Microsoft fixes '19-year-old' bug with emergency patch

http://www.bbc.com/news/technology-30019976

by makphir • 12 years ago

108 43 12 years ago

bbc.com

userbinator2• 12 years ago

Reminds me of this one... http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability

Another long-lived bug that someone finally managed to discover and exploit.

I wonder if it's related to this one 4 years ago: http://www.cvedetails.com/cve/CVE-2010-2566/

giancarlostoro• 12 years ago

So if this really goes back that far, I would hate to be anyone using Windows XP.

Eyas• 12 years ago

The vulnerability seems to be present in Windows 95 (and equivalent Windows Server), as well as IE 3.0+. So yeah.. quite a big deal.

biesnecker• 12 years ago

There are plenty of running installations of Windows 95/98/2000, too.

danielweber2• 12 years ago

XP is 13 years old.

When the Blaster worm hit in 2003, the Unix people laughed, because they were immune. The Morris worm was ancient history, because it had been 15 years since that hit.

XP is almost ancient history. You shouldn't be running it, any more than you should've been running something vulnerable to the Morris worm in 2003.

edit 'omh makes a good point below

k-mcgrady2• 12 years ago

You shouldn't be running it but a hell of a lot of people and businesses still are. And MS is to blame IMO. The continued extending support, they screwed up with Vista and after making things right with Windows 7 screwed up again (although no where nearly as badly as with Vista) with Windows 8.

I also know of people running XP because it's incredibly stable now and they don't see anything in newer versions of Windows they really want or need.

omh• 12 years ago

Windows XP is old, but to call it 13 years old is somewhat misleading.

XP was the newest possible version of Windows as recently as 2007, and since most people ignored Vista it was the default install for many (most?) people up until Windows 7, which was only 5 years ago. SP3 came out in 2008 and significantly improved the features and security.

Combined with some odd licenses and old PC stock in stores there were plenty of people buying new laptops in 2010 with XP installed.

Yes, it's old. But more like 5-6 years than 13.

userbinator2• 12 years ago

I'm using XP but also a filtering/reencrypting proxy, so all secure connections are going through OpenSSL's client code. Ironically, I just updated OpenSSL 2 days ago and patched the proxy to add SNI...

hrjet• 12 years ago

MS is still pushing monthly updates to XP users, purportedly to scan for malware. How hard would it be for them to push a patch with a fix for this?

dspillett• 12 years ago

As far as I know they haven't explicitly said they won't. The "affected systems" lists on the recent advisories currently only go back as far as 2003/Vista, but IE6 is listed in some of them so if they are going that far back with IE (6 dropped out of extended support at the same time as XPsp3) there is a chance there is a patch coming for XP too.

Of course they are under no obligation to.

And some might argue that giving people updates so they can continue to use IE6 is as bad as giving an alcoholic a double G&T to help keep withdrawal symptoms at bay...

maccard• 12 years ago

XP came out before Debian 3.0. At that point, Google hardly existed, iTunes hadn't been released, and the Nokia 3310 was less than a year old - http://en.wikipedia.org/wiki/Nokia_3310

Anyone who is still running Windows XP has this coming.

gambiting• 12 years ago

On the other hand, you could buy a brand new PC with XP on it 2 years ago. PC which could be still working perfectly fine for its intended purpose - so many people don't understand why would they want to spend money on something that works without any problems.

noinsight• 12 years ago

BBC delivers again, this is quality tech journalism unlike the usual stuff from other outlets (IMO).

fname3• 12 years ago

Specifically, it related to Microsoft Secure Channel, known as Schannel, Microsoft's software for implementing secure transfer of data.

I'm confused... The article says this research relates to the SChannel vulnerability being patched this month and cites IBM Researchers[1] finding it, but the link to the blog post showing the work is towards OLE and not SChannel. Also, Microsoft has mentioned that they found[2] the SChannel vulnerability through an internal audit. To me, it seems the research is talking about CVE-2014-6332[3], which shows the patch as MS14-064. MS14-066 is the patch for the SChannel vulnerability.

Either BBC is confused on which patch they're trying to report on, or I am.

