RE: BAD NEWS: Microsoft Security Bulletin MS03-032

From: Drew Copley (dcopley_at_eeye.com)
Date: 09/09/03

  • Next message: Chris Brenton: "Permitting recursion can allow spammers to steal name server resources" 
    To: "'Nathan Wallwork'" <owen@pungent.org>
Date: Tue, 9 Sep 2003 13:51:25 -0700

    > -----Original Message-----
    > From: Nathan Wallwork [mailto:owen@pungent.org]
    > Sent: Tuesday, September 09, 2003 1:18 PM
    > To: Drew Copley
    > Cc: ADBecker@chmortgage.com; 'GreyMagic Software'; 'Bugtraq';
    > full-disclosure@lists.netsys.com; http-equiv@excite.com;
    > 'NTBugtraq'; 'Microsoft Security Response Center';
    > vulnwatch@vulnwatch.org
    > Subject: RE: BAD NEWS: Microsoft Security Bulletin MS03-032
    >
    >
    > On Mon, 8 Sep 2003, Drew Copley wrote:
    > > The only sure way to detect this, I already wrote about [to
    > Bugtraq].
    > > That is by setting a firewall rule which blocks the
    > dangerous mimetype
    > > string
    > > [Content-Type: application/hta]. Everything else in the
    > exploit can change.
    >
    > Just so we are clear, the firewall wouldn't tbe he right
    > place to catch
    > this because that string could be split by packet
    > fragmentation, so you'd
    > need to look for it at an application level, after the data stream
    > has been reassembled.

    Yes, I mean "IPS rule" - "firewall rule" is a bit inaccurate- just a
    traditional term. Any IPS that does not handle fragmentation, though, has
    some serious problems.

    >
    > Of course, if anyone thinks it is easier to protect their
    > browser with a
    > proxy than fix the browser they've got other issues.

    Yes, exactly.

    There have been a lot of inaccuracies about this bug. What should be
    absolutely clear to everyone is that it is a very serious security hole and
    users should put in a fix on their own system and the systems which they are
    responsible for.

    Any kind of "well, my AV protects me from this" is absolutely inexcusable.
    As Nick Fitzgerald pointed out, I don't even think there is AV which looks
    at server response codes.

    This means there is absolutely no protection offered from these products.

    There is a near infinite number of ways someone could write exploit code
    doing the same thing for this bug. There is no way AV can protect against
    the next virus. They don't know it exists. How can they protect against it?

    Beyond this, if you actually tell people you depend on this kind of
    solution... You are telling everyone you are vulnerable. You are telling the
    leagues of the security world "I have this vulnerability on my system, my
    browser is an open door".

    People, think.

    We are not lying and we are not incorrect about this.

    Those that are not ignorant of this problem have a conscience obligation to
    secure the systems they are in charge of.

  • Next message: Chris Brenton: "Permitting recursion can allow spammers to steal name server resources"

    Relevant Pages

    • RE: BAD NEWS: Microsoft Security Bulletin MS03-032
      ... >> That is by setting a firewall rule which blocks the ... > this because that string could be split by packet ... > proxy than fix the browser they've got other issues. ... There is no way AV can protect against ...
      (Full-Disclosure)
    • [Full-Disclosure] RE: BAD NEWS: Microsoft Security Bulletin MS03-032
      ... >> That is by setting a firewall rule which blocks the ... > this because that string could be split by packet ... > proxy than fix the browser they've got other issues. ... There is no way AV can protect against ...
      (Full-Disclosure)
    • [Full-Disclosure] RE: BAD NEWS: Microsoft Security Bulletin MS03-032
      ... >> That is by setting a firewall rule which blocks the ... > this because that string could be split by packet ... > proxy than fix the browser they've got other issues. ... There is no way AV can protect against ...
      (Full-Disclosure)
    • [Full-Disclosure] RE: BAD NEWS: Microsoft Security Bulletin MS03-032
      ... >> That is by setting a firewall rule which blocks the ... > this because that string could be split by packet ... > proxy than fix the browser they've got other issues. ... There is no way AV can protect against ...
      (Full-Disclosure)
    • RE: Protecting XML File While Displayed In Browser
      ... If you're sending data to the user in IE, there's nothing I'm aware of that will protect it before printing. ... Assuming you had some way to protect the data all the way to the printer, once its been printed out you have a whole new set of problems. ... Protecting XML File While Displayed In Browser ...
      (microsoft.public.dotnet.security)
    • Quantcast