Outlook Express 6 Service Pack 1 or later can mitigate the risk of being compromised via an email with a malicious animated cursor by reading email messages in plain text format.

Note: Reading e-mail in plain text on Outlook Express does not mitigate attempts to exploit this vulnerability.

]]> http://www.dslreports.com/forum/remark,18094396 Sat, 31 Mar 2007 13:09:17 EDT http://www.dslreports.com/forum/remark,18094350 AB :

said by ModemHead :

Regardless of whether Javascript is required to drop the malware or not, a reading of the Gecko documentation indicates to me that Gecko-based browsers are not going to be vulnerable because animated cursors are not supported.

Works for me. I use a Gecko-based browser. Thanks for the link. :)]]> http://www.dslreports.com/forum/remark,18094350 Sat, 31 Mar 2007 12:55:50 EDT http://www.dslreports.com/forum/remark,18094335 vircotto : Symantec has now addressed this.

»www.symantec.com/outbreak/animat···ity.html

...
Users of Outlook 2002 (or later) or Outlook Express 6 Service Pack 1 or later can mitigate the risk of being compromised via an email with a malicious animated cursor by reading email messages in plain text format.

Symantec Security Response has released virus definition signatures that will detect threats that attempt to exploit this vulnerability. These threats will be detected as Bloodhound.Exploit.131. Certified virus definitions dated March 30, 2007 or later contain this detection.

]]> http://www.dslreports.com/forum/remark,18094335 Sat, 31 Mar 2007 12:51:38 EDT http://www.dslreports.com/forum/remark,18094294 ModemHead : Regardless of whether Javascript is required to drop the malware or not, a reading of the Gecko documentation indicates to me that Gecko-based browsers are not going to be vulnerable because animated cursors are not supported.

See Using URL values for the cursor property, esp. the section titled "Limitations" and "Compatibility with other browsers".]]> http://www.dslreports.com/forum/remark,18094294 Sat, 31 Mar 2007 12:42:45 EDT http://www.dslreports.com/forum/remark,18094132 AB :

said by swhx7 :

said by AB :

said by Cudni :

from
»www.securityfocus.com/brief/473

Aha! Javascript is most definitely heavily involved.

What that article says about Javascript is only that it's used to redirect the browser to another page where the .ani file is hosted. This is not crucial to the exploit; you could go to an infected site in the first place instead of being redirected. JS is not needed to make a browser download an .ani file.

Finally here is what amounts to a safe POC page.
»www.gdgsoft.com/anituner/help/SavingCur.htm
It explains that .ani files are delivered with code like this:

<style>
<!--
BODY{ cursor:url("mycur.ani"); }
-->
</style>

And it contains a link, just like the above, to an actual .ani file which apparently is an animated dinosaur. However, for me there was no animation, and no change in the cursor. This was with Seamonkey 1.x with Javascript off. I then turned on Javascript, and got the same result: nothing. Also I downloaded the .ani file and double-clicked it, and the dialog came up asking which program to open it with. This is on Windows 2000 SP4 with a lot of things turned off, including various services and shell dlls ,etc.. Your mileage may vary.

From the Security Focus article:

"The JavaScript code had previously used known vulnerabilities to exploit the systems of visitors to various Web sites, including the site for Super Bowl venue Dolphin Stadium, but have now transitioned over to using a vulnerability that has not been patched, Marx said.

Other security researchers have found a greater number of pages apparently hosting the file. A search of Google returns more than 113,000 pages with the JavaScript attack on it, according to a blog post by McAfee researcher Craig Schmugar." (Bolding mine.)

Sounds to me like javascript is involved here by more than just browser re-direction. As is often the case for web-based malware.
For me, the question is still is this just another garden-variety exploit being over-hyped (most likely), or truly something to be seriously concerned about?
A second question would be that since this is an old and known vulnerability, why didn't Microsoft patch this long ago?
Maybe they'll just recommend that everyone move to Vista and enable 'Protected Mode'.]]> http://www.dslreports.com/forum/remark,18094132 Sat, 31 Mar 2007 12:09:52 EDT http://www.dslreports.com/forum/remark,18093986 rhatsaruck : Has any firm explained how to determine if you are already infected? The Microsoft advisory is silent on this matter as is Symantec, my AV vendor.]]> http://www.dslreports.com/forum/remark,18093986 Sat, 31 Mar 2007 11:38:23 EDT http://www.dslreports.com/forum/remark,18093351 Mele20 : I'm curious why you didn't install their patch instead?

