AB
Premium
join:2006-04-04
Leesburg, VA
| reply to somebodynew5
Re: Firefox 2 is vulnerable to ANI flaw
said by somebodynew5 :
I think the biggest problem with these Proof of Concept test pages is people think that just because they pass one particular test that says their system is safe they think they are safe.
These proof of concept pages often only test a limited subset of all possible attack vectors. . . .
. . In this case the exploit can be triggered by some CSS code to load a ANI cursor file, So with some tweaks I am sure it is quite possible to cause Firefox to attempt to load a ANI file into windows. I don't doubt this for a moment. |
|
fishmaster
Premium
join:2004-10-08
Rockford, IL
 ·Comcast
·Insight Communicat..
1 edit | 
after patch ani alert |
|
|
javaMan
Premium,MVM
join:2002-07-15
San Luis Obispo, CA
| reply to matunga
I'm somewhat perplexed and worried by this term "browser vulnerability" This is an OS vulnerability; web based technologies employed by the browser are simply the vehicle used for transport. As such there is no browser test that will demonstrate either invulnerability or vulnerability. As somebodynew5 noted there are only tests that will indicate whether a particular technology used by the browser is usable for the delivery. What is worrisome is there are a variety of technologies that could possibly be used. It seems prudent to me then that one should not place too much confidence in these "browser vulnerability" tests. Invulnerability will only be attained when MS provides the patch which, according to reports, is coming soon.
--
Woe unto them that call evil good, and good evil; that put darkness for light, and light for darkness. . . Isa. 5:20 |
|
Grail Knight
Who Dares Wins
Premium
join:2003-05-31 | The patch was released today by MS in case you have not checked for updates.  |
|
javaMan
Premium,MVM
join:2002-07-15
San Luis Obispo, CA
| said by Grail Knight  :The patch was released today by MS in case you have not checked for updates. Yeah, thanks. I checked right after posting that message and installed it. 
--
Woe unto them that call evil good, and good evil; that put darkness for light, and light for darkness. . . Isa. 5:20 |
|
Grail Knight
Who Dares Wins
Premium
join:2003-05-31 | I figured as much but better safe then sorry. |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC | reply to matunga
Love those bloggers 
»blogs.zdnet.com/Ou/?p=461&tag=nl.e589 |
|
mysec
Premium
join:2005-11-29
| reply to matunga
said by Boricua65 :I don't use animated cursors, so I should be okay?
Note that it is the code of an animated cursor file, and not an animated cursor itself which does the work. The file has to be embedded in a web page or email. Also, file extensions other than *.ani are used. The one I tested was a .jpg file with the .ani code inside.
said by javaMan : What is worrisome is there are a variety of technologies that could possibly be used. said by somebodynew5 :
These proof of concept pages often only test a limited subset of all possible attack vectors.
Again, Kevin's and my points in the AV thread: if you depend on trying to cover all bases of exploit carriers (.ani, .wmf, etc) you will always be in "emergency mode" but if you are set up to catch the payload, well, the *,ani file can sit cached all day but won't do anything.
said by planet :Would this exploit be less destructive to a machine running in a limited user account?
Of course! fatdcuk pointed out to me the irony of the video, in that that DEP had to be turned off in order for the exploit to run. It's reminiscent of the firewall leaktests: you have to disable your security to let the test executable run to prove you are vulnerable.
Well, they get paid to stir up discussion. But some relevant conclusions can be made from such articles. The browser is on the front line,and should not be depended upon for ones total security. One should always have protection behind the browser for the unexpected.
So what if on day-Zero you encounter the .ani exploit on a web page and it gets by the your browser. Doesn't everyone here have something in place that would block the executable payload? I certainly hope so!
Then, you don't have to be in "emergency mode" and can calmly await the official patch (now released).
regards,
-rich
______________________________________________
"Talking About Security Can Lead To Anxiety, Panic, And Dread...
Or Cool Assessments, Common Sense And Practical Planning..."
--Bruce Schneier |
|
La Luna
Surviving Ashraful
Premium
join:2001-07-12
Warwick, NY
clubs:
·Optimum Online
 ·Vonage
| reply to AB
said by AB :I think it was brought out in the other thread that javascript was *not* involved, beyond the browser re-direction nature of sending you to a page hosting the exploit, regardless of how it was presented in the 'Security Focus' article. A CSS code trojan/worm, was what I got from it. But there definitely seems to be a lot more confusion about what's up with this one than is ordinarily the case. Why start a new thread? It just makes it more confusing and harder to keep up with. So many threads, so little time . . . . I don't care anymore. I'm patched.
