ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev
Home / News & Blogs / Zero Day

Microsoft warns of dangerous IE browser vulnerabilities

By | February 14, 2012, 11:19am PST

Summary: The most severe vulnerabilities could allow remote code execution if a user simply views a specially crafted web page using Internet Explorer.

Microsoft is warning all users of its Internet Explorer web browser to immediately apply the latest security patch as a precaution against malicious hacker attacks.

As part of its Patch Tuesday releases, the company shipped a high-priority IE update (MS12-010) which covers four documented vulnerabilities that could be used in drive-by downloads with minimal user action.
follow Ryan Naraine on twitter
The update is rated “critical” for Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows client machines and Microsoft expects to see reliable exploit code published with the next 30 days.

The most severe vulnerabilities could allow remote code execution if a user views a specially crafted web page using Internet Explorer, Microsoft warned.

[ SEE: Hackers pounce on just-patched Windows Media vulnerability ]

The IE patch addresses the vulnerabilities by modifying the way that Internet Explorer handles content during copy and paste processes, handles objects in memory, and creates and initializes strings.

The company is also urging Windows users to pay special attention to MS12-013, a critical bulletin that fixes a flaw that could allow remote code execution if a user opens a specially crafted media file that is hosted on a website or sent as an email attachment.

From the bulletin:

A remote code execution vulnerability exists in the way that the msvcrt DLL calculates the size of a buffer in memory, allowing data to be copied into memory that has not been properly allocated. This vulnerability could allow remote code execution if a user opens a specially crafted media file. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft also noted that any application that uses msvcrt.dll could be affected by this vulnerability, meaning that some third-party applications may also be vulnerable.

[ SEE: Patch Tuesday heads-up: 21 vulnerabilities, including 'critical' IE bulletin ]

This month’s batch of patches also fixes remote code execution vulnerabilities in Windows kernel mode drivers, privilege escalation flaws in ancillary function driver, security holes in Microsoft SharePoint, code execution holes in color panel control and dangerous security problems in Indeo codec and Microsoft Visio Viewer 2010.

The company also shipped fixes for vulnerabilities in .Net Framework and Microsoft Silverlight.

[ SEE: Ten little things to secure your online presence ]

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Topics

Vulnerability, Bulletin, Security, Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
Ask a Question Start a Discussion
118
Comments
Add Your Opinion

Join the conversation!

Just In

RE: Microsoft warns of dangerous IE browser vulnerabilities
famulla 21st Feb
@patt1 ...I agree Unix like COBOL is great we need to have as many as we can, try crack this crack that it is like the button on the wrist watch. If you do not try how will you learn and do not be afraid, these we days if you get in a position you cannot come out get a buy of 15 these kids are whiz I thank you Firozali A.Mulla DBA
View in thread
0 Votes
+ -
Theme: Remote Code Execution Repairs
daikon Updated - 14th Feb
Its not just a job, its an adventure!

Kudos to Jan Schejbal, Stephen Fewer, and Jason Hullinger for reporting these vulnerabilities to help protect users.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
toddbottom 14th Feb
@daikon
And thanks Linux.

And thanks Apple.

They are all the same. They all have vulnerabilities. If this upsets you so much, maybe you should consider a job that doesn't use computers in any way?
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
daikon 14th Feb
@toddbottom
Go ahead explain They are all the same.
0 Votes
+ -
He did.
ye 14th Feb
@daikon: Right here:

"They all have vulnerabilities."
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
daikon 14th Feb
@ye
Must be a typo then. Two separate sentences.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
thoiness Updated - 15th Feb
@toddbottom All operating systems, and all software written has vulnerabilities that can be exploited, but Internet Explorer is just one piece of software that just needs to die.

I like Microsoft, I appreciate and use Windows, but IE is a disaster, and has been the one thing standing in the way of progress. It started it's life not adhering to the web standards, not adopting W3C outlines, and making the web a fragmented experience. To add to that, it has been the hacker's focal point for the last few generations. Secure or not, it is the browser of choice for hackers, because it has the market share and is the default install (attractive to non-technical users).

