Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Microsoft Patches VML Vulnerability

kdawson posted more than 7 years ago | from the not-a-moment-too-soon dept.

130

Uncle Rummy writes, "Microsoft has quietly released an official patch for the zero-day VML vulnerability. The patch was publicly available yesterday, But Microsoft has just added it to the Security Bulletin Index." Eight days from time of first report to patch is pretty fast for Microsoft, and is almost two weeks ahead of their normal patch schedule. This security flaw was being aggressively exploited out in the wild.

cancel ×

130 comments

Sorry! There are no comments related to the filter you selected.

this patch was released before patch day? (5, Funny)

jimstapleton (999106) | more than 7 years ago | (#16216067)

How did it affect DRM such that it encouraged MS to do this?

Re:this patch was released before patch day? (0)

OverlordQ (264228) | more than 7 years ago | (#16216139)

How did it affect DRM such that it encouraged MS to do this?

Well just guessing but:

A) These people who write these patches, and the people who work on the DRM and probably not the same.
B) This probably has alot more code that needed to be changed then the DRM fix.

Re:this patch was released before patch day? (1)

notaspunkymonkey (984275) | more than 7 years ago | (#16216187)

I am guessing he was being sarcastic. but hey.. maybe I am wrong.. wouldnt be the first time.

Re:this patch was released before patch day? (1)

jimstapleton (999106) | more than 7 years ago | (#16216253)

it was pure sarcasm, meant mostly in jest, related to the comments on the previous DRM patch

Re:this patch was released before patch day? (1)

OverlordQ (264228) | more than 7 years ago | (#16216275)

I know he might have been saying that sarcasticly, but there's alot of people on /. who think there is a conspiracy about MS putting the DRM before security patches.

Re:this patch was released before patch day? (1)

BadAnalogyGuy (945258) | more than 7 years ago | (#16216345)

More likely that the testing requirements for even a small change to something as complex and widespread as a web browser is enormous. Fixing a buffer overflow, especially when a repro case exists, isn't the hardest thing in the world. Making sure that the changes don't break anything else is quite a bit harder, especially with a product that's already entered its maintenance phase and most of the team has moved on to the next version.

Re:this patch was released before patch day? (1)

Volante3192 (953645) | more than 7 years ago | (#16216455)

The kicker though, there's been zero day exploits that weren't patched before Patch Tuesday anyway. I can fully understand the desire to test it as thoroughly as possible, so I'm not too concerned about the 8 day delay (given the quagmire of code they have to work with)

What the surprise here is they DID release it early. This has happened only twice before, once with the Windows Meta File (back at the start of the year, http://www.informationweek.com/windows/showArticle .jhtml?articleID=175802202 [informationweek.com] ), which seemed to be under duress, and second with the DRM patch. More surprising is this one looks like it was done voluntarily.

Vendor Reviews... (3, Funny)

kf4lhp (461232) | more than 7 years ago | (#16216069)

Now to see how long it takes my vendors to say "OK, you can safely apply this patch."

Re:Vendor Reviews... (1)

toadlife (301863) | more than 7 years ago | (#16216247)

If your vendor is Cisco (Unity, etc) then I would estimate....six moinths.

Re:Vendor Reviews... (0)

Anonymous Coward | more than 7 years ago | (#16217195)

It looks like the security guy at Cisco currently is too busy to send out vulnerability notices to be able to review any patches. Be patient.

Re:Reviews... (1)

RR074862 (1003812) | more than 7 years ago | (#16216457)

A good move from Microsoft.I guess it's time to kill the Cyber criminals that are known to be using the bug to install keyloggers, adware and spyware and take over Windows PCs. Thank You Microsoft.

Yay. (-1, Offtopic)

Anonymous Coward | more than 7 years ago | (#16216073)

I've never been first to comment before, yay.

Re:Yay. (0)

Anonymous Coward | more than 7 years ago | (#16216609)

And you still aren't! ZOMGROFLAMOWTFBBQLOL!!!111one

Not an issue for some (-1, Redundant)

smooth wombat (796938) | more than 7 years ago | (#16216087)

This security flaw was being aggressively exploited out in the wild.


Only if you use Internet Explorer. For the rest of us, there's Firefox, Opera, Konqueror and other browsers which aren't embedded in the OS and so don't allow such nonsense to affect our systems.

Re:Not an issue for some (0, Troll)

notaspunkymonkey (984275) | more than 7 years ago | (#16216229)

Wow your so cool.. you throw in those nice alternate browser references nice and early on - sure to be modded insightful. Your comment was a waste of energy - it was an IE fix - and everyone here.. even the editors know that you don't have that problem unless your running windows.. idiot.

