user messages to applications. It also contains the Graphics Device Interface (GDI), which is a library of functions for graphics output devices. Finally, it serves as a wrapper for DirectX support that is implemented in another driver (dxgkrnl.sys).

      The handling of EOT (Embedded OpenType) fonts is apparently (at least partially) handled by the kernel and presumably a component of the GDI system. IE supports EOT fonts and presumably just hands them off to the kernel, after all, it is delegated the responsibility of handling them, so why re-implement it in IE? The flaw is not really in IE but in buggy code in the relevant processing. There is an argument to be made that IE really shouldn't be explicitly processing these fonts by default in an untrusted network (and this can be changed in the preferences, but is not the default), but the flaw itself is in the system call code itself; the latter is merely about reducing attack surface in the case of exploits such as this arising.

      My point is, this isn't really a case of IE being "overly" coupled into the system (which isn't to say it isn't, just that I don't view this as an example of it). Whether it's sensible engineering to have the kernel handle this stuff is probably a far more interesting and valid argument. Protecting against system call vulnerabilities is pretty tough, as you do expect the kernel to be trusted, indeed, if you can't trust the kernel you have serious problems. A quick google seems to suggest Firefox doesn't support EOT fonts, and I'm not sure if any other browsers do either, but if they did, they may well have their own exploit situations as well.

      • by Ralish (775196)

        Minor correction:
        This isn't necessarily limited to EOT fonts, but is a flaw in the font parsing code in the kernel in general. EOT fonts are just the exploit vector as specific to IE, but other font types can be used for less likely exploit vectors, such as TTF fonts in a Terminal Services setup. The point is this is a flaw in a kernel system call and IE's use of this system call + default settings makes it vulnerable to exploitation.

      • by Abcd1234 (188840)

        The handling of EOT (Embedded OpenType) fonts is apparently (at least partially) handled by the kernel and presumably a component of the GDI system.

        Interesting. So this actually goes even deeper than IE being integrated with the OS, and demonstrates why things like font handling should *not* be done in kernel space.

        'course, this wasn't always the case. There was a time when the video subsystem was largely a userspace component, but during the NT days, they decided to move a lot of video-related functional

    • by bheer (633842)

      It would be deeply, deeply wrong if IE was the only way to get infected. The vulnerability [vupen.com] is quite interesting -- it can be invoked by crafting a special Embedded OpenType (EOT) font file, which then exploits a vulnerability in kernel mode driver that parses font code. So you can be exploited using Microsoft Office, Wordpad -- anything that can display EOT-embedded fonts. All you have to do is open a document containing the offending font. Of course, IE is easy to exploit because all you need to do is put

      • by WhiteDragon (4556)

        Note that Windows 7, in which most drivers are back in user space, is not vulnerable to this exploit. Killer reason to upgrade, imho. This is also the reason most video driver crashes don't crash Windows 7 -- the display is simply re-initialized.

        This seems like a no-brainer, but they must have had some reason for putting all those things in kernel space before. Perhaps performance? But isn't the Win7 performance better anyway?

        • Re: (Score:3, Informative)

          by bheer (633842)

          NT 3.x supported user-space drivers and was criticized by reviewers for poor graphics performance (especially those who wanted to run visualisation/CAD apps on it). But it was rock-solid, as you can imagine.

          NT 4 introduced kernel-mode display drivers, which helped it become very popular with engineers who needed these apps (remember, the only other 'mainstream' OS on the market at this time was Win95/98 and System 8/9; NT was rock-solid by comparison and Linux didn't have many commercial apps at this time).

    • by v1 (525388)

      was just going to say... aaaaaaand that's what you get for hooking the kernel to your web browser ... idiots.

      "windows security" isn't just an oxymoron, it's the oxymoron. They just... never... learn.

  • That's shocking! (Score:3, Interesting)

    by Rik Sweeney (471717) on Wednesday November 11, 2009 @09:24AM (#30059132) Homepage

    They thank someone from Google for helping them spot the vulnerability! It's in the acknowledgements:

    http://www.microsoft.com/technet/security/Bulletin/MS09-065.mspx [microsoft.com]

    • They thank someone from Google for helping them spot the vulnerability! It's in the acknowledgements

      They always do that. It is in Microsoft's interests to publicly acknowledge the people who send them security reports because they want to encourage people to do that. It is preferable to what happened in the recent story [slashdot.org] where the guy posted the bug in a blog rather than telling them directly.

      The accepted practice is to privately tell the company about a bug and give them time to fix the problem before posting about it publicly.

  • It's Still Windows (Score:3, Insightful)

    by dkh2 (29130) <dkh2@NoSpAM.WhyDoMyTitsItch.com> on Wednesday November 11, 2009 @09:27AM (#30059150) Homepage

    No wonder my home system was such a dog this morning. It was pulling the latest patches and updates.

    Meanwhile, it's still Windows. There's only so much improvement you can make when the manufacturer insists on packing so much into the "kernel." I was always taught that the OS kernel is the one piece that provides the interface between all software and all hardware. File systems, GUIs, internet browsers and lesbian Pr0n are all just forms of software that should be clients to the ultimately optimized but minimalist kernel.