The death of IE has been LONG overdue.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
LyonJE 15th Feb
@toddbottom No, you've missed the point -- Microsoft is having to urge all users to apply the patch. That's not necessary with Google's Chrome browser. It's not about how many vulnerabilities there are (and that argument will flame for all eternity) -- it's about the vast numbers of users who won't get around to installing the patch and need to be alerted to the urgency to do so.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
ScorpioBlue 15th Feb
They all have vulnerabilities.

Vulnerabilities are not exploits. Lean to know the difference, freak.
  • Flagged
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
Michael Alan Goff 15th Feb
"Vulnerabilities are not exploits. Lean to know the difference, freak."

Exactly.

This is a vulnerability, not an exploit.
0 Votes
+ -
Goff, are you my widdle parrott?
ScorpioBlue 15th Feb
Do you nod your head in agreement all the time like my slave?

I won't pay you for this, ya know...

lol... grin
0 Votes
+ -
So we all agree
Michael Alan Goff 15th Feb
this article is pointless.
0 Votes
+ -
No, it got your attention
ScorpioBlue 15th Feb
So how can it be pointless.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
smashandgrab 16th Feb
@toddbottom - I fail to see anything in his post to conclude he is upset. While you are correct that all OS and software have vulnerabilities, I cant see why you would accuse someone of being upset when they clearly weren't.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
hessmartin 15th Feb
@daikon
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
HackerJ 15th Feb
@daikon You are just jealous that Micr0$uck$ LoseDoze Operating System (O/S) is the most secure O/S ever! This is because of the INNOVATION and INTELLECTUAL property that makes up the LoseDoze products. Stop bashing the most honest company in the world that makes the best products on the planet.
0 Votes
+ -
Operative word: With administrator privileges
honeymonster Updated - 14th Feb
Since Windows Vista users don't run apps with administrator privileges, not even if they *are* administrators. Indeed, thanks to IE protected mode all users run IE7 and later with *low integrity* which prevents exploits from changing the system. Unless the user switched off UAC.
0 Votes
+ -
One thing I dislike about the security alerts / coverage is it always...
ye 14th Feb
@honeymonster: Indeed, thanks to IE protected mode all users run IE7 and later with *low integrity* which prevents exploits from changing the system.

...ignores Protected Mode. They don't address how Protected Mode could mitigate a particular vulnerability.
0 Votes
+ -
Protected mode
davidr69 14th Feb
@ye I'm a Linux guy, so I don't understand protected mode. Is it like Linux's App Armor? Are we saying that Windows is normally unprotected? Is this for IE only or for the OS?
0 Votes
+ -
Protected Mode is a form of MAC.
ye 14th Feb
@davidr69: Do a Google search on "windows mandatory integrity levels". I attempted to provide a link but this POS talkback "lost" the message.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
MrElectrifyer Updated - 14th Feb
@ye Install the "Lazarus" extension plain
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
ff2 Updated - 14th Feb
@davidr69: "I'm a Linux guy, so I don't understand protected mode. Is it like Linux's App Armor?"
Nope. What Linux has only latetly with App Armor, that had Windows NT already built-in 20 years ago. You could restrict process privileges arbitrarily already in Windows NT 3.51.

"Are we saying that Windows is normally unprotected"
Nope. It's Linux that's normally unprotected and needs custom kernel security extensions to reach even just near the safety level of Windows.

"Is this for IE only or for the OS? "
Any application running under Windows can use the technique. It's not a service provided by the OS, but as simple as taking advantage of basic Windows security concepts and APIs. For ex. Adobe is also using the same technique to sandbox their Reader X.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
xamountofwords 14th Feb
@ff2 Ha. Yes. Windows is WAY more secure than Linux. Which is why Microsoft has "Patch Tuesday". Windows must be inherently more secure if every week they have a bunch of vulnerabilities that need fixing.

Oh and what's that Linux users? You say you don't even need a firewall? Or anti-virus? Or anything of all that stuff Windows needs? Hmm. Looks like Windows can't even touch Linux on security. Maybe next time.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
kirovs@... 15th Feb
@ff
You do not understand how Linux works. Lay off that topic or you look really silly. BTW, how is the implementation of file control going in Win? Just asking happy
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
ScorpioBlue 15th Feb
Nope. What Linux has only latetly with App Armor, that had Windows NT already built-in 20 years ago.