Re:Not an issue for some (2, Informative)

toadlife (301863) | more than 7 years ago | (#16216341)

Wow your so cool.. you throw in those nice alternate browser references nice and early on - sure to be modded insightful.


What's even cooler is that one of the browsers he mentions (Koqueror) is just as much "embedded into the OS" (i.e. uses shared libraries that if removed affect other userland programs) and IE.

Ten bucks says he still gets modded up for it.

Re:Not an issue for some (2, Insightful)

hal2814 (725639) | more than 7 years ago | (#16216535)

From what I understand, being embedded into the OS is not a matter of shared libraries in this case. Some of the IE code is actaully running in kernel mode. The Konqueror broswer runs entirely in user mode from what I understand. Konqueror does call external libraries and those external libraries may enter kernel mode for a few well-defined tasks, but nothing on the level of what IE does if what I've read about IE's internals is true.

Re:Not an issue for some (1)

plague3106 (71849) | more than 7 years ago | (#16216741)

Some of the IE code is actaully running in kernel mode.

Reference please?

Re:Not an issue for some (1)

toadlife (301863) | more than 7 years ago | (#16216873)

"Some of the IE code is actaully running in kernel mode"

Can you define "Kernel Mode". Googling, I see this [bellevuelinux.org] , which if is what you are talking about, tells me that you are wrong, because exploits in IE have no ability to gain priviledge higher than the user's.

These are the things I know from experience:

* Exploits that hit IE gain the priviledges of the user. Since most Windows users run as administrator, the priviledges are generally unlimited, but if the user is running as a restricted user, the exploit can not doing anything that the user can't do. This is standard for any userland program.

* IE can be completely neutered by denying access to a few key dlls. This will break certain other components of the OS, but contrary to many claims, will not cause Windows to be unusable, or unstable. Things that break when you neuter IE in this way are the help and support center (which is a glorified IE shell), and certain functionality in explorer.

Re:Not an issue for some (1)

rodgster (671476) | more than 7 years ago | (#16217923)

I enforced normal users for all desktop users. Myself included. Some poorly designed apps like quickbooks still require Power User. Some other poorly developed apps still require admin e.g. UPS Ship.

I've looked @ the nonadmin site (yours????) before and I don't see the dll security setting you reference (to neuter IE).

Would you mind spoon feeding me?

Thanks,

Re:Not an issue for some (1)

toadlife (301863) | more than 7 years ago | (#16218521)

We use UPS world ship. It ships with a little program you can run that will make it work for regular users. It's in the program directory (normally C:\ups I think). I don't remember the name of the utility and the computers I know run it are not on, so I can';t find it right now. Browse the program directory and look at the .exe files and you should be able to find it. Run it as an administrator and your users will be able to use the program without any special rights.

As for diabling IE, I can't remember the dlls. I found them by running process explorer and looking at which dlls IE used. One of them is "mshtml.dll". Deny "everyone" access to that dll and I'mmpretty sure IE will puke when you try and use it. I personally don't bother, because IMO IE is not as huge a security threat if you practice other more important secuirty practices - such as running as a non-admin, or simply choosing not to use it.

The non-admin site is not mine. I've just contributed to it.

Re:Not an issue for some (1)

toadlife (301863) | more than 7 years ago | (#16218875)

Also, you mentioned quickbooks. This too can be fixed easily to work for regular users by modifying a few permisions. The vendor of Quickbooks has a KB article on their website that explains how to fix it.

Re:Not an issue for some (1)

Richard_at_work (517087) | more than 7 years ago | (#16217031)

No, IE does not run in kernel mode in any way shape or form, its a common misconception. khtml is a lot more like mshtml.dll than people would like to admit.

Re:Not an issue for some (0)

Anonymous Coward | more than 7 years ago | (#16217059)

From what I understand, being embedded into the OS is not a matter of shared libraries in this case. Some of the IE code is actaully running in kernel mode.
You understand wrong.

The "integration into the OS" is that Internet Explorer is tied to Explorer, the Windows Shell. Absolutely nothing of Internet Explorer is running in kernelspace.

Re:Not an issue for some (1, Interesting)

hal2814 (725639) | more than 7 years ago | (#16217193)

"The "integration into the OS" is that Internet Explorer is tied to Explorer, the Windows Shell."

Which is part of the window manager which according to this image from microsoft.com [microsoft.com] has been run in kernel mode since NT 4.0 (Article ref [microsoft.com] ). If that weren't the case, then Explorer could not hang the window manager (which it sometimes does).

Re:Not an issue for some (1)

borgboy (218060) | more than 7 years ago | (#16217433)

Please explain how the diagram you cite shows Explorer to run in the Executive.

Re:Not an issue for some (0)

Anonymous Coward | more than 7 years ago | (#16217559)

By that logic, all software runs in kernelspace, because all software talks to the kernel.

The problem with IE is ActiveX, and the fact that its users are almost all Administrators, not that it's integrated with Explorer, which is part of the window manager, which talks to the kernel.

Re:Not an issue for some (1)

toadlife (301863) | more than 7 years ago | (#16217819)

"By that logic, all software runs in kernelspace, because all software talks to the kernel."

Oh crap. You're right. I'm no expert, but do you think we could mitigate this risk but using an OS with no kernel?

Hurd maybe?

Re:Not an issue for some (0)

toadlife (301863) | more than 7 years ago | (#16217739)

Which is part of the window manager which according to this image from microsoft.com has been run in kernel mode since NT 4.0 (Article ref).


Yes, the "Window manager". The equivalent of that in *nix would be X, which runs also in kernel mode. Your point?

If that weren't the case, then Explorer could not hang the window manager (which it sometimes does).


Explorer does not have the ability to arbitrily "hang the Window manager" in Windows. If the system has buggy drivers or what not, the "Window manager" can certainly hang itself though. I realize that the Window manager and GDI running in kernel mode has the potential to make WIndows less reliable than other OS's, but it has nothing to do with Internel Explorer, or Explorer.

Re:Not an issue for some (0)

Anonymous Coward | more than 7 years ago | (#16219507)

> The equivalent of that in *nix would be X, which runs also in kernel mode. Your point?

Uh ? X runs in kernel mode ? Nonsense !

Re:Not an issue for some (1)

toadlife (301863) | more than 7 years ago | (#16219837)

Uh ? X runs in kernel mode ? Nonsense !

It's runs with root-level permisions, and the drivers run in kernel mode.

What exactly is nonsense?

Wow (0)

Anonymous Coward | more than 7 years ago | (#16219985)

The above poster got modded up three times for posting something that is 100% wrong.

It certainly pays to be an ignorant Microsoft basher on Slashdot.

Re:Not an issue for some (0)

Anonymous Coward | more than 7 years ago | (#16219215)

The difference is, remove Konqueror from your system, and KDE won't go boom. Remove IE from the oldstyle Win98 & have an unusable system. Konqueror is just another program that uses KDE/QT core libraries. Nothing critical in itself. And those libraries are installed (on my FC5 system, anyways) seperate from Konq.

Re:Not an issue for some (0)

Anonymous Coward | more than 7 years ago | (#16220073)

Windows 98?

Should we bring up Slackware 96 issues too?

Re:Not an issue for some (1)

Red Flayer (890720) | more than 7 years ago | (#16216353)

Your comment was a waste of energy - it was an IE fix - and everyone here.. even the editors know that you don't have that problem unless your running windows.. idiot.
Wow, ur so kewl 2! You can point out when someone is making an obvious point, but then completely blow it when you refer to running windows as if the OP had commented on it being a Windows-only vulnerability... when the OP only referred to other browsers, not other OSs.

Flame on, if you like, but having something more useful or amusing to add to the conversation would be great -- instead of the bitter rantings of an idiot with a superiority complex.

Now, if you'll excuse me, I've got to figure out where I put my Hypocrasy Merit Badge.

Re:Not an issue for some (1)

gbjbaanb (229885) | more than 7 years ago | (#16216285)

and only if tyou use IE6. If you have IE7 beta installed, you're safe.

Re:Not an issue for some (1)

GreggBz (777373) | more than 7 years ago | (#16216485)

I need a break from this place.

It's like a when your Commodore 64 locked up, and it keept making that same horrible floppy drive noise over and over and over again..

the first rule of slashdot (1)

weierstrass (669421) | more than 7 years ago | (#16218147)

when moaning about slashdot, make sure you mention your girlfriend

if you don't have a girlfriend, mention that you used to have an 8-bit computer

Re:Not an issue for some (2)

mshmgi (710435) | more than 7 years ago | (#16216523)

I'd be willing to bet that Mac OS X/Linux users would have a lot more security problems if we used "SoftwareUpdate.app" (in the case of OS X) or "sudo apt-get" (in the case of Linux) as our default web browser.

Thankfully, only Microsoft has been daft enough to use a single piece of software to both browse the web and tinker w/ the core of the operating system.

Until somebody in Redmond decides to develop a standalone app for system updates and limits IE to being a web browser ONLY, Windows users will continue to be plagued by this crap.