What AV do you have? Most are protecting against it now..but not mine and it is ironic because Avira adds more definitions than anyone just about. :(]]> http://www.dslreports.com/forum/remark,18093351 Sat, 31 Mar 2007 08:38:38 EDT http://www.dslreports.com/forum/remark,18093229 daveinpoway : I installed Blink Neighborhood Watch from eEye yesterday; they claim this will protect my PC from this problem, but I haven't found any test site to verify if I am indeed protected or not. Since I am using Zone Alarm Pro, I disabled both firewalls in BNW; hopefully, the protection against this malware is still present without BNW's firewalls, but who knows for sure?]]> http://www.dslreports.com/forum/remark,18093229 Sat, 31 Mar 2007 07:14:55 EDT http://www.dslreports.com/forum/remark,18093174 matunga : »securitytracker.com/alerts/2007/···827.html

This can be exploited via various methods, including HTML and e-mail and is not limited to files with a '.ani' file extension.

This can be exploited via various applications that use the vulnerable Windows functions, including Microsoft Internet Explorer, Windows Explorer, Mozilla Firefox, and Microsoft Outlook.

Users with Internet Explorer 7 running in Protected Mode on Windows Vista are not affected.]]> http://www.dslreports.com/forum/remark,18093174 Sat, 31 Mar 2007 06:08:13 EDT http://www.dslreports.com/forum/remark,18093102 swhx7 : Update:

.ani files are interpreted by user32.dll ( »research.eeye.com/html/alerts/ze···328.html ), and it also does a bunch of other things in Windows, so unregistering it would not be an option.

The above page also links to a 3rd party patch.

Note: .ani files can be renamed to .jpg or .jpeg and still be effective in this attack.

said by AB :

said by Cudni :

from
»www.securityfocus.com/brief/473

Aha! Javascript is most definitely heavily involved.

What that article says about Javascript is only that it's used to redirect the browser to another page where the .ani file is hosted. This is not crucial to the exploit; you could go to an infected site in the first place instead of being redirected. JS is not needed to make a browser download an .ani file.

Finally here is what amounts to a safe POC page.
»www.gdgsoft.com/anituner/help/SavingCur.htm
It explains that .ani files are delivered with code like this:

<style>
<!--
BODY{ cursor:url("mycur.ani"); }
-->
</style>

And it contains a link, just like the above, to an actual .ani file which apparently is an animated dinosaur. However, for me there was no animation, and no change in the cursor. This was with Seamonkey 1.x with Javascript off. I then turned on Javascript, and got the same result: nothing. Also I downloaded the .ani file and double-clicked it, and the dialog came up asking which program to open it with. This is on Windows 2000 SP4 with a lot of things turned off, including various services and shell dlls ,etc.. Your mileage may vary.]]> http://www.dslreports.com/forum/remark,18093102 Sat, 31 Mar 2007 04:33:43 EDT http://www.dslreports.com/forum/remark,18093060 Mele20 : McAfee says Firefox 2.0 is not vulnerable. Many are still using 1.5 and without a POC we can't know if it is or is not vulnerable. Probably not but McAfee may not be right as other security experts say that Fx is vulnerable under some circumstances.

I don't like any other email client. OE is the only email client I have used that I really like. ]]> http://www.dslreports.com/forum/remark,18093060 Sat, 31 Mar 2007 03:44:44 EDT http://www.dslreports.com/forum/remark,18093028 swhx7 : Microsoft has known about this since 2006.12, and published an advisory only when exploits were reported. »blogs.zdnet.com/security/?p=143

McAfee says Firefox is not vulnerable. »www.avertlabs.com/research/blog/?p=230

I haven't confirmed it, but I suspect that .ani files are run by one of those shell handler things in Windows. I wonder whether a workaround could be as simple as disabling whatever it is in Windows that runs .ani files.

I would be surprised if Firefox downloads .ani files without warning and calls the relevant handler. If anyone reading this has ever seen a Mozilla browser load up and use an animated cursor without asking permission, or if anyone has seen a proof of concept page so we can test it, please post.

Microsoft email software is an infection vector because it uses the IE pieces for interpreting HTML. Use an email client that doesn't rely on IE and you're ok.]]> http://www.dslreports.com/forum/remark,18093028 Sat, 31 Mar 2007 03:17:05 EDT http://www.dslreports.com/forum/remark,18092279 La Luna :

said by AB :

said by La Luna :

. . why would I open an email from an unknown source who might embed one in an email?

Because you may just have won $100,000.00!! Yes, YOU!!
Or some rich guy may have just died and left you a big pile of money, if only you could assist his Nigerian Executor in getting it to you! ;) :D

. . Maybe I'm not understanding the mode of propagation with this. . . .