I think I lost track of the tennis game not long after this:
said by AB :Aha! Javascript is most definitely heavily involved. Thank you very much, Cudni! »Re: Chinese servers host malicious cursor attacks
--
~~Don't wanna' fight in a holy war...World war III when are you coming for me? Been kicking up sparks, we set the flames free...the windows are locked now so what'll it be? A house on fire or a rising sea?...~~
|
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| reply to matunga
well rich..what you just posted made no sense..when it came to your words on the browser end of the deal..but it certainly is true one needs to stop a vector or a payload if it was cause damage..but your supposition would then be to stop everything until you make sure no one is going to throw mama from the train.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ |
|
AB
Premium
join:2006-04-04
Leesburg, VA
| reply to La Luna
said by La Luna :I don't care anymore. I'm patched. I think I lost track of the tennis game not long after this: said by AB :Aha! Javascript is most definitely heavily involved. Thank you very much, Cudni! » Re: Chinese servers host malicious cursor attacks That was early on in the thread, and just referenced what was printed in the 'Security Focus' article. It became apparent later that javascript was not the culprit on this one.
Meaning that was an incorrect statement on my part.
Glad to hear you're patched up without issues, Luna! |
|
mysec
Premium
join:2005-11-29
| reply to Name Game
said by Name Game :well rich..what you just posted made no sense..when it came to your words on the browser end of the deal..
Why? Sure, browsers have certain security built in. Up until recently, both Opera and FireFox users have laughed at IE users, but now, FF has experienced many vulnerabilities, and O is perhaps not far behind, once malware writers focus on it. No line of code is immune from being exploited.
With that in mind, I would never depend on my browser to be immune from some unknown exploit, and so, I advocate that we should have protection in back of the browser for the "in case" scenario.
quote:
but it certainly is true one needs to stop a vector or a payload if it was cause damage..but your supposition would then be to stop everything until you make sure no one is going to throw mama from the train.
My supposition is to stop *any* executable from being installed by remote code execution, aka, drive-by download.
Many ways to do that: DEP, SRP, Limited User, 3rd-party execution protection -- all White List solutions.
regards,
-rich
______________________________________________
"Talking About Security Can Lead To Anxiety, Panic, And Dread...
Or Cool Assessments, Common Sense And Practical Planning..."
--Bruce Schneier |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| reply to matunga
Naw..just 'lock down' the browser and many threads at this forum to explain the settings to do so. limited user is now set at default for any who hav winxp sp2..and Vista has its own version of the same..no need for theird party stuff..their are setting in your browser to do just that and even IE6 has popup blocker protection that does more than some users realize..but its all there if one looks and sets it up
»www.microsoft.com/windowsxp/sp2/···iew.mspx
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ |
|
jcbsinger
join:2007-04-03
New York, NY
| reply to matunga
Could anyone here please explain me that what is ANI flaw, I am kinda new to this area 
--
Guide on Mp4
»www.mp4-converter.net |
|
swhx7
Premium
join:2006-07-23
Elbonia
·RoadRunner Cable
| reply to matunga
javaMan is right, the browser is only a vehicle. What causes the problem here is unpatched user32.dll interpreting an animated cursor file. The file need not be named with .ani extension.
When we were discussing it before in the other thread (1 and 2 april), we observed that the most straightforward way of delivering the file, namely putting reference to it in a CSS line, did not work on Firefox. And Mozilla doc page said that Firefox could not use the ani files.
WHat we have now is a proof of concept (POC) of infection via Firefox. But they do not explain how it works and they won't until there's a Firefox patch. The two obvious possibilities are (a) certain versions of Firefox support .ani although earlier versions don't or (b) there is some means of getting Firefox to download an ani file without user permission and ask user32.dll to run it, other than the CSS way.
said by Boricua65 :I don't use animated cursors, so I should be okay? I use Firefox 2.0.0.3 as the main browser and IE 6 when pages do not render well and for updates. Or are they talking about the cursors installed from Windows. The point of this whole issue is that it's not a choice. If it were something you could just turn off in Windows it would be less critical. The problem is malicious websites (or frames, emails etc.) can make the system try to run the supposed animated cursor (really a malware) without asking. We don't know how it works thru Firefox yet.
said by jcbsinger :Could anyone here please explain me that what is ANI flaw, I am kinda new to this area .ani files are a type of file that normally makes an animated cursor, but a malicious version of it can take over your computer, if you haven't installed the fix.