Re:Not an issue for some (1)

toadlife (301863) | more than 7 years ago | (#16217295)

In WindowsXP you can run `wuauclt /detectnow` which causes the Windows Update client to check for updates immediately. From there you can install udpates after the little icon pops up in your system tray. This is not perfect, but it does mean you don't have to use IE. In Windows Vista the update function has it's own control panel app and updating via the browser is not possible.

Re:Not an issue for some (1)

mshmgi (710435) | more than 7 years ago | (#16218463)

The problem isn't that MS doesn't offer a non-IE way to conduct system updates. The problem is that MS allows IE to conduct system updates in the first place. 85% of the world's population uses IE as their default browser. It doesn't matter if there exists an alternate method for updating the OS. What matters is that 85% of the world is using their OS update utility as a web browser - that's just scary.

Re:Not an issue for some (1)

toadlife (301863) | more than 7 years ago | (#16218823)

Uhhh. Any browser could be used to do system updates using java applet. Microsoft's just happens to use ActiveX instead of Java.

The scary part is not that people use the browser in that way. It's that people run with root-level access, which allows them to use their browser in that way.

Re:Not an issue for some (1)

paralaxcreations (981218) | more than 7 years ago | (#16219625)

And the scarier part is that even when they WANT to run as regular users (which entails creating a new user since the default user is an adminstrator. This is something most Windows users don't know how to do because they don't know why they need to do it), they'll find that most of their software no longer runs.

Compare to...any other OS: they tell you right off the bat "hey, you probably don't want to run as administrator. Here, let me make you a limited account that you should use to access your computer. It will work just fine for most of your needs, trust me."

Now excuse me while I find my tinfoil hat and try to figure out why exactly MS wants us to all run as admins.

Re:Not an issue for some (1)

Ooble (917932) | more than 7 years ago | (#16219533)

You'll be happy to know Vista uses a standalone app to manage Windows Updates.

Not a bad turnaround (2, Interesting)

dynemo (650078) | more than 7 years ago | (#16216111)

Sometimes, I feel like security researchers are intentionally disclosing their new vulnerability information as close to the "Patch Tuesday" as possible in an attempt to force Microsoft to release an out of cycle patch. This time they were successful.

Re:Not a bad turnaround (0)

Anonymous Coward | more than 7 years ago | (#16216357)

You got this one backwards. This was an in-the-wild exploit that security experts found. Microsoft was then notified, and started their effort. The ZERT folks then came out with their own patch for the problem. Microsoft then released the "official" patch.

Re:Not a bad turnaround (4, Insightful)

LurkerXXX (667952) | more than 7 years ago | (#16216483)

Umm, here's a big clue for you...

The virus/worm writers are the ones releasing the exploit into the wild the day after patch Tuesday.

That way they are more likely to have it expand for an entire month before MS patches it and messes up their fun.

Security researchers generally want things secure. Virus/Worm writers don't.

Re:Not a bad turnaround (1)

TheOtherChimeraTwin (697085) | more than 7 years ago | (#16219705)

The virus/worm writers are the ones releasing the exploit into the wild the day after patch Tuesday.

I'm a little surprised they don't unleash their nasties on Monday, before Patch Tuesday. It isn't like Microsoft could make corrections that quickly.

Firefox not vulnerable because VML not supported? (4, Informative)

BadAnalogyGuy (945258) | more than 7 years ago | (#16216125)

I had no idea what VML was, so I did a little digging and found the following links.

W3C's introduction to VML: http://www.w3.org/TR/NOTE-VML [w3.org]

Microsoft's brief introduction to VML: http://msdn.microsoft.com/workshop/author/vml/defa ult.asp [microsoft.com]

Interestingly, the MS page includes a demo "oval with red background" which doesn't work in my Firefox browser.

Re:Firefox not vulnerable because VML not supporte (3, Insightful)

Sephiroth9611 (854458) | more than 7 years ago | (#16216153)

Of course it didn't work in Firefox. MS is not interested in creating webpages that will work in other people's browsers.

Re:Firefox not vulnerable because VML not supporte (1)

BadAnalogyGuy (945258) | more than 7 years ago | (#16216183)

VML is a standard from almost a decade ago. Firefox wasn't even on their radar in 1998.

Some clarification. (4, Informative)

hullabalucination (886901) | more than 7 years ago | (#16217023)

VML is a standard from almost a decade ago.