App armor has been around since 1998. You sure about your dates? Check them.

Nope. It's Linux that's normally unprotected and needs custom kernel security extensions to reach even just near the safety level of Windows.

Unprotected against what specifically? Do tell.

Any application running under Windows can use the technique. It's not a service provided by the OS, but as simple as taking advantage of basic Windows security concepts and APIs.

Well they'd have to now, wouldn't they. Your point?
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
thoiness 15th Feb
@ye Well ZDNet, four attempts to reply is enough for me. If this one makes it through, we'll see the definition of irony. I'm not going to even try anymore.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
ScorpioBlue 15th Feb
@ye Well ZDNet, four attempts to reply is enough for me. If this one makes it through, we'll see the definition of irony. I'm not going to even try anymore.

Well @thoiness you just don't know how to do it right.

Maybe you should consider another browser. Or another OS. Or go back to school.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 14th Feb
@honeymonster

But they still have admin rights, BeyondTrust reported a couple of years ago that 90% of Critical Windows 7 vulnerabilities are mitigated by having users log in as standard users.
0 Votes
+ -
Not until they elevate through UAC.
ye 14th Feb
@guzz46: But they still have admin rights

Until then they lack administrative rights.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 14th Feb
@ye

Why don't you go read the BeyondTrust report.

And don't be fooled by UAC, it can by bypassed.
0 Votes
+ -
Glady. Please provide a reference.
ye Updated - 14th Feb
@guzz46: Why don't you go read the BeyondTrust report.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 14th Feb
@ye

I did, why don't you?
0 Votes
+ -
I will as soon as you provide a reference.
ye 14th Feb
@guzz46: I did, why don't you?

TIA
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 14th Feb
@ye

Seeing as zdnet doesn't seem to like links, google the following (it should come up as the first search result) "BeyondTrust Analysis of 15 Months of Microsoft Security Bulletins Finds the Vast Majority of Vulnerabilities can be Diminished by Configuring End Users as Standard Users"
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
dvm Updated - 15th Feb
@guzz46,
I read the BeyondTrust article and there is no mention of UAC being bypassed (what's more, there is no mention of UAC in the document at all). What they mention is that being a standard user mitigate the malware attacks. In one interview to a company representative, he mentioned that standard users are safer because a password is required to install an application or modify the system, a password only the system administrator have access to. Could it be that's the reason a standard user is more safe and not because UAC was bypased? BTW, did you know the study finished on how their application solved some applications requirements for administrative privileges? Maybe I misunderstood the study, so if someone can give additional details will be nice, because, IMO, the study don't have enough details.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 15th Feb
@dvm

Yes I know the report didn't mention UAC, I never said it did, that was another article altogether, but it doesn't need to mention UAC because UAC is already installed and active in windows 7 and obviously does nothing to protect the user from the critical vulnerabilities, hence they recommend a standard user account.

I think I have already been over the benefits of a standard user account with you a while ago, but if you still don't believe the article and want more details then download the white paper from their website.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
dvm Updated - 15th Feb
@guzz46,
"Yes I know the report didn't mention UAC, I never said it did, that was another article altogether, but it doesn't need to mention UAC because UAC is already installed and active in windows 7 and obviously does nothing to protect the user from the critical vulnerabilities, hence they recommend a standard user account."
The white paper mentions that vulnerabilities were mitigated by running as a standard user. But they don't give any details if their results were based on the password requirements for standard users to modify the system or install applications. If I gave a users administrative privileges, he only have to click Allow/Continue to install applications or modify the system. In either case, UAC prompted for user authorization. It's clear that if the user don't have the administrative password, the malware won't work at all. But they don't give enough details on how they got the results on malware affecting the system.