From what I'm reading, it's an old and quite well known javascripting vulnerability.
The new wrinkle seems to be in having .ani files carry out the dirty work.
As best I can make of it. But I could be wrong.

Oh crap, this is too confusing.....someone get back to me when it's sorted out, lol....

Now, let me go search for the email from that rich old coot..... :D
--
~~Don't wanna' fight in a holy war...World war III when are you coming for me? Been kicking up sparks, we set the flames free...the windows are locked now so what'll it be? A house on fire or a rising sea?...~~

]]> http://www.dslreports.com/forum/remark,18092279 Fri, 30 Mar 2007 22:50:42 EDT http://www.dslreports.com/forum/remark,18092249 AB :

said by La Luna :

. . why would I open an email from an unknown source who might embed one in an email?

Because you may just have won $100,000.00!! Yes, YOU!!
Or some rich guy may have just died and left you a big pile of money, if only you could assist his Nigerian Executor in getting it to you! ;) :D

. . Maybe I'm not understanding the mode of propagation with this. . . .

From what I'm reading, it's an old and quite well known javascripting vulnerability.
The new wrinkle seems to be in having .ani files carry out the dirty work.
As best I can make of it. But I could be wrong.]]> http://www.dslreports.com/forum/remark,18092249 Fri, 30 Mar 2007 22:45:13 EDT http://www.dslreports.com/forum/remark,18092187 La Luna : I've never, ever seen an animated ani file in an email? And why would I open an email from an unknown source who might embed one in an email?

I suppose it could be passed on by someone else who foolishly opened something unknown, but still, that's a long shot. I can't think of anyone I email with who would do that.

Maybe I'm not understanding the mode of propagation with this.

Clicking unknowlingly on an infected website seems like it would be more of a problem to me.
--
~~Don't wanna' fight in a holy war...World war III when are you coming for me? Been kicking up sparks, we set the flames free...the windows are locked now so what'll it be? A house on fire or a rising sea?...~~

]]> http://www.dslreports.com/forum/remark,18092187 Fri, 30 Mar 2007 22:26:10 EDT http://www.dslreports.com/forum/remark,18091804 Mele20 : All you need to do is use Outlook Express set to Plain Text for reading and then open an email that has embedded ANI files and unless your AV is detecting this, you are infected. If you use default settings for OE then you would get some interactive warning as the email would open in HTML but most folks will ignore the warning and get infected.

»isc.sans.org/diary.html?storyid=···f99022a6
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"

»www.msfirefox.com/]]> http://www.dslreports.com/forum/remark,18091804 Fri, 30 Mar 2007 21:01:29 EDT http://www.dslreports.com/forum/remark,18091728 La Luna : Well, this really IS confusing....from Cudni 's link:

The animated-cursor flaw affects all versions of Windows, including Windows Vista, as well as Internet Explorer 6 and 7.

»www.securityfocus.com/brief/473

So what's the deal? You have to visit an infected site or open an email and click on a link that sends you to a site that has these infected cursors on it?
--
~~Don't wanna' fight in a holy war...World war III when are you coming for me? Been kicking up sparks, we set the flames free...the windows are locked now so what'll it be? A house on fire or a rising sea?...~~

]]> http://www.dslreports.com/forum/remark,18091728 Fri, 30 Mar 2007 20:49:09 EDT http://www.dslreports.com/forum/remark,18091544 Mele20 : Seven AV companies have issued protection. My AV is not one of them. I also use Outlook Express. DEFAULT settings in OE are somewhat protective in that interaction is required so for those who wouldn't just ignore and click on through there is some protection. For Plain Text readers though they are actually at the MOST RISK of all. ]]> http://www.dslreports.com/forum/remark,18091544 Fri, 30 Mar 2007 20:17:03 EDT http://www.dslreports.com/forum/remark,18091090 art22gg : Hi,
There sure seems to be a lot of conflicting stories/confusion going on about this subject.Hopefully the situation will be straightened up with/by someone making a definitive conclusion,about who/what is vulnerable.
MS says per quote--
Mitigating Factors for Animated Cursor Vulnerability
•

Customers who are using Internet Explorer 7 on Windows Vista are protected from currently known web based attacks due to Internet Explorer 7.0 protected mode. For more information on Internet Explorer Protected Mode see the following Web Site.--------This is not "Security Focus" is saying!
Art]]> http://www.dslreports.com/forum/remark,18091090 Fri, 30 Mar 2007 18:50:45 EDT http://www.dslreports.com/forum/remark,18090953 AB :

said by Cudni :

from
»www.securityfocus.com/brief/473

Aha! Javascript is most definitely heavily involved. Thank you very much, Cudni! :)
Still sounds pretty severe, but the javascript aspect is hardly anything new.
I'll continue to disallow it as a general rule, and wait for further developments.
Won't be using any animated cursors, either.]]> http://www.dslreports.com/forum/remark,18090953 Fri, 30 Mar 2007 18:21:05 EDT http://www.dslreports.com/forum/remark,18090878 jansson_mark : Any POC anywhere?
Id surely like to check if Im vulnerable with Firefox, because these reports dont clearly say yes or no to that...]]> http://www.dslreports.com/forum/remark,18090878 Fri, 30 Mar 2007 18:08:27 EDT http://www.dslreports.com/forum/remark,18090859 Cudni : from
»www.securityfocus.com/brief/473
"...
A criminal group responsible for using compromised Web sites to spread malicious software have already started using the latest Microsoft flaw to install their code from at least three servers in China, security experts said on Friday.
.."

Cudni
--
Some are born to failure, others achieve it, all deserve it.
Help yourself so God can help you.
MVP, Microsoft Windows Security 2006]]> http://www.dslreports.com/forum/remark,18090859 Fri, 30 Mar 2007 18:04:32 EDT http://www.dslreports.com/forum/remark,18090753 AB :

said by daveinpoway :

Here's another article about this- »cwflyris.computerworld.com/t/140···57317/2/

Well, now I'm thoroughly confused.
This article seems to indicate that Windows animated cursors are not at risk, and the exploit comes from allowing an animated cursor to run on a particular website, or within an HTML e-mail.
WTF?? Am I missing something? Do animated cursor files abound on websites? Do I run them all the time and just not know it?
Or is javascript heavily involved in this?
And do I have to just run some sort of .ani file on a webpage, or actually allow something specific to be downloaded onto my machine, or is user interaction not even required?

I'm not sure what that smell is.
This is either very scary or hardly worth concerning about-- and I'll be damned if I know which right now.]]> http://www.dslreports.com/forum/remark,18090753 Fri, 30 Mar 2007 17:41:37 EDT http://www.dslreports.com/forum/remark,18090392 daveinpoway : Here's another article about this- »cwflyris.computerworld.com/t/140···57317/2/]]> http://www.dslreports.com/forum/remark,18090392 Fri, 30 Mar 2007 16:32:34 EDT http://www.dslreports.com/forum/remark,18090073 AB :

said by Mele20 :

Whoa! This is nasty! There is NO WAY to protect yourself if you use Outlook Express (even if you use IE7)

Don't use an animated cursor?]]> http://www.dslreports.com/forum/remark,18090073 Fri, 30 Mar 2007 15:34:50 EDT http://www.dslreports.com/forum/remark,18088129 Grail Knight : Has this patch been tested by any other security vendors?]]> http://www.dslreports.com/forum/remark,18088129 Fri, 30 Mar 2007 09:30:07 EDT http://www.dslreports.com/forum/remark,18088009 rgillis70 : Outlook 2007 and IE7 on Vista (as shipped) are not vulnerable to this one.]]> http://www.dslreports.com/forum/remark,18088009 Fri, 30 Mar 2007 09:04:39 EDT http://www.dslreports.com/forum/remark,18087984 swhx7 :

said by KachiWachi :

I guess you don't visit myspace often then swhx7. ;)

Well, seriously, if you or anyone can give me a link to a page that has this in it (harmless .ani file that is), I'd like to check it out. PM is OK.]]> http://www.dslreports.com/forum/remark,18087984 Fri, 30 Mar 2007 09:00:09 EDT http://www.dslreports.com/forum/remark,18087786 Mele20 : There is a temporary patch from eeye security.

»research.eeye.com/html/alerts/ze···328.html

I'm just about to install it.]]> http://www.dslreports.com/forum/remark,18087786 Fri, 30 Mar 2007 08:03:09 EDT http://www.dslreports.com/forum/remark,18087752 KachiWachi : I guess you don't visit myspace often then swhx7. ;)]]> http://www.dslreports.com/forum/remark,18087752 Fri, 30 Mar 2007 07:48:21 EDT http://www.dslreports.com/forum/remark,18087630 swhx7 : OK, I can see Fireferret/Moz browsers being vulnerable if a page can get them to call the Windows routines for using a new cursor from an .ani file instead of the regular cursor the user already has going on. But how would that happen?

In several years of surfing with Mozilla/Seamonkey I've never had the cursor become animated. If it did I would have immediately found a way to prevent it, because I find that sort of thing intolerably annoying.