It isn't a standard, it was a submission to the W3C for consideration, by Microsoft and some of its useful idiots (HP, Macromedia, Autodesk, Visio). Submissions don't automagically get the thumbs up from the W3C. According to Wikipedia, Adobe, Sun and others submitted a proposal for a competing technology called PGML. Best features of the two technologies were then merged and improved upon to produce:

SVG: http://www.w3.org/TR/SVG10/ [w3.org]

SVG became a W3C recommendation on September 4, 2001. Later versions of Opera, Firefox and some other browsers implement at least limited support for SVG. It's also a standard vector graphics creation/exchange format for many open source graphic apps like Inkscape and Scribus. Adobe Illustrator and CorelDraw also support SVG fairly capably. Guess whose browser pointedly doesn't support SVG?

http://en.wikipedia.org/wiki/Vector_Markup_Languag e [wikipedia.org] Check out the code samples. The SVG code is quite a bit more compact than its VML equivalent.

Folks on SVG-rendering browsers (Firefox 1.5.x, Opera 8 and above) will possibly enjoy this little demonstration: http://isthis4real.com/orbit.xml [isthis4real.com]

* * * * *

It's a small world, but I wouldn't want to have to paint it.
—Stephen Wright

Re:Some clarification. (1)

DerPflanz (525793) | more than 7 years ago | (#16219577)

In my work, I created a SVG-based SCADA-like package. I had to build it to run in Adobe's SVG Viewer, because the native Firefox and Opera implementations couldn't run it. Note that I wrote the whole thing with the W3C docs in my hand, not with trial-and-error in the plugin.

The Firefox implementation misses critical things (the viewbox has some problems) and it is very heavy and slow, compared to Adobe's implementation. The Adobe plugin works right in IE, crashes in Firefox under Windows. Firefox in Linux has to use the beta version.

I like SVG and what you can do with it, but the implementations should get better, much better (think Flash-like performance and possibilities; it's all in the standard) to catch on and be that Flash-killer it is supposed to be.

Re:Firefox not vulnerable because VML not supporte (0)

OverlordQ (264228) | more than 7 years ago | (#16216207)


Interestingly, the MS page includes a demo "oval with red background" which doesn't work in my Firefox browser.


VML isn't a standard, it was rejected by the W3C.

Given how Firefox ignores things like MNG and SVG, not surprised they didn't implement VML.

Re:Firefox not vulnerable because VML not supporte (1)

BadAnalogyGuy (945258) | more than 7 years ago | (#16216241)

Thanks for that information. From just the brief search I ran, I was under the impression it was already approved (and simply unimplemented).

Do you have a link?

Re:Firefox not vulnerable because VML not supporte (1)

OverlordQ (264228) | more than 7 years ago | (#16216509)

Just what I found on WikiPedia, that and there doesn't seem to be any followup on the W3C site past the initial submission for consideration.

SVG not ignored by Firefox (2, Informative)

6031769 (829845) | more than 7 years ago | (#16216465)

SVG [mozilla.org] is not ignored by Firefox nor by Mozilla as a whole.

HTH

Re:Firefox not vulnerable because VML not supporte (0)

Anonymous Coward | more than 7 years ago | (#16218413)

Surely you're trolling? It's not exactly a well-kept secret that Firefox supports SVG.

if browserid NOT Equal TO IEXP, mangle.page .. (1)

rs232 (849320) | more than 7 years ago | (#16217071)

"Interestingly, the MS page includes a demo "oval with red background" which doesn't work in my Firefox browser

Interesting enough the page layout is displayed correctly if Firefox changes User Agent ID to Internet Explorer 6. Under default Firefox ID it displays as a drap one page layout. Why does Microsoft mangle its own pages if viewed under a non MS browser.

if ($browserid!=IEXP) { mangle.page(); else display.page(); }

was: Firefox not vulnerable because VML not supported?

Re:Firefox not vulnerable because VML not supporte (0)

Anonymous Coward | more than 7 years ago | (#16218559)

Gonna roll the dice before I follow the Wikipedia link:

Virus Markup Language?

Vulnerability Markup Language?

Virtual Messy Layer?

Could this have something to do with... (4, Insightful)

shoolz (752000) | more than 7 years ago | (#16216159)

...the unofficial patch [heise-security.co.uk] that was release by independant security specialits? A bit of a black eye for MS, no?

Probably not (4, Insightful)

Sycraft-fu (314770) | more than 7 years ago | (#16216503)

They release patches for critical, out in the wild, flaws as soon as they get them certified. You have to realise that they can't just release a patch right off, by their own policy and as a matter of practise. They have to go through a rather extensive certification procedure to make sure it won't cause computers to blow up. It's similar to patches you see for other OSes like Solaris. You'll hear of a bug and they'll be a patch out, but not one form Sun. That comes a bit later, after they've had time to test it.

You might not agree with the policy but that's how it is, and there are reasons for doing it that way. People already whine about patches breaking systems when at present it's an extremely rare occurrence (in all the cases I've encountered, said system was spywared and that was the problem). If they rushed patches out without testing and they ended up breaking things, it could easily get to a state where people refused to patch because they were more scared of the patch than the problem.