"but if you still don't believe the article and want more details then download the white paper from their website."
I read the white paper, and they didn't published enough details to have a real answer.
One more thing, the white paper finish with selling their product to solve the problem with applications which require administrative privileges, while keep them as standard users. Could it be that the study was biased? Just thinking...
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 15th Feb
@dvm

"The white paper mentions that vulnerabilities were mitigated by running as a standard user. But they don't give any details if their results were based on the password requirements for standard users to modify the system or install applications"

Since when were users modifying the system or installing applications classed as vulnerabilities? and its not just malware, its vulnerabilities, the white paper gives all the details of which vulnerabilities can be mitigated by removing admin rights, plus running as a standard user is something anyone can do free of charge in windows, so there is nothing for them to sell.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 Updated - 15th Feb
@dvm

Plus if you still think BeyondTrust is being biased just google the security bulletin id and read it straight from microsoft, this is a quote from microsoft regarding security bulletin MS10-001

"This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font in client applications that can render EOT fonts, such as Microsoft Internet Explorer, Microsoft Office PowerPoint, or Microsoft Office Word. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights."
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
dvm 15th Feb
@guzz46,
"Since when were users modifying the system or installing applications classed as vulnerabilities?"
I was talking about malware which system files, folders and the registry.

"the white paper gives all the details of which vulnerabilities can be mitigated by removing admin rights,"
Could it be because the UAC prompts to enter an administrative account? You are assuming that UAC has been bypassed, but there is no mention of it in the white paper. BTW, I'm not saying that UAC will protect you from every vulnerability. But the white paper you mentioned don't give enough details to think that UAC is useless.

"plus running as a standard user is something anyone can do free of charge in windows, so there is nothing for them to sell."
You can run as a standard user, but you cannot elevate sessions without an administrative account, something their software do. BTW, if you had read the white paper, how is that you didn't noticed the sales pitch?
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 15th Feb
@dvm

"I was talking about malware which system files, folders and the registry."

But the article talks about vulnerabilities

"Could it be because the UAC prompts to enter an administrative account?"

No, read my response above, it comes direct from microsoft, the vulnerability regards an attacker gaining full access to your system, in which case UAC is going to be completely useless, but if you're running as a standard user then the attacker won't be able to do any serious damage to your system without knowing the password.

"You can run as a standard user, but you cannot elevate sessions without an administrative account"

Thats what a password is for, and as I said before BeyondTrust aren't being biased, you can read the security bulletin direct from microsoft.
0 Votes
+ -
Admin rights
honeymonster 15th Feb
@guzz46
"But they still have admin rights"
No they don't. Get in the game. UAC (despite what Linux fans believe) is not just the *prompt*. When you log into Windows, UAC will *strip* admin rights from your token. Any process started thereafter will *not* have admin rights and the usual permission/privilege checks will deny you access to resources and functions which require admin access.

The BeyondTrust study *ignores* UAC and actively assumes that you are *not* running with UAC. Why? Because BeyondTrust has a product to sell which solves much of the same problem as UAC. What you can take away from that study is that 92% of vulns are mitigated if the user does not have admin privileges. BeyondTrust will sell you a product which will help you do that. But UAC already does it - a fact that they conveniently "forgot" to mention.

Microsoft has a policy of rating severity as if UAC *is not* enabled. If a vuln allows arbitrary code execution it allows arbitrary code execution, BeyondTrust or UAC or not. What is mitigated at that point is what that code is restricted to. And UAC severely restricts the code, especially when the process is running in *low* integrity. A low integrity process (like IE, the office "viewers", Chrome etc) can not write to disk except for a designated "cache" area the location of which has been deliberately obfuscated to minimize the risk of clever social engineering attacks luring users into running files from the cache.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 Updated - 15th Feb
@honeymonster

If you don't believe BeyondTrust then go straight to the source and read it straight from microsoft, here is a snippet of security bulletin MS10-001 from microsoft
"An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights"

Now don't tell me microsoft is ignoring UAC, besides how can UAC stop an attacker from gaining system wide access and installing programs or making system wide changes?
Get in the game, despite what windows fans believe UAC is not the same as a standard user account.
0 Votes
+ -
Read it
honeymonster 16th Feb
@guzz46
"Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights"

MS cannot know whether UAC has been switched off or not. With UAC switched *on* you are *not* one of the "users who operate with administrative user rights".

