[funsec] Amusing security advice from Microsoft

[rms at computerbytesman.com]

I found Microsoft's advice pretty amusing for dealing with the new
"zero-day" ANI security flaw in Windows:

 

  http://www.microsoft.com/technet/security/advisory/935423.mspx

 

   "As a best practice, users should always exercise extreme caution when
opening or viewing 

   unsolicited emails and email attachments from both known and unknown
sources."

 

I guess folks on this list should never had read this message in the first
place. ;-)  I don't even know what "exercise extreme caution" means.  Should
we all stop reading email until there is a patch available for the bug?  I
guess the preview pane is a bad idea also.

 

In addition, the attached Bugtraq message points out that this ANI security
hole isn't actually new.

 

Richard

 



Subject:  

0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038)


From:  

"Alexander Sotirov" <asotirov at determina.com>


Date:  

Fri, March 30, 2007 1:53 am


To:  

bugtraq at securityfocus.com


Cc:  

full-disclosure at lists.grok.org.uk


Priority:  

Normal


Options:  

View
<https://webmail3.pair.com/src/view_header.php?mailbox=INBOX&passed_id=3148&
passed_ent_id=0>  Full Header | View Printable Version
<https://webmail3.pair.com/src/printer_friendly_bottom.php?passed_ent_id=0&m
ailbox=INBOX&passed_id=3148&view_unsafe_images=>  | Add
<https://webmail3.pair.com/plugins/address_add/add.php?email=asotirov%2540de
termina.com&nick=asotirov&first=Alexander&last=Sotirov>  to Addressbook

	

 





 

Today Microsoft released a security advisory about a vulnerability in the
Animated Cursor processing code in Windows:
http://www.microsoft.com/technet/security/advisory/935423.mspx
 
It seems like the vulnerability is already exploited in the wild:
http://asert.arbornetworks.com/2007/03/any-ani-file-could-infect-you/
 
This is one of the vulnerabilities Determina discovered and reported to
Microsoft back in December of last year. It was assigned CVE-2007-0038 and
we
published a brief advisory about it today:
http://www.determina.com/security_center/security_advisories/securityadvisor
y_0day_032907.asp
 
The vulnerability is trivially exploitable on all versions of Windows,
including
Vista. The protected mode of IE7 will lessen the impact of the
vulnerability,
but shellcode execution is of course still possible. Determina also
discovered
that under certain circumstances Mozilla Firefox uses the same underlying
Windows code for processing ANI files, and can be exploited similarly to
Internet Explorer.
 
As noted in Microsoft's security advisory, workarounds for this
vulnerability
are limited at this point. I personally recommend browsing the web and
reading
mail with telnet until patches are available.
 
Of course, Determina VPS Desktop and Server Edition have been continuously
protecting against this vulnerability even prior to its discovery.
 
 
Alexander Sotirov
Determina Security Research

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://linuxbox.org/pipermail/funsec/attachments/20070330/badaa954/attachment.html