    • by Bacon Bits (926911) on Wednesday November 11, 2009 @10:20AM (#30059730)

      There's only so much improvement you can make when the manufacturer insists on packing so much into the "kernel."

      So in trying to bash Microsoft you're saying that Linux sucks?

      Linux is a monolithic kernel. Windows is a hybrid kernel. Linux puts a lot more into kernel mode/real mode than Windows does. Many drivers in Windows are user mode drivers, for example, particularly printers. The only thing I can think of that runs in kernel mode in Windows and not in Linux is the graphics system -- which is why the screen flickers and changes resolutions slower in Linux and Windows tends to run full screen games and video better with DirectX, but it also rarely brings the system down... not that a system you can't get desired display output from is useful entirely.

      • by ettlz (639203)

        Windows is a hybrid kernel. Linux puts a lot more into kernel mode/real mode than Windows does.

        Oh come on now, "hybrid" kernel is nonsense marketspeak; all the high-level services such as networking and filesystems and drivers run in the same address space. How they chat to each other is irrelevant here, NT is a monolithic kernel. And what the hell is a configuration database, the Registry, doing as a kernel service? And then there's GDI etc. --- (up until recently used to be) a kernel service.

        The only thi

      • by Abcd1234 (188840)

        Linux is a monolithic kernel. Windows is a hybrid kernel. Linux puts a lot more into kernel mode/real mode than Windows does. Many drivers in Windows are user mode drivers, for example, particularly printers.

        Uh, just FYI, printer drivers are usermode in Linux as well. Furthermore, until recently (ie, the Vista pedigree), the Windows drivers were built against the KMDF, and so ran in kernel mode.

        Secondly, your statement that "the only thing I can think of that runs in kernel mode in Windows and not in Linu

      • by jpmorgan (517966)
        Actually, since Vista even graphics drivers aren't all entirely in the kernel anymore. WDDM splits graphics drivers into two parts, a low-level realtime component which is responsible for direct interaction with the graphics card (scheduling DMA and stuff like that) and a higher-level component which does things like implement OpenGL and DirectX primitives. That's why graphics drivers can crash in Vista without taking down the entire OS: most of the driver is running in usermode. And not just printer drive
      • by Suiggy (1544213)
        As of Windows Vista and in Windows Server 2008 and Windows 7, the graphics drivers are all user mode. When a graphics driver crashes on those systems, it doesn't bring the whole system down. The graphics driver gets restarted and you continue with your business.
    • No, that was me, driving my Mac Truck(tm) Lorry Load(tm) Malware Package through the gaping holes in your operating system. The patch you think you applied is just a little eye-candy to make you feel all warm, snug, and safe. It's working. too. :-)

    • You can leave it on to notify you or just download them manually when MS releases them (your job to keep track like reading security news or check MS Updates every second and fourth Tuesdays of each month; don't forget emergency releases once in a while!).

  • by 140Mandak262Jamuna (970587) on Wednesday November 11, 2009 @09:32AM (#30059182) Journal
    From the article

    But while Storms speculated that Microsoft knew the EOT font flaw was a security issue -- and waited until now to patch older Windows -- Lai thought that Microsoft didn't realize until recently that it was also a security vulnerability in editions prior to Windows 7. "I think they fixed this bug as part of the code sanitization during [Windows 7's] development cycle. It was actually only publicly disclosed recently, and then they patched it in other Windows

    The article is speculating what did Micrsoft know and when did it know it etc. Microsoft's standard line defending its security through obscurity policy is, "we are not providing any details because it is going to help the hackers". But what about its big customers? Almost all businesses do not care much about its small customers. So forget small timers. But Microsoft has to coddle its big Fortune500 company customers. Would they be informed, even under confidentiality agreements and non disclosure agreements, which platforms and applications are vulnerable?

    How do these big companies justify being so meek and acquiescing to Microsoft? If these Fortune 500 companies chip in 100,000$ a year, they can create an Institute of Software Interoperability and go towards reducing their switching costs. Microsoft has total revenue of more than 25 billion dollars, and a significant chunk comes from these big companies. They pay off has to be enormous for these companies.

    • Re: (Score:2, Informative)

      by thejynxed (831517)

      Yes, the appropriate contacts in such organizations get informed. Chiefly, the CIOs and their assorted assistants down the IT chain. What they then do with that information is up to them. There's a reason these companies pay for their overpriced support contracts and license aggreements with Microsoft.

      I know the major security vendors like Symantec are also informed.

      This has been addressed several times (redundantly, I might add) in Slashdot articles over the years, and can probably even be confirmed by you

  • Fourteen? (Score:5, Funny)

    by paimin (656338) on Wednesday November 11, 2009 @10:06AM (#30059510)
    I, for one, have been getting my hole plugged by Microsoft for a good twenty plus years now.

    So sore.
  • ....is Internet Explorer?........aaaahh, that buggy browser that comes with windows. I stopped using it four years ago and deleted the icon.

    Seriously tough, I think that when people choose to use a browser that messes with system internals above other browsers that are NOT messing with the kernel, they get what they ultimately deserve. I remember a particularly buggy period that really had me going definitely over to Firefox: whenever IE crashed, I had to reboot. With firefox, killing the program would su
  • Once again I am delighted that I switched to Mac. The entire Windows ecosystem is riddled with these sorts of design flaws. What more reason can anyone need to get off of Microsoft?
    • by Sporkinum (655143)

      The primary vulnerability was mitigated by using Firefox and Open Office. The drive by needs IE or Powerpoint or Word to execute.
       

      • So, one must assume you are in complete agreement with me, since both of those products with vulnerabilities are made by Microsoft. I just wonder what rock someone must have been living under to not notice the steady stream of bad news coming out of Redmond. Microsoft just produces total and complete crap, from the first to the last byte.
        • by Ralish (775196)

          And yet, Apple's default browser Safari has a pretty terrible security record, the latest OS X release contained a bug that nuked account data, and OS X consistently falls behind both Linux and Windows in defence-in-depth security mitigations. While Apple might like to boast about its operating system security, this doesn't appear to be due to any particular "hardened" design versus other mainstream operating systems and in fact lacks solid implementations of various security features that have been standar

    • by alen (225700)

      snow leapard has been out for 2 months and service pack 2 has just been released. the fixes are for some pretty obvious stuff that should not have made it past QA like the Flash performance issues.

    • by DrXym (126579)
      OS X has been tardy in implementing things like ASLR and there have been plenty of security issues that Apple took too long to patch. It may be that OS X in general has a better track record than Windows, but Apple certainly aren't paying as close attention to security as they should.
      • Okay, regarding security, I would rank them like this:

        Apple A-
        Microsoft F-

        Sounds like the choice is Cupertino over Redmond, all the way.
  • by FatdogHaiku (978357) on Wednesday November 11, 2009 @10:32AM (#30059908)
    I gotta wonder about the line:
    'Anyone running IE [Internet Explorer] is at risk here, even though the flaw is not in the browser, but in the Win32k kernel mode driver.'
    Why aren't users of other browsers on the older Win platforms vulnerable? Is there some other risk or problem that is being ignored or even concealed?

    Man, I can't believe I got that out without laughing...
    • by taviso (566920) * on Wednesday November 11, 2009 @11:33AM (#30060732) Homepage

      I discovered this bug (check the credit section [microsoft.com] in the advisory), so can explain. The bug is in parsing a component of TTF files, which are handled by the GDI kernel subsystem in Windows. Anything that tries to load fonts can be used to exploit this vulnerability, as they will eventually reach this code, Internet Explorer just happens to be the easiest way to reach it remotely.

      Other browsers _are_ affected, the difference is that there's only one level of indirection before the vulnerable code in Internet Explorer, and at least two in other browsers. This is because IE supports EOT files directly, which via TTLoadEmbeddedFont() are decoded and passed straight to GDI, where as other browsers take a TTF input, convert it into an EOT and then pass that to TTLoadEmbeddedFont, so you have to convince three different chunks of code your input is valid (the browser, t2embed, then gdi), instead of just two in IE.

      If you use any browser that support @font-face on Windows (Safari, Firefox 3.5+), you should still patch and reboot.

    • by Culture20 (968837)
      And what of people running old versions of IE on Solaris or Mac? There's no Win32k kernel mode driver there...
  • Anyone running IE [Internet Explorer] is at risk here,

    That statement is still true, even when the rest of it is missing. ^^

    Then again, what does it give us, to help those, who were chosen by natural selection, to be punished?
    Wouldn't it make more sense so block all packets coming from IE users?
    Use the drive-by hole, to put a trojan on those systems, whose only purpose it is, to block all outgoing traffic, except Microsoft servers and their DNS mappings, until the system is updated. If the system is updated, the trojan restores everything, and deletes itself.

    I

  • Why no mention of the several dozen patches released in Snow Leopard 10.6.2? And they were only patches for Apple's latest OS. Unfortunately, those patches apparently aren't very interesting or something.
    • When people start having problems with zombie Mac systems you can start worrying about those Apple patches. In the meantime we're getting flooded with security issues in Windows. Still.
  • Awesome, now this means my xp version is even more insecure then I thought,
    I am still waiting until they offer free patching for pirated copies.

  • After what was expected to be an unusually quiet Patch Tuesday, Microsoft has released eight patches for applications with an insufficient number of security holes.

    “Our market is the enterprise,” said Microsoft security marketer Jonathan Ness. “Information technology professionals know that Windows is the greatest IT job creation scheme in history. Without Patch Tuesday, there’s no reason for the experienced IT worker to spend his time hiding out in the server room watching progres

  • None affects Windows 7. Of today's 15 bugs, Microsoft tagged three 'critical' and the remaining 12 'important.'

    Critical and important patches but none affects Windows 7.

    Solution?

    Simple. Offer Windows 7 as a patch option (and keep it as only an option because some machines don't have enough hardware). It's hypothetical though due to the monopoly and antitrust problems of Microsoft.

    After all the patching your XP or Vista or whatever becomes more and more like Windows 7 anyways.

    How many of the people who've

Going the speed of light is bad for your age.

Working...