Arbitrary code execution still applies, but it IS NOT a UAC breach. UAC works at *process* level and has stripped the process token of admin rights. They DO NOT magically come back. To have them back you have to go through an elevation prompt.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
dvm Updated - 16th Feb
@guzz46,
I was going to post an answer, but it looks like honeymonster gave details about UAC better than what I can explain...
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 Updated - 16th Feb
@honeymonster

"MS cannot know whether UAC has been switched off or not"

Come on now, why would they assume it was switched off? besides you still didn't answer my question, how can UAC possible stop an attacker from gaining access to your system and installing applications and making system wide changes? seeing as they only have to click ok on a prompt, you know because the default windows 7 user has those rights.
You don't want to answer that question because you know UAC can't protect your system from that, but a standard user account can, because the attacker wouldn't know what the admin password etc...
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 16th Feb
@dvm

No you already posted an answer, so I will respond to your previous unedited post.

"Could it be that the protection from the standard user is for Windows 2000 and XP, which don't have UAC?"

No because it effected windows 7 as well, you also avoided answering my question, the default windows 7 user can install applications and make system wide changes by simply clicking ok on a prompt, so an attacker who gains those same user rights will obviously be able to do exactly the same, but he wouldn't be able to do those things if he was a standard user because he wouldn't have the admin password now would he, its not rocket science.
As I've said before UAC isn't the same as a standard user account.

"how do you know if the company isn't biased"

Because they didn't make up those security bulletins, every single one is legit, you can read it straight from microsoft, I have already posted evidence from microsoft admitting that a standard user account can mitigate the vunerability, what more do you need? read them all if you need to, you just don't want to believe the truth do you.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
dvm Updated - 16th Feb
@guzz46,
"No you already posted an answer, so I will respond to your previous unedited post."
After reading the honeymonster post, I understood more on how UAC worked, plus he gave details I didn't know. That's the reason I removed my post.

"No because it effected windows 7 as well"
In a TechNet article regarding MS10-001 details were given on how the vulnerability affected Windows 2000, but on operating systems like Windows 7 x64 will result in a Violation at a kernel mode address which would affect application stability (Denial of Service) with no threat of code-execution. Because the advisory covered all versions of Windows, maybe they gave details on the worst case scenario, in this case Windows 2000. If you read the advisory completely, you will notice that Windows 2000 has critical rating vs the other versions of Windows of low.

"you also avoided answering my question, the default windows 7 user can install applications and make system wide changes by simply clicking ok on a prompt, so an attacker who gains those same user rights will obviously be able to do exactly the same, but he wouldn't be able to do those things if he was a standard user because he wouldn't have the admin password now would he, its not rocket science.
As I've said before UAC isn't the same as a standard user account."
Why the comparison of UAC with a standard user account?

"Because they didn't make up those security bulletins, every single one is legit, you can read it straight from microsoft, I have already posted evidence from microsoft admitting that a standard user account can mitigate the vunerability, what more do you need? read them all if you need to, you just don't want to believe the truth do you."
Read what I posted above regarding MS10-001 and the standard user account, specifically with Windows 2000 and the critical severity, vs other versions low severity rating.
BTW, based on other posts, are you implying that being a standard user makes your system invulnerable? Every time you mention UAC, for some reason you focused on how it don't helps protects a system. How registry virtualization, sandbox of applications and other UAC functionality won't help to keep safe a system? Because some vulnerabilities "bypassed" it? (after reading honeymonster post, maybe UAC wasn't bypassed at all). If that's the case, it should apply to Linux too, right? There was Linux advisory CVE-2010-2066, a vulnerability which bypassed every Linux security mechanism, even a sandbox and being a standard user. Care to explain how a sandbox or being a standard user would help protect the system from this vulnerability? If both mechanisms failed to protect the system, does it means that are useless? UAC isn't perfect, still give a level of protection vs previews versions of Windows without it, don't you think.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 16th Feb
@dvm

"In a TechNet article regarding MS10-001 details were given on how the vulnerability affected Windows 2000, but on operating systems like Windows 7"

But it said it affected windows 7, if it didn't affect windows 7 then microsoft wouldn't say it affected windows 7, but hey don't stop at just one, how about another, lets try MS10-046...
"This security update resolves a publicly disclosed vulnerability in Windows Shell. The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights."
"This security update is rated Critical for all supported editions of Microsoft Windows"

And if you scroll down the page you will notice that its rated critical for both windows 7 32bit and 64bit, is doesn't get any clearer than that I'm affraid.