We are dealing with non-technical users here, remember. A patch can't include a page of instructions of things you need to check first, nor can it be assumed that if it causes a problem the user can troubleshoot and fix it. It pretty much has to work straight off, and has to do so on literally tens of millions of permutations of software and hardware configurations.

Personally I'd like to see a compromise where they'd release an unofficial, untested patch for power users as soon as they could and the full patch later after testing. However the likely problem would be the unofficial patch would get in the wild, people would tout it as the official MS patch, something would go wrong, and they'd get blamed anyhow.

Re:Probably not (1)

Feyr (449684) | more than 7 years ago | (#16216667)

/ it could easily get to a state where people refused to patch because they were more scared of the patch than the problem.

that's already the case, even if they HAVE improved in recent years. there's still the stigma associated with patches that seriously broke systems in nt4 and 2k

the only reason i don't worry about patches breaking my (windows) systems is because they're not critical enough to warrant it just let the auto update do its job. my linux servers, on the other hand, get tested thoroughly before deploying anything major.as much as i'd like to feel smug and say "haha this doesn't happen with linux!!!!" it's just not true, and oftentimes an apt-get upgrade will break something

Re:Could this have something to do with... (1)

BadAnalogyGuy (945258) | more than 7 years ago | (#16216551)

A couple things about that.

First, if users install a foreign version of VML.DLL via the Heise patch (I don't know the details of that patch), then they run the risk of flagging their software as "non-genuine" and may lose the ability to get further updates from WindowsUpdate. From Microsoft's point of view, they don't want the headache of dealing with these users who broke the genuineness of their software, so getting a patch out quickly to head it off at the pass is in their best interest.

Second, if the Heise patch simply unregisters the VML dll, then the browser's featureset has been reduced. This is not a fix. It is a workaround, and it causes loss of functionality (albeit very rarely used functionality).

I don't know why they released so early, but it is possible that a 3rd party patch which they are unable to verify the safety of may prompt them to do so.

Re:Could this have something to do with... (0)

Anonymous Coward | more than 7 years ago | (#16218593)

If you don't know any details about the unofficial patch, why are you blowing smoke out of your arse on the subject?

Takes less time to learn the particulars about the zeroday patch than it does to write your hand-waving, content-free post

sigh - roll my eyes (-1, Offtopic)

Anonymous Coward | more than 7 years ago | (#16216219)

All your base belong to us. You stupid Winsuckers.

Mods: mark everyone else redundant.

Maybe they should have tested it more... (2, Informative)

HaeMaker (221642) | more than 7 years ago | (#16216329)

Installing the patch crashes svchost on my system.

Re:Maybe they should have tested it more... (0)

Anonymous Coward | more than 7 years ago | (#16216369)

e-mail them and strongly complain, partly because it might force a better patch, and partly because it'll make them look stupid

Re:Maybe they should have tested it more... (3, Funny)

BadAnalogyGuy (945258) | more than 7 years ago | (#16216371)

Back out that change, install Firefox, and go and sin no more.

Re:Maybe they should have tested it more... (0)

Anonymous Coward | more than 7 years ago | (#16216393)

They can't win! First people want patches for security holes. Then they want the patches as soon as possible. Then they want patches that don't introduce new security holes. Then they want patches that don't corrupt data. And now they want patches that don't crash other programs! It's tough being Microsoft.

Maybe you should tell us more (0)

Anonymous Coward | more than 7 years ago | (#16217041)

If you want to be helpfull rather than biatching and moaing, you could tell the configuration of the system that's having the problem.

Seeing as how I've applied this patch to about 20 machines running Win2K, XP Home, XP Pro, Win2k Svr, Win 2k3 Svr 32-b, and Win 2k3 Svr 64-b, all without any ill effects...

Re:Maybe they should have tested it more... (1)

j79zlr (930600) | more than 7 years ago | (#16217091)

The installation failed on my work PC running Windows 2000. I checked the installation logs and manually editted the permissions on this registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\VGXUpdate Using regedt32.exe set full control to administrators and system users.

Microsoft Patches IE Browser Flaw (2, Funny)

RR074862 (1003812) | more than 7 years ago | (#16216349)

The Internet Explorer patch was released early because Microsoft was concerned of the critical risk to users. The vulnerability involves the way that the browser handles Vector Markup Language (VML) graphics. Malicious hackers can exploit the flaw by creating a Web page that can download spyware or keyloggers onto a user's system.

Re:Microsoft Patches IE Browser Flaw (1)

truthsearch (249536) | more than 7 years ago | (#16216499)

The Internet Explorer patch was released early because Microsoft was concerned of the critical risk to users.

I see by your ID (over 1 million, congrats /.!) that you're new here. So we'll let this comment go with just a laugh. Microsoft... caring about... users... hahaha....

Re:Microsoft Patches IE Browser Flaw (1)

Shawn is an Asshole (845769) | more than 7 years ago | (#16218149)

It's more likley that they found a way to use the exploit to bypass their DRM, which gives it more of a priority...

Good for them. (1)

Grendel Drago (41496) | more than 7 years ago | (#16216467)

Good for them, doing the right thing here and all.

It's kind of funny how the security bulleting reads "Vulnerability in Vector Markup Language Could Allow Remote Code Execution". We're not saying that it does, but we think it's possible.

Gee. Ya think?

Re:Good for them. (1)

solevita (967690) | more than 7 years ago | (#16216567)

I think that's better than saying "Vulnerability in Vector Markup Language Does Allow Remote Code Execution", after all, just having the vulnerability doesn't mean that code will be executed. You still have to run IE and visit a malicious website.

Imagine a PC with no network conection at all - a vulnerability in VML is not going to lead to remote code execution.

actually not yet in the Index (0)

Anonymous Coward | more than 7 years ago | (#16216531)

Actually, the patch is NOT yet in the Security Bulletin Index as of this time. The patch is out there, but the link in the bulletin index isn't there right now. Hopefully, that web page will be updated soon.

Re:actually not yet in the Index (1)

Uncle Rummy (943608) | more than 7 years ago | (#16217491)

You're right, of course. What I submitted originally read "...The patch was publicly available yesterday, but Microsoft hasn't yet added it to the Security Bulletin Index." I added that bit specifically because it's puzzling that MS would release such a critical patch but not tell anybody. Don't ask me why kdawson saw fit to change it to the innacurate version that got posted.

XP SP2 problems (5, Informative)

BenEnglishAtHome (449670) | more than 7 years ago | (#16216603)

I work in a large organization that push-deployed the patch asap. The result is that any XP machine sitting at Service Pack 1 level for the OS can no longer be successfully updated to SP2 without first deleting a file (c:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll on our image). Then we can install SP2, then re-install the 0-day.

What a pain in the ass. Is everybody seeing the same trouble?

Re:XP SP2 problems (1, Interesting)

Christopher_G_Lewis (260977) | more than 7 years ago | (#16216685)

Why oh why in the world do you still have machines at SP1?

What's the name of your organization. I'd like to make sure I don't have any of your stock.

Re:XP SP2 problems (1)

BenEnglishAtHome (449670) | more than 7 years ago | (#16218069)

You don't have any stock in us [irs.gov] .

Why do we have any left at SP1? I could be flip and say it's because we relied on Tivoli to update them, but I won't go there. Basically, we updated about 100K machines and are hunting down the last few hundred, mostly laptops belonging to people who spend all their time in the field and try to never come into the office where they can be updated. (Among our old-timers, it's a real badge of honor to brag that they haven't been in the office in 6 months.) Internal politics prevents us from simply locking those people off the network; we have to chase them down and say please. For any organization-wide update, there are always a few like that.

Re:XP SP2 problems (1, Interesting)

plague3106 (71849) | more than 7 years ago | (#16216877)

SP1 isn't supported anymore, so I don't know why you're still running it. At any rate, I would install SP2 before going off to install other patches anyway...

It's NOT! 10/10/2006! (2, Insightful)

antdude (79039) | more than 7 years ago | (#16217959)

Its support will expire on October 10, 2006 according to Automatic Updates service. Also, see this Microsoft Web page [microsoft.com] . It's soon, but not over yet.

Re:XP SP2 problems (0)

Anonymous Coward | more than 7 years ago | (#16218099)

Becuase in the real world you can't always keep everything up to date. Where I work we finally phased out Win9x less than a year ago! We still have 2K machines on SP2. We have a lot of XP SP1 machines. Everything we put out is up to date, but we have a LOT of users and no real authority to force updates on them. In those rare cases where we have forced updates the fucking patches have ended up breaking things - most recently there was an IE patch that broke Siebel. It was a critical patch so we got special permission to force it onto everyone and then it blew up in our face. Never going to happen again.

Re:XP SP2 problems (2, Insightful)

Anonymous Coward | more than 7 years ago | (#16217051)

Is everybody seeing the same trouble?

The only trouble I am seeing is why it has taken you so long to put SP2 on [some of] your machines.

Re:XP SP2 problems (0)

Anonymous Coward | more than 7 years ago | (#16218985)

It is the IRS, what do you expect?

Re:XP SP2 problems (1)

Shawn is an Asshole (845769) | more than 7 years ago | (#16218333)

Why are you trying to update SP1 to SP2? If it's for new installations, you really should learn about Slipstreaming. It's really easy to do.

In fact, here is a script that will not only splipstream in SP2, but all critical updates automatically:

http://smithii.com/?q=node/12 [smithii.com]

ZERT fix and FAQ entry written too (1)

jjMick (911387) | more than 7 years ago | (#16216607)

There was a 3rd party fix from Zeroday Emergency Response Team http://isotf.org/zert/ [isotf.org] (ZERT) available too and FAQ document written: http://www.securityfocus.com/bid/20096/references [securityfocus.com]

FAQ document here: http://blogs.securiteam.com/?p=640 [securiteam.com]

Change the icon please (2, Funny)

140Mandak262Jamuna (970587) | more than 7 years ago | (#16216637)

MSFT fixes a bug. Then it fixes the patch. Patches the patch. So is that dead bug a good choice as an icon? Please change it to phoenix bird. It is supposed to die and come back alive from its ashes.

Fixed last week (1)

raind (174356) | more than 7 years ago | (#16217069)

Thanks to these folks: http://isotf.org/zert/ [isotf.org]

Cant install this or a few other patches..help? (1)

SteveXE (641833) | more than 7 years ago | (#16217633)

For some reason this and 3 other "Critical" patches refuse to install on my system. I've been verified genuine and gone through the MS tech support hoops to no avail. The install always fails and gives me a generic error code. Here are the patches I need but cant get no matter what I do, if anyone knows a possible solution I wont complain.

Security Update for Windows XP (KB917344)
Cumulative Security Update for Internet Explorer for Windows XP (KB918899)
Security Update for Windows XP (KB925486)

Error codes / "only 8 days" (1)

mackyrae (999347) | more than 7 years ago | (#16218169)

I just want to point out that ALL error codes on Windows are "generic". My computer switched into 640x480 with 8-bit color and it told me "there was an error" like it wasn't really obvious.

I can't really help you though.

So, MS takes "only" 8 days to release a patch, and Firefox gets patches out in a day...which seems better: having exploits running around for over a week being hacked at or having it fixed immediately?

Re:Cant install this or a few other patches..help? (1)

Dog-Cow (21281) | more than 7 years ago | (#16218753)

I went through MS tech support to get WU working on an XP machine, and I saved all the emails in the event that the problem came up again. Send a note to avi.slashdot@mail.ashevin.com and I'll be glad to share them with you.

If only... (1)

Vexler (127353) | more than 7 years ago | (#16217687)

...they release their operating systems as quickly as they do their security patches. Eight days from the first report to a working patch? That's working fast!

microsoft too late again? (1)

pk073900 (1006369) | more than 7 years ago | (#16217729)

yeah thanks to zert for stepping in with the fix. microsoft did not have "time" to release a patch. for what i understand microsoft only released the patch a few days after the third party patch appeared online. coincidence or what? with microsoft being reluctant to change their monthly update cycle. attackers have taken advantage of this. i cant understand why they are reluctant to do this. microsoft just let their users systems be vulnerable and unprotected for several weeks until the new patch is updated. to me this is a concern especially now when zero-day vulnerabilities wont be left alone by the attackers. microsoft should do better to protect their users.

Firefox & VML (0)

Anonymous Coward | more than 7 years ago | (#16217855)

So, talking theoretically....

If someone where to have a Firefox cache file that was infected by Bloodhound / The VML vuln. would there be any concern for that user?

Quietly? (2, Insightful)

kitman420 (864936) | more than 7 years ago | (#16218205)

Why is it that every time a patch is announced nowadays, it's announced as "X quietly releases a patch"? What? do they need fanfare or something?

Re:Quietly? (1)

Uncle Rummy (943608) | more than 7 years ago | (#16219083)

Quietly as in Microsoft apparently hasn't done any of the things they normally do when they release an offcycle patch, especially for a critical vulnerability with multiple known exploits in the wild and ample media coverage thereof.

I haven't seen an email notification from Microsoft for this patch yet, and it still hasn't been listed in their Security Bulletin Index (and when I submitted the article, it said as much - for some bizarro reason kdawson decided to change it to the innacurate text stating that it *is* listed in the index before he posted the article).

For this type of patch, it should indeed be accompanied by enough fanfare to make people aware that it exists, especially since it comes well off the established monthly Microsoft patch cycle.

VML's real name (1)

springbox (853816) | more than 7 years ago | (#16218439)

I knew it! It's Vulnerable Markup Language!
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>