Random Entry: Death and Cancer
< Sun Recommended Patch Management Policy | Microsoft Virtual Server 2005 >
< Sun Recommended Patch Management Policy | Microsoft Virtual Server 2005 >
Microsoft has released it's usual round of Tuesday patches. For the first time I decided to do more than a cursory examination of the announcements and the associated vulnerabilities. It is enough to stop me using windows ever again.
- MS04-038: Cumulative Security Update for Internet Explorer (834707)
- MS04-037: Vulnerability in Windows Shell Could Allow Remote Code Execution (841356)
- MS04-036: Vulnerability in NNTP Could Allow Code Execution (883935)
- MS04-035: Vulnerability in SMTP Could Allow Remote Code Execution (885881)
- MS04-034: Vulnerability in Compressed (zipped) Folders Could Allow Code Execution (873376)
- MS04-033: Vulnerability in Microsoft Excel Could Allow Code Execution (886836)
- MS04-032: Security Update for Microsoft Windows (840987)
- MS04-031: Vulnerability in NetDDE Could Allow Remote Code Execution (841533)
- MS04-030: Vulnerability in WebDav XML Message Handler Could Lead to a Denial of Service (824151)
- MS04-029: Vulnerability in RPC Runtime Library Could Allow Information Disclosure and Denial of Service (873350)
Lets have a look at MS04-038 for a start. It is a cumulative patch for eight IE vulns:
- CSS Heap Memory Corruption Vulnerability - CAN-2004-0842:
- Similar Method Name Redirection Cross Domain Vulnerability - CAN-2004-0727:
- Install Engine Vulnerability - CAN-2004-0216:
- Drag and Drop Vulnerability - CAN-2004-0839:
- Address Bar Spoofing on Double Byte Character Set Systems Vulnerability - CAN-2004-0844:
- Plug-in Navigation Address Bar Spoofing Vulnerability - CAN-2004-0843:
- Script in Image Tag File Download Vulnerability - CAN-2004-0841:
- SSL Caching Vulnerability - CAN-2004-0845:
From here I recommend IE users don't follow the links to:
- http://freehost07.websamba.com/greyhats/hijackclick3.htm
- http://www.malware.com/paul.html
- http://www.malware.com/wottapoop.html
Lets move on shall we. You use firefox instead of the browser that fucks things up, so you think you are safe. The vulnerability in windows shell sounds like a good place to disprove that. The google search shows nothing, so I head on over to scurn (tick everything except Packetstorm) and find a reference to it at Secunia (they are quite good too). Unfortunately those links weren't very helpful so after some more poking around I found the original posts here and here. It looks like this one will work on IE and Mozilla, with the actual overflow in the Program Group converter.
Then there is the compressed folders vulnerability. This one was not previously disclosed but was 'responsibly' disclosed to the vendor and this is the first we are hearing about it. The actual eEye advisory has the juicy details. It requires a overflow in the zip file's filename.
The point here is that you have Microsoft releasing patches on the second Tuesday of each month. This month we have 7 out of 10 announcements being critical with a few very easy exploits. Last month we had the GDI+ exploit which people are still having trouble patching and required a third party tool for proper scanning. Thats a lot of critical vulns in a very short time. After checking out the dates on the above vulnerabilities I noticed that they were both originally disclosed in July.
THAT'S 3 MONTHS!
This means crackers have had access to this information and been honing the exploit, checking out their targets, looking for the one hole they need to break in while Microsoft's faithful customers have only just found out, and they need to close every potential hole.
The argument is that releasing patches on the second Tuesday makes it easier for companies to schedule their patching. Companies can have their own internal schedule, instead of sitting in the dark getting hacked while Microsoft does their business tasks for them. To be completely fair not all of the advisories are as bad as the IE one.
With popular open source software you often have a patch being provided with the original announcement, and if the creator of the software is snoozing, the community generally gets the patch out very quickly. This isn't guaranteed with open source, but it almost is with popular open source products.


Thank God. Microsoft seems to be slowly getting it. After responding to 'consumer pressure' they have decided to release advanced notification of the security updates they release on the second Tuesday of every month.Thus instead of the mad scramble to ap
Tracked: Nov 05, 02:15
This is something I have spoken about before, but it is nice to have a big vendor backing me up. Releasing patches on a regular schedule doesn't make sense. The argument for it is that it makes things easier for firms as they can schedule their patching
Tracked: Mar 09, 11:09
I just pointed this out in my last entry, but I felt it deserved its own entry. I once discussed the trade-off inherent in introducing a patch schedule, and I have said it before (one, two, three). The latest patches from Microsoft fix some vulnerabilit
Tracked: Dec 15, 17:52