Simple answer for all Windows users now, install the patch. You will already have it if you use Automatic Updates. If you use Microsoft Update site and haven't gone there since about midday Tuesday 3rd April, do it now. If you download manually, go to: »www.microsoft.com/technet/securi···017.mspx |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| said by swhx7 :javaMan is right, the browser is only a vehicle. What causes the problem here is unpatched user32.dll interpreting an animated cursor file. The file need not be named with .ani extension. When we were discussing it before in the other thread (1 and 2 april), we observed that the most straightforward way of delivering the file, namely putting reference to it in a CSS line, did not work on Firefox. And Mozilla doc page said that Firefox could not use the ani files. WHat we have now is a proof of concept (POC) of infection via Firefox. But they do not explain how it works and they won't until there's a Firefox patch. The two obvious possibilities are (a) certain versions of Firefox support .ani although earlier versions don't or (b) there is some means of getting Firefox to download an ani file without user permission and ask user32.dll to run it, other than the CSS way. said by Boricua65 :I don't use animated cursors, so I should be okay? I use Firefox 2.0.0.3 as the main browser and IE 6 when pages do not render well and for updates. Or are they talking about the cursors installed from Windows. The point of this whole issue is that it's not a choice. If it were something you could just turn off in Windows it would be less critical. The problem is malicious websites (or frames, emails etc.) can make the system try to run the supposed animated cursor (really a malware) without asking. We don't know how it works thru Firefox yet. said by jcbsinger :Could anyone here please explain me that what is ANI flaw, I am kinda new to this area .ani files are a type of file that normally makes an animated cursor, but a malicious version of it can take over your computer, if you haven't installed the fix. Simple answer for all Windows users now, install the patch. You will already have it if you use Automatic Updates. If you use Microsoft Update site and haven't gone there since about midday Tuesday 3rd April, do it now. If you download manually, go to: » www.microsoft.com/technet/securi···017.mspx And what you just described is the biggest problem with Firefox..in the IE world at least people know the differences in IE5, IE5.5, IE6, and IE7..but when it come to Firefox and people say they have a problem with it..you have no idea what version or plug in or other opensource gimmick they have with it..the whole project has little or no quality control..each version has it own particular problems and I constantly see gurus who write code for it tell users it is not our fault contact the webmaster of the site..or some other vendor.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ |
|
Mele20
Premium
join:2001-06-05
Hilo, HI
| said by Name Game :And what you just described is the biggest problem with Firefox..in the IE world at least people know the differences in IE5, IE5.5, IE6, and IE7..but when it come to Firefox and people say they have a problem with it..you have no idea what version or plug in or other opensource gimmick they have with it..the whole project has little or no quality control..each version has it own particular problems and I constantly see gurus who write code for it tell users it is not our fault contact the webmaster of the site..or some other vendor. That's because you don't use it. I know what the differences are between 1.5 and 2.0 and I won't use 2.0 because of the privacy invasions in 2.0. I also know the differences between the best version of Fx (0.8) and 1.0 and 1.5 and 2.0. As for different extensions causing different problems, the user can always boot into Fx Safe Mode where the extensions and themes are disabled to see if they still have the problem. The extensions are why we use Fx and we become quicky and strongly addicted to them and it's unthinkable to go use IE which has none of the richness of Fx...none of the vista of potential either.
--
"If you want to do DRM on a PC then you need to treat the user as the enemy." Ross Anderson in "`Trusted Computing' Frequently Asked Questions"
»www.msfirefox.com/ |
|
Ryan
Premium
join:2001-03-03
Attleboro, MA
1 edit | reply to Name Game
said by Name Game And what you just described is the biggest problem with Firefox..in the IE world at least people know the differences in IE5, IE5.5, IE6, and IE7..but when it come to Firefox and people say they have a problem with it..you have no idea what version or plug in or other open source gimmick they have with it..the whole project has little or no quality control..each version has it own particular problems and I constantly see gurus who write code for it tell users it is not our fault contact the webmaster of the site..or some other vendor.
:
PFFFF yea who uses software that can be customized or preferred by that user. Everyone should be forced into standardized computing. No choices, no customizing, and you have to pay for it too!  |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
1 edit | reply to Mele20
said by Mele20 :said by Name Game :And what you just described is the biggest problem with Firefox..in the IE world at least people know the differences in IE5, IE5.5, IE6, and IE7..but when it come to Firefox and people say they have a problem with it..you have no idea what version or plug in or other opensource gimmick they have with it..the whole project has little or no quality control..each version has it own particular problems and I constantly see gurus who write code for it tell users it is not our fault contact the webmaster of the site..or some other vendor. That's because you don't use it. I know what the differences are between 1.5 and 2.0 and I won't use 2.0 because of the privacy invasions in 2.0. I also know the differences between the best version of Fx (0.8) and 1.0 and 1.5 and 2.0. As for different extensions causing different problems, the user can always boot into Fx Safe Mode where the extensions and themes are disabled to see if they still have the problem. The extensions are why we use Fx and we become quicky and strongly addicted to them and it's unthinkable to go use IE which has none of the richness of Fx...none of the vista of potential either. No.. that is because I help people with their Firefox problems..not only at DSLR but in the real world and other forums constantly running into prolems they have with it..some case just like the IE mentality where they refuse to update..but too many cases lately where it is just plain broken or won't work with another App and for Firefox 2 the latest is 2.0.0.3 and still counting. Safe Mode.. Firefox does not have a monopoly on that..it is a Microsoft thingie..Richness ??? like with Winamp and shoutcast ?
»www.mozilla.org/projects/firefox···map.html
--
Gladiator Security Forum »www.gladiator-antivirus.com/
Missing Kids
»www.missingkids.com/ |
|
DownTheShore
Maddie Knows Poopie
Premium
join:2003-12-02
Beautiful NJ
clubs:
| reply to jcbsinger
said by jcbsinger :Could anyone here please explain me that what is ANI flaw, I am kinda new to this area It's a vulnerability in the portion of the computer code that allows you to run animated cursors, if I'm understanding it correctly. Nefarious people can use certain browsers/websites to access that coding on your machine and divert it to their own purposes.
You may or may not be vulnerable to it, and your anti-virus program may stop it automatically, but just to be sure, Windows Update has a patch for the problem.
--
Life is simply one damned thing after another. |
|
