RSSMicrosoft Fixes Zero-Day Word Flaws
By Ed Oswald | Published February 13, 2007, 4:27 PM
Microsoft on Tuesday released a bevy of patches, including three critical patches for the Microsoft Windows operating system, two for Office, and a critical patch for its antivirus and anti-malware software products.
Altogether, twelve patches were released, and the Redmond company finally addressed the issues within Microsoft Word and Office that were being exploited in zero-day attacks. Both Office patches dealt with code execution issues.
The first patch dealt with a total of six vulnerabilities within Word, including malformed string, data structure, drawing object, and function issues, as well as issues with Word Count and Word macros. The patch is intended for Word 2000, 2002, and 2003, as well as Works Suites 2004 through 2006 and Office for Mac.
Also patched in a separate fix were flaws within PowerPoint and Excel. Both concern malformed record issues that could put users at risk of a code execution attack, Microsoft said.
Of the Windows patches, a fix has been released for the HTML Help ActiveX control which could allow an attack to execute arbitrary code by visiting a specially crafted webpage.
Flaws within Microsoft's Data Access Components were also remedied, as well as a new cumulative security update for Internet Explorer. That patch fixes two issues with the COM object, as well as an issue with FTP server usage.
The last of the critical issues fixes an issue within Microsoft's antivirus software. According to an advisory, the flaw exists in how the Malware Protection Engine processes PDF files. If a specially crafted file is sent through, it could open up a code execution risk.
The remaining patches were all rated important: four remote code execution vulnerabilities in Step-by-Step Interactive Training, Microsoft OLE Dialog, Microsoft MFC, and RichEdit. All, however require user interaction in order to be exploited.
Two elevation of privilege risks were also remedied, which existed in the Windows Shell and Image Acquisition.
Of the patches, security firm PatchLink put the highest priority on the fix for Microsoft's Data Access Components, saying the vulnerability could put at risk secure databases.
"An attacker successfully exploiting this vulnerability could take complete control of an affected system to install programs to view, change, or delete data; or create new accounts with full user rights," vice presdent of security Technologies Chris Andrew said.
"Organizations should review the specifics of this security bulletin and to ascertain level of risk, especially for organizations that are dealing with mission critical or customer data," he continued.
There is a serious vulnerability in Mozilla Firefox, tested with 2.0.0.1,
but quite certainly affecting all recent versions.
This makes it possible for evil.com to modify location.hostname as
described above, and have the resulting HTTP request still sent to
evil.com. Once the new page is loaded, the attacker will be able to set
cookies for *.example.com; he'll be also able to alter document.domain
accordingly, in order to bypass the same-origin policy for XMLHttpRequest
and cross-frame / cross-window data access.
A quick demonstration is available here:
http://lcamtuf.dione.cc/ffhostname.html
The impact is quite severe: malicious sites can manipulate authentication
cookies for third-party webpages, and, by the virtue of bypassing
same-origin policy, can possibly tamper with the way these sites are
displayed or how they work.
Regards,
/mz
Score: 0
|What MS needs to do is follow the foot step of Apple. Instead releasing patches and SP for FREE, they need to release them as "UPGRADE" and charge people for them.
WTF you people are thinking??? Wow another patch. It will download in the background. When it's done downloading, it will wastes me a minute to click on updating it. And oh yea, I will need to reset the computer, which takes another minute.
Score: 0
|With Vista, a computer restart will not be needed 75% of the time from what I hear. Also every update for Vista so far does not require a restart on my Vista Ultimate Edition install--so far, so good...
Score: 0
|Well vista has no patches at least ;)
Score: 0
|Huh? Do you mean TODAY?
Ignorance IS bliss!
Score: 0
|Vista has several patches, just none that are "Highly critical" yet :)
There are over 11 "recommended" updates on mine so far (some of those may have been for Office XP as well though).
Score: 0
|That's only another 12 patches to install from fresh when formatting.
That takes the total up (for me) to around 70 from fresh install.
Score: 0
|I'm currently downloading 18--yes, eighteen--patches from Windows Update.
What bothers me isn't the amount of patches, but how Microsoft idiotically limits releases to one Tuesday a month. Okay, yes, I know, the policy is meant to accommodate IT departments who have to test the patches before deploying them across their networks. But why enforce that sort of schedule on the rest of us? Make the patches available as soon as they're completed, and let the corporate departments set their own "once a month" testing policy.
Score: 0
|I currently have 87 waiting to be downloaded for Ubuntu...and thats just from last month, so it's no picnic on the Linux side either.
Score: 0
|For all of us doing fresh installs I really with MS would roll all of the updates for the year into an anual service pack. I find the .net updates tobe the worst.
Score: 0
|but for ubuntu you update all the software the package manager deals with as well, which is generally most of it.. so its not to bad.. the fresh installs of that os suck as well though.
MS doing annual "roll ups" would be nice.. Make less work for all of us who like to have a clean install every now and then..
Score: 0
|Do what I do--manually downloud the .exe files or the .msi files and burn them to a CD. Just install them that way rather than from windows update--much faster.
I'm sure there are third party utilities that also better automate that sort of thing as well.
Score: 0
|"Okay, yes, I know, the policy is meant to accommodate IT departments who have to test the patches before deploying them across their networks. But why enforce that sort of schedule on the rest of us?"
Answer: Because releasing the patch means revealing the exploit, which would destroy the whole reason behind the monthly updates.
In other words--they don't do what you suggested because they can't do what you suggested.
Score: 0
|I just got the latest patches and between Windows XP and Office 2003 there were "only" 19 of them...gee and the software has only been on the market for at least 3 years!
Score: 0
|No holes to plug in Office 2007 and Windows Vista? Poor hackers... ((wiping tears))
Score: 0
|um, just wait a few days... There will be. Guaranteed.
Score: 0
|There have been several minor flaws found already.
First, it is possible for audio played over speakers to trigger Speech Recognition. This can do pretty much anything, although it is slowed by the rate of human speech and recognition. However I think this would be more of an issue of poor sound equipment arrangement and volume/balance levels than a Windows flaw.
Also any program with "install", "setup", or "patch" in it's name will, by default, prompt for elevation. Again I don't think this was a bad decision by MS because there's no easy way to tell if a program needs elevation if it lacks a manifest file. If the program doesn't conform to known installer types, checking the filename is about the only other thing you can do to try and figure out if it does. I consider the ability to exploit this minor, because you are still prompted by UAC.
And actually there are two updates for Vista and one for Office 2007... but they're just junk filters for Mail and Outlook, and the Malicious Software Removal Tool.
Score: 0
|The hackers still have many months (years maybe?) of massive XP usage to exploit.. Vista will be the target when the time comes, which will be soon I'm sure.
Score: 0
|I'm pleasantly surprised in the lack of holes in Office 2007.
Give Vista time, there's bound to be holes.
Score: 0
|"... it is possible for audio played over speakers to trigger Speech Recognition. This can do pretty much anything, although it is slowed by the rate of human speech and recognition."
This relies on:
1. The user being stupid enough to open a file crafted for the exploit.
2. For them to be running speech recognition.
3. For them to have set up their microphone facing the speakers (genius).
4. For the microphone and speakers to be set to *just* the right volume.
Sorry, but that is never, ever an exploit in my book.
It's a function doing what it's told. After all, it *is* supposed to recognise speech.
Score: 0
|No "Highly critical" updates, but over 11 "Recommended updates" and other "Optional Add-ons". Apparently folks are swift to comment on an OS that they aren't even using!
Score: 0
|