Microsoft warns of Windows image rendering flaw
Summary
Microsoft warned of a Windows vulnerability that could allow an attacker to take control of a computer if the user is logged on with administrative rights.
Topics
Microsoft warned on Tuesday of a Windows vulnerability that could allow an attacker to take control of a computer if the user is logged on with administrative rights.
To be successful, an attacker would have to send an email with an attached Microsoft Word or PowerPoint file containing a specially crafted thumbnail image and convince the recipient to open it, Microsoft said in its advisory, which also contains information on workarounds.
An attacker also could place the malicious image file on a network share and potential victims would have to browse to the location in Windows Explorer.
For more on this story, read Microsoft warns of Windows flaw affecting image rendering on CNET News.
Just In
yeah just like all flaws highly unlikely to happen. cuz jsut simply clicking an image is highly unlikely to happen
Quoted from the CNET News article:
"The vulnerability affects Windows XP Service Pack 3, XP Professional x64 Edition Service Pack 2, Server 2003 Service Pack 2, Server 2003 x64 Edition Service Pack 2, Server 2003 with SP2 for Itanium-based systems, Vista Service Pack 1 and Service Pack 2, Vista x64 Edition Service Pack 1 and Service Pack 2, Server 2008 for 32-bit, 64-bit, and Itanium-based systems and Service Pack 2 for each."
Just making sure it was not an oversight
Edit: Nevermind, I read that Windows 7 and Server 2008 R2 are NOT affected. Just wanted to make sure if I had to warn my mother yet again not to open attachments on emails that look suspicious or from people she does not know or was not expecting.
"The vulnerability affects Windows XP Service Pack 3, XP Professional x64 Edition Service Pack 2, Server 2003 Service Pack 2, Server 2003 x64 Edition Service Pack 2, Server 2003 with SP2 for Itanium-based systems, Vista Service Pack 1 and Service Pack 2, Vista x64 Edition Service Pack 1 and Service Pack 2, Server 2008 for 32-bit, 64-bit, and Itanium-based systems and Service Pack 2 for each."
Just making sure it was not an oversight
Edit: Nevermind, I read that Windows 7 and Server 2008 R2 are NOT affected. Just wanted to make sure if I had to warn my mother yet again not to open attachments on emails that look suspicious or from people she does not know or was not expecting.
@bobiroc
You really shouldn't open attachments on emails that look suspicious or from people you do not know, etc. regardless of current security scares. It's better to avoid that type of thing even if you are running a more secure operating system than Windows XP and whatever other versions this applies to.
You really shouldn't open attachments on emails that look suspicious or from people you do not know, etc. regardless of current security scares. It's better to avoid that type of thing even if you are running a more secure operating system than Windows XP and whatever other versions this applies to.
To be successful, an attacker would have to send an email with an attached Microsoft Word or PowerPoint file containing a specially crafted thumbnail image and convince the recipient to open it, Microsoft said in its advisory, which also contains information on workarounds.
Might as well call this flaw already dead. Users won't open it for two reasons. One, the email would come from an unknown/untrusted sender. Two, the big warning message saying that attachments could harm your computer would scare them off into not opening it.
Might as well call this flaw already dead. Users won't open it for two reasons. One, the email would come from an unknown/untrusted sender. Two, the big warning message saying that attachments could harm your computer would scare them off into not opening it.
@Loverock Davidson
I think you severely overestimate Users. I agree that those are obvious warning signs but I cannot tell you how many people have blindly clicked on a link or opened an attachment from a random email thinking it was some sort of greeting card or funny picture or video knowing fully that the email came from somebody they did not know.
I think you severely overestimate Users. I agree that those are obvious warning signs but I cannot tell you how many people have blindly clicked on a link or opened an attachment from a random email thinking it was some sort of greeting card or funny picture or video knowing fully that the email came from somebody they did not know.
yeah cuz its again highly unlikely the email would come from hotmail.com microsoft.com etc etc etc.....
highly unlikely as that is not even possible!!!! no way!
bet thing install 3 software firewalls they will save u!
highly unlikely as that is not even possible!!!! no way!
bet thing install 3 software firewalls they will save u!
All it takes is a spoofed email account. Not all home users are Tech savvy as Loverock Davidson. /humor
@Loverock Davidson
"Users won't open it for two reason."
Riiiiiiiggghhht.
"Users won't open it for two reason."
Riiiiiiiggghhht.