Anyone similarly confused as I am?

[1] http://securityintelligence.com/ibm-x-force-researcher-finds...

[2] http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-...

[3] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-633...

thefreeman• 12 years ago

I think the BBC reporter likely got confused. However it seems http://securityintelligence.com/ibm-x-force-researcher-finds... is a blog post about a 19 year old remotely exploitable bug being fixed recently, so it seems like if anything the link should go there.

fname3• 12 years ago

Completely agree, maybe the mods can fix the link.

srcmap• 12 years ago

Does IE allow VBscript execution in any html page?

Does it happen only when activeX is enable?

fname3• 12 years ago

Depends on the IE Zone settings. I believe that if you set the a zone to 'Low', a web page can execute a VBSCript code, with or without ActiveX being enabled.

chrismcb• 12 years ago

The article was discussing two separate bugs. As it says "one of the other bugs ...."

rikkus• 12 years ago

BBC technology reporting at its usual standard.

"In computer security, a drive-by attack typically means making users download malicious software."

That's really not clear. It means that you'll get infected by simply passing by [a website] rather than actively doing anything.

MichaelApproved• 12 years ago

While its good to point out errors in the article, It'd be helpful to include the correction as well.

A 'drive-by-download' attack is a malware delivery technique that is triggered simply because the user visited a website. Traditionally, malware was only 'activated' as a result of the user proactively opening an infected file (for example, opening an email attachment or double clicking on an executable that had been downloaded from the Internet).

Source: https://www.comodo.com/resources/home/newsletters/nov-10/ask...

danielweber2• 12 years ago

It's Patch Tuesday. What makes this an "emergency patch"?

eat• 12 years ago

It's really "what should have been an emergency patch", if they're referring to MS14-066. Article is kind of confusing as to what vuln they're actually referring to, though.

72deluxe• 12 years ago

Confused BBC.

https://technet.microsoft.com/library/security/MS14-066

https://technet.microsoft.com/library/security/ms14-064

Full list of updates: https://technet.microsoft.com/library/security/ms14-nov

Of significant importance too are the Flash Player updates released: http://helpx.adobe.com/security/products/flash-player/apsb14...

shashikant52004• 12 years ago

I agree with flash player update.. seems all (flash) video players on IE8 stopped working now.

mkhalil• 12 years ago

I wouldn't be surprised if this was a "oh we found a bug, lets leave it" backdoor.

pbhjpbhj2• 12 years ago

So I should "update" my old laptop to Vista?

vlammerbot• 12 years ago

"Cutting to the chase, VBScript permits in-place resizing of arrays through the command “redim preserve.” This is where the vulnerability is.

redim preserve arrayname( newsizeinelements ) ... For VBScript, exploitation of this bug could have been avoided by invalidating the common “On Error Resume Next” VBScript code when the OleAut32 library returns with an error."

Always thought there was something shady about VB and redimming -- and On Error Resume Next. ;^) But that explains why it's as old as VB itself.

Robin_Message2• 12 years ago

We upgraded to this, only to find it activates some new encryption modes (4 new GCM suites) that don't seem to function properly for us. Anyone else seen that issue?

(Technical details: If the client offer one of the suites, the server is accepting it in the ServerHello, but then RSTing the connection after the client sends their encrypted handshake, and the event log says "none of the cipher suites supported by the client application are supported by the server". Browser and curl don't use that suite, but Amazon ELB does.)

duckhead814• 12 years ago

Yes, all of our AWS EC2 Windows instances sitting behind an ELB with the latest AWS Security Protocols will not communicate with the ELB after this update.

I was able to fix this by reconfiguring the available cipher suites within IIS. Downloaded the IIS Crypto tool https://www.nartac.com/Products/IISCrypto/Default.aspx and applied their "Best Practices" which removed a bunch of insecure ciphers. After that the AWS ELB and IIS happily communicated.

Robin_Message2• 12 years ago

Thanks, nice to know there's not just something wrong with us! We made exactly the same fix with the same tool funnily enough.

Microsoft fixes '19-year-old' bug with emergency patch

Related Stories