This must not be confused with the substitute cursors that can be specified with stylesheets. With some CSS you can make a compliant browser use a question mark or crosshairs, for example, instead of the usual pointer. An ani cursor, I presume, would be actually moving on its own.]]> http://www.dslreports.com/forum/remark,18087630 Fri, 30 Mar 2007 06:38:23 EDT http://www.dslreports.com/forum/remark,18087603 Mele20 : Whoa! This is nasty! There is NO WAY to protect yourself if you use Outlook Express (even if you use IE7) and even Windows Vista Mail is somewhat vulnerable. From Microsoft Security Advisory (935423):

"Caveat: Reading e-mail in plain text on Windows Vista Mail does not mitigate attempts to exploit the vulnerability when Forwarding and Replying to mail sent by an attacker.

Note: Reading e-mail in plain text on Outlook Express does not mitigate attempts to exploit this vulnerability."

I have always read all email in OE in Plain Text. That has been excellent protection until this. Alexander Sotirov from Determina recommends reading ALL MAIL with Telnet. That is sure going to be fun.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"

»www.msfirefox.com/]]> http://www.dslreports.com/forum/remark,18087603 Fri, 30 Mar 2007 06:24:40 EDT http://www.dslreports.com/forum/remark,18087575 bcool : Wow! In one little thread two contradictory assertions:

"Alternative browsers such as Firefox and Opera do not appear to be vulnerable to the attack." »www.vnunet.com/vnunet/news/21868···-attacks

"Mozilla Firefox uses the same underlying Windows code for processing ANI files, and can be exploited similarly to Internet Explorer" »www.derkeiler.com/Mailing-Lists/···536.html

Since Firefox most assuredly calls upon the Windows API, I will err on the side of caution. :(
--
"in flagrante delicto"]]> http://www.dslreports.com/forum/remark,18087575 Fri, 30 Mar 2007 06:10:53 EDT http://www.dslreports.com/forum/remark,18087546 matunga : This flaw is a Windows's flaw, not a browser's flaw. Both browsers IE and Firefox are at risk:

Determina also discovered that under certain circumstances Mozilla Firefox uses the same underlying Windows code for processing ANI files, and can be exploited similarly to Internet Explorer

All applications that use certain Windows API calls are affected, including Internet Explorer, Windows Explorer, Mozilla Firefox and Outlook.

»www.derkeiler.com/Mailing-Lists/···536.html]]> http://www.dslreports.com/forum/remark,18087546 Fri, 30 Mar 2007 05:43:35 EDT http://www.dslreports.com/forum/remark,18087075 anon : Found the answer, it is Microsoft products only.
»www.vnunet.com/vnunet/news/21868···-attacks]]> http://www.dslreports.com/forum/remark,18087075 Fri, 30 Mar 2007 00:53:20 EDT http://www.dslreports.com/forum/remark,18086903 anon : I couldn't tell from the writeup - does this affect only IE or can it be exploited via other browsers too? What does Firefox do with the .ani cursors? If there is an animated cursor feature in Firefox, can it be turned off?

(swhx7 posting anon. because of untrusted computer)]]> http://www.dslreports.com/forum/remark,18086903 Fri, 30 Mar 2007 00:07:20 EDT http://www.dslreports.com/forum/remark,18085512 DownTheShore : Thanks for posting this.]]> http://www.dslreports.com/forum/remark,18085512 Thu, 29 Mar 2007 19:58:04 EDT http://www.dslreports.com/forum/remark,18085278 NICK ADSL UK : Microsoft Security Advisory (935423)
Vulnerability in Windows Animated Cursor Handling
Published: March 29, 2007

Microsoft is investigating new public reports of targeted attacks exploiting a vulnerability in the way Microsoft Windows handles animated cursor (.ani) files. In order for this attack to be carried out, a user must either visit a Web site that contains a Web page that is used to exploit the vulnerability or view a specially crafted e-mail message or email attachment sent to them by an attacker.

As a best practice, users should always exercise extreme caution when opening or viewing unsolicited emails and email attachments from both known and unknown sources.Microsoft has added detection to the Windows Live OneCare safety scanner for up-to-date removal of malicious software that attempts to exploit this vulnerability.Microsoft intends to actively share information with Microsoft Security Response Alliance partners so that their detection can be up to date to detect and remove attacks.Customers in the U.S. and Canada who believe they are affected can receive technical support from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls that are associated with security updates.International customers can receive support from their local Microsoft subsidiaries. There is no charge for support that is associated with security updates. For more information about how to contact Microsoft for support issues, visit the International Support Web site.

Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This will include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary.

»www.microsoft.com/technet/securi···423.mspx
--
Wilders Security Forum Admin
Microsoft MVP-Windows Security

]]> http://www.dslreports.com/forum/remark,18085278 Thu, 29 Mar 2007 19:12:10 EDT