@Loverock Davidson
already dead. Hah. U obviously never worked a help desk.
already dead. Hah. U obviously never worked a help desk.
not that the article states it can just be an image
@Loverock Davidson
If people didn't do stupid stuff just like this, I wouldn't be getting so many fishing emails.
If people didn't do stupid stuff just like this, I wouldn't be getting so many fishing emails.
@Loverock Davidson
Well, you're right that it shouldn't gain traction, but that doesn't mean that it won't. Having users act rationally all the time would probably cut out at least 75% of current Windows malware.
Well, you're right that it shouldn't gain traction, but that doesn't mean that it won't. Having users act rationally all the time would probably cut out at least 75% of current Windows malware.
@Loverock Davidson
Yes it works every time.
It works the same way with compiled binaries in GNU/Linux also.
Yes it works every time.
It works the same way with compiled binaries in GNU/Linux also.
It requires manual interaction. Therefore, according to the rules as laid out by the ABMers, this one doesn't count.
Cue the double standards...
Cue the double standards...
@NonZealot
No double standards intended, it is you I find so funny as most of the time you even defend the indefensible. They all have flaws, just none as great as your hyper-inflated ego and fanboy preferences
No double standards intended, it is you I find so funny as most of the time you even defend the indefensible. They all have flaws, just none as great as your hyper-inflated ego and fanboy preferences
@NonZealot
Nobody had made a comment about Windows' lack of security when you posted this. You should have held off a bit longer and replied to one of them.
This actually is a security flaw, but considering the phishing that is involved in exploiting it, it's a relatively minor one. Also it doesn't even exist, apparently, in Windows 7.
I'm certainly no fan of Windows, but this isn't that big of a deal. I'm sure a fix will be forthcoming.
Nobody had made a comment about Windows' lack of security when you posted this. You should have held off a bit longer and replied to one of them.
This actually is a security flaw, but considering the phishing that is involved in exploiting it, it's a relatively minor one. Also it doesn't even exist, apparently, in Windows 7.
I'm certainly no fan of Windows, but this isn't that big of a deal. I'm sure a fix will be forthcoming.
So if Windows users use common sense then this is an non issue.
@athynz
if windows users had any common sense, they wouldn't be using windows. the average windows user has an IT IQ somewhat on a par with a brick. They will click on anything, click through any warning message and then ***** and moan when they're computer is broken. These people are in all likelihood reasonably intelligent in other areas of their lives, they think a windows computer is a toaster. although computers should be as simple to operate as toasters, we're decades from that.
if windows users had any common sense, they wouldn't be using windows. the average windows user has an IT IQ somewhat on a par with a brick. They will click on anything, click through any warning message and then ***** and moan when they're computer is broken. These people are in all likelihood reasonably intelligent in other areas of their lives, they think a windows computer is a toaster. although computers should be as simple to operate as toasters, we're decades from that.
@haydens0
With that logic, I guess 90.29% of all users in the world have no common sense, and 9.71% of the world are the only ones with common sense...
With that logic, I guess 90.29% of all users in the world have no common sense, and 9.71% of the world are the only ones with common sense...
@haydens0
Unlike Nix users perhaps? or Mac? I assume you are one of those. Another fanboy to be sure.
Unlike Nix users perhaps? or Mac? I assume you are one of those. Another fanboy to be sure.
@haydens0
Bravo, you nailed it. After all, it is called "Computer Science", first cousin to "Rocket Science". Novices need to be confined to Macs only.
Bravo, you nailed it. After all, it is called "Computer Science", first cousin to "Rocket Science". Novices need to be confined to Macs only.
@athynz
How many windows users have that?
How many windows users have that?
@athynz just waiting for all the MAC fanboys to weigh in with "but a windows user doesnt have common sense or they would buy a mac" - joke!
What if the user doesn't have Word or PowerPoint? What if he/she opens it with OpenOffice?