"BTW, based on other posts, are you implying that being a standard user makes your system invulnerable?"

No why do you say that? it makes it more secure, not invulnerable.
Remember what I originally posted "90% of Critical Windows 7 vulnerabilities are mitigated by having users log in as standard users."
Well you haven't proven that wrong, and you haven't even taken into account the fact that UAC will be completely useless if an attacker gains access to your system and only has to click ok on a silly prompt when he wants to do nastie things to your PC, in fact I don't even know why you are still arguing, you must think that a standard user account isn't any safer, despite microsoft admitting that it is.
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
dvm Updated - 17th Feb
@guzz46,
"But it said it affected windows 7, if it didn't affect windows 7 then microsoft wouldn't say it affected windows 7"
Between Windows 2000 and Windows 7, the severity of the vulnerability was different. Could it be because UAC help mitigate the vulnerability?

"lets try MS10-046..."
...as soon as you explain to me why the Linux sandbox and standard users privileges couldn't protect you from CVE-2010-2066. Here are some details from the group who discover the vulnerability,
"In other words: any GUI application (think e.g. sandboxed PDF viewer), if compromised (e.g. via malicious PDF document) can bypass all the Linux fancy security mechanisms, and escalate to root, and compromise the whole system. The attack allows even to escape from the SELinux's "sandbox -X" jail. To make it worse, the attack has been possible for at least several years, most likely since the introduction of kernel 2.6."

"Well you haven't proven that wrong, and you haven't even taken into account the fact that UAC will be completely useless if an attacker gains access to your system and only has to click ok on a silly prompt when he wants to do nastie things to your PC, in fact I don't even know why you are still arguing, you must think that a standard user account isn't any safer, despite microsoft admitting that it is."
Again, UAC is not only a user prompt to allow an application. Registry virtualization and the sandbox funcionality is part of it. If you don't think those mechanisms helps to protects the systems, that's your opinion. Second, it's clear that if a standard user don't know the administrative password, it would be safer than give it an administrative account . Did I ever say it wasn't?
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
guzz46 Updated - 17th Feb
@dvm

"Could it be because UAC help mitigate the vulnerability?"

Unlikely, because if you had read the report then you would of noticed this "An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights"
Unless you're now claiming that UAC stops you from doing all those things?

"as soon as you explain to me why the Linux sandbox and standard users privileges couldn't protect you from CVE-2010-2066"

Ah, so you want to change the subject now, you obviously have no excusses for MS10-046, which isn't surprising because there are no excusses for it, besides trying to change the subject.
But seeing as you don't want to admit it, I'll at least play your game... its was a bug/hole, here is some more info on it that you failed to mention "I would point out that this is the kind of bug that requires an attacker to already have compromised the system far enough to be able to run code locally; this vulnerability cannot, in and of itself, give a remote attacker any sort of access to a vulnerable system"
So what is your point again? anyway now you can try and explain MS10-046 and all the rest.

"Again, UAC is not only a user prompt to allow an application"

I know, but its still only a prompt, as opposed to a password request, hence why 90% of critical windows 7 vunerabliities can be mitigated by removing admin rights (oh and you still haven't taken into account the attacker situation) your argument now seems to be that UAC is better than no UAC, which has nothing to do with what I originally posted.

"it's clear that if a standard user don't know the administrative password, it would be safer than give it an administrative account . Did I ever say it wasn't?"

Hooray! you actually admit it now! so why did you question the report in the first place if you already knew that a standard user account is safer? did you just feel like having an argument?
0 Votes
+ -
RE: Microsoft warns of dangerous IE browser vulnerabilities
famulla 21st Feb
@patt1 ...I agree Unix like COBOL is great we need to have as many as we can, try crack this crack that it is like the button on the wrist watch. If you do not try how will you learn and do not be afraid, these we days if you get in a position you cannot come out get a buy of 15 these kids are whiz I thank you Firozali A.Mulla DBA

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix