Microsoft rushes clutch patch for 'deep' bug in Windows, third-party apps
Researchers say move may be tied to this week's Black Hat security conference
Computerworld - The emergency patches Microsoft plans to rush out this week will fix a flaw that runs through several critical components of Windows and an unknown number of third-party applications, according to a pair of security researchers.
On Tuesday, Microsoft will slap a permanent patch on a video streaming ActiveX control used by Internet Explorer (IE), addressing a vulnerability that it has known about, but not fixed, for more than a year. Two weeks ago, Microsoft issued a "kill bit" update that, rather than address the underlying problem, disabled the ActiveX control to stymie attacks that were already in progress. It's also slated a fix for Visual Studio, Microsoft's popular development platform.
Although Microsoft has not spelled out exactly what it will patch with the two "out-of-band" updates -- the term for security updates released outside the company's once-a-month schedule -- earlier this month researchers pointed fingers at the Active Template Library (ATL), a code "library" used not only by Microsoft's own developers, but also by third-party software programmers to access some features within Windows.
Two German researchers -- Thomas Dullien, the CEO and head of research at Zynamics GmbH, and Dennis Elser -- dug into the bug within the ActiveX control, the "msvidctl.dll" file, that streams video content. They found that it stemmed from a simple programming mistake in a function called "ATL::CComVariant::ReadFromStream."
"Instead of passing a pointer to a data buffer to IStream::Read, it took the address of a (small) local variable, and passes this address as output buffer to IStream::Read, along with a length read from the stream previously," said Dullien, who goes by the moniker "Halvar Flake" when writing about security vulnerabilities. "Somebody clearly got confused," he added in a blog entry posted July 9.
The result? Although Microsoft shut off current attacks against the ActiveX control, the programming mistake is present in several other Windows files -- at least five in XP, at least 13 in Vista -- including ones crucial to IE, Windows Media Player and Terminal Services.
"The bug is actually much 'deeper' than most people realize," said Dullien, "[and] the kill-bit fix is clearly insufficient, as there are bound to be many other ways of triggering the issue."
Additionally, said Dullien and Elser, third-party developers may have used the same flawed library to create their own applications. "The bug might have weaseled its way into third-party components, if anyone outside of Microsoft had access to the broken ATL versions," said Dullien. "If this has happened, Microsoft might have accidentally introduced security vulnerabilities into third-party products." Dullien claimed that older versions of Adobe's Flash contained the vulnerability.
- Retired US airport body scanners fail to spot guns, knives
- 'Reveton'ransomware adds powerful password stealer
- Many Chrome browser extensions do sneaky things
- Kicking the stool out from under the cybercrime economy
- Symantec folds nine Norton products into one service
- Why would Chinese hackers want US hospital patient data?
- Senator questions airlines' data privacy practices
- About 4.5M face risk of ID theft after hospital network hacked
- SDS still young, but very much on the rise
- Startup builds intrusion prevention system for home networks
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- The business impact of BYOA: Five major challenges and how your enterprise can solve them This E-Book reviews five major challenges of BYOA with key subject matter experts and outlines how businesses can solve them.
- BYOA: Embracing the Opportunity, Controlling the Risk This whitepaper explores the shift from BYOD to BYOA (bring-your-own-application) and how IT departments today can address this new change in the IT...
- Learn More About Peer 1 Hosting's Mission Critical Cloud Mission Critical Cloud from Peer 1 Hosting is enterprise-ready, creating a perfect point of adoption whether you need an off-premise solution for development
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade.
- Peer 