@davidr69 It is an image rendering glitch, you simply have to open the file. When you save these documents, word creates a snapshot of the file, and windows uses it instead of the default icon. Here is an example(I just did a Google image search):
http://img257.imageshack.us/img257/8022/vistathumbnailscp0.gif
The icon in the middle on the bottom row is a PDF file with a thumbnail that replaces the icon. A hacker can modify the image, and windows might accidentally install a virus. Image hacks could be very powerfull, there is a similiar flaw in the PSP, that is used to hack the device(Like Jailbreaking), here is a video of the PSP hack:
http://www.youtube.com/watch?v=EAoCDBwhybo&feature=related
Here it was used to benefit the user, but it could be used by a hacker to damage or takeover the device. This windows flaw is very similar to the PSP flaw.
http://img257.imageshack.us/img257/8022/vistathumbnailscp0.gif
The icon in the middle on the bottom row is a PDF file with a thumbnail that replaces the icon. A hacker can modify the image, and windows might accidentally install a virus. Image hacks could be very powerfull, there is a similiar flaw in the PSP, that is used to hack the device(Like Jailbreaking), here is a video of the PSP hack:
http://www.youtube.com/watch?v=EAoCDBwhybo&feature=related
Here it was used to benefit the user, but it could be used by a hacker to damage or takeover the device. This windows flaw is very similar to the PSP flaw.
Logged on with admin right?
But by default administrator doesn't have admin right in vista (UAC), so it's really not an important vulnerability.
But by default administrator doesn't have admin right in vista (UAC), so it's really not an important vulnerability.
@mikroland
"With that logic, I guess 90.29% of all users in the world have no common sense, and 9.71% of the world are the only ones with common sense..."
Rather predictable for an MS shill. You noticed and then ignored my qualifier relating to IT common sense, not common sense in general. People want to use computers like appliances and windows computers in those hands can be dangerous. The users lack the commons sense to realize that computing in 2011 is still primitive, particularly regarding security.
"With that logic, I guess 90.29% of all users in the world have no common sense, and 9.71% of the world are the only ones with common sense..."
Rather predictable for an MS shill. You noticed and then ignored my qualifier relating to IT common sense, not common sense in general. People want to use computers like appliances and windows computers in those hands can be dangerous. The users lack the commons sense to realize that computing in 2011 is still primitive, particularly regarding security.
the blah blah windows crap started.
Hey haydens0, I've never understood how your kind of persons inability to write a bat file made them 'superior'. (Can you tell my opinion of you people goes way, way back?)
Hey haydens0, I've never understood how your kind of persons inability to write a bat file made them 'superior'. (Can you tell my opinion of you people goes way, way back?)
@rmhesche
a bat file? been writing them since the 80s, it's still a useful way to get things done quickly. how does writing a bat file stop someone from clicking through warning messages and infecting their computers? my point is that until computers are as safe and reliable as, say, telephones or automobiles, we're going to have these problems.
a bat file? been writing them since the 80s, it's still a useful way to get things done quickly. how does writing a bat file stop someone from clicking through warning messages and infecting their computers? my point is that until computers are as safe and reliable as, say, telephones or automobiles, we're going to have these problems.
Now that we've proven UAC is completely FIVE-STAR-USELESS to keep people from doing stupid things, can we please get rid of it now?
The one that pops up and reminds windoze users as to what idiots they are?
lol
lol
WHEN will the largest software maker of the planet finally produce something better than JUNK?
Buyers of their products should be reimbursed for the trouble they go through buying and using bad products!
Buyers of their products should be reimbursed for the trouble they go through buying and using bad products!
These are very serious indeed, I am a Windows user, and I am aware of it's discrepancies, but image hacks can be powerful. Sony PSPs are often safely hacked (By users wanting to run homebrew; like a jailbreaking hack) via a TIFF image exploit (Called ChickHEN). When the PSP generates the thumbnail, it causes the PSP to load a binary file, that forces it to reboot into a new firmware.
Do you actually have to OPEN the file or do you just have to browse to the folder it's in when Explorer (or whatever) is in thumbnails mode?
The description seems unclear on this point. (In one place it says you have to open it but then it says it's to do with embedded thumbnails and you just have to browse to the folder.) The difference is rather significant as one action is far more passive than the other.
The description seems unclear on this point. (In one place it says you have to open it but then it says it's to do with embedded thumbnails and you just have to browse to the folder.) The difference is rather significant as one action is far more passive than the other.
It's gotten to the point where I send a notice to someone telling them I'm going to send an attachment before I actually do it. And if I get "stuff" from familiar sources with attachments, I delete it and tell 'em I did so and to send it again.
But this is really a terrible waste of time . . .
But this is really a terrible waste of time . . .
Join the conversation!
The best of ZDNet, delivered
ZDNet Newsletters
Get the best of ZDNet delivered straight to your inbox
Vendor Showcase
Facebook Activity
