Another update on the 0day Explorer exploit

Well, it looks like quite a bit took place while I was out on the “zero day exploit front”. It looks as though there is another update at The Sans Institute. The first thing to notice is that they’ve raised their alert level to Yellow over the impending active exploitation of this vulnerability.

Earlier updates on this event on my site are here and the initial post here.

Among the other information that Sans gives this evening is that they’ve tidied their summary from earlier. Essentially this exploit will open a remote shell and allow arbitrary code to be executed at the privilige level of the user. As of 4PM this afternoon Microsoft has announced an advisory on this issue, no patch yet. They are “aggressively investigating” these reports of the vulnerability.

Sans still has their patch available (Follow the above link to find the details.) They do note that this patch may break Activex components that try to activate this dll library. The dll in question of course, is msdds.dll a dotnet (.NET) component and ships with several products. (See earlier post here or the Sans institutes for more details there.)

Microsoft, in their advisory is “concerned” over how this vulnerability was disclosed saying that the practice of notifying the vendor first should have been the way to deal with the issue. (All malicious hackers out there remember when you find a new vulnerability, tell MS first before you start using it.) Realistically, most of the time this is what is done by the responsible IT Security professionals. In this case I notice that the SANS Institute also has an open letter to Microsoft.

The summary of that is that this vulnerability may be zero day, but the underlying problem has been known for 380 days and Microsoft has YET to address the issue. (They point to this information week article as evidence of a similar flaw. It appears that Microsoft has urged users to set “kill bits” on individual Activex/Com objescts and have a write up on how-to in their knowledge base, essentially open regedit and burrow to some really NASTY looking keys and change a dword.

(The key is named by the CLSID of the Activex control, their suggestion for determining the correct CLSID is to uninstall all of them and only reinstall the one you are trying to modify.)
I would hesitate with this myself, I can’t imagine recommending this to ANYONE as a fix for them to try. Ultimately SANS gets at the real problem which is the default policy is to ALLOW the kind of communication that causes this exploit. They also call on MS to change to a default DENY policy and that the issue needs attention and CANNOT wait until Vista and(or) IE7.

There is a workaround suggested at SANS it sounds like it may take a bit to work through and I would not suggest this for someone that’s never used regedit before. Apparently this Knowledge Base article gives more information.

Further there are a few more updates at Security Fix on this afternoons events. They mention both the SANS yellow alert and the Microsoft announcement.

Hopefully we’ll see an out of cycle Microsoft Patch that will take care of this and any other future problems exploiting this ActiveX flaw.

Related Posts

Blog Traffic Exchange Related Posts
  • MS05-053 Microsoft Windows Image Viewing Vulnerability Two notes on the Windows vulnerability patched day before yesterday. There is a trojan in the wild exploiting it and Symantec's AV definition to detect such an exploit is a bit too paranoid and flags lot's of emf files as having an exploit for the same. The workaround is to......
  • Microsoft's priorities... I didn't really think of this in context, but George Ou points out that Microsoft issued an "out of cycle" patch for their DRM software in response to the FairUse4WM software that stripped DRM protections from Windows Media Files. It took a mere 3 days from being made aware of......
  • WMF exploit situation summary... Since there's been quite a bit of flux the last couple of days I thought I'd try to "reset" the situation and give a general overview of where we stand now with regards to the recent WMF zero-day exploit. 1st there is a vulnerability in the way Windows renders WMF......
Blog Traffic Exchange Related Websites
  • PC Registry Cleaner - Discover The Most Effective And Safest PC Registry Cleaner Out Today! Why would you need a PC registry cleaner? Well, are you tired of files or downloads taking forever? Do you keep getting pop-ups or strange errors everytime you turn around? Well, chances are you need your computer scanned for errors and get those errors fixed as soon as possible! Take......
  • Microsoft to Improve User Access Control in Windows 7 I was just reading a Slashdot article about Microsoft improving User Access Control (UAC) in Windows 7. In the cited PC Pro article, Microsoft engineer Ben Fathi says: We've heard loud and clear that you are frustrated. You find the prompts too frequent, annoying, and confusing. We still want to......
  • San Mateo County Hike in Pillar Point Location: This trail is located at Pillar Point in San Mateo County as part of the San Mateo County Harbor District The Hike: This is a 1.2 mile walk out and back that begins at the outskirts of the Princeton Harbor and ends at the beach. Distance: This is......    Send article as PDF   

Similar Posts

See what happened this day in history from either BBC Wikipedia
Amazon Logo

Comments are closed.

Switch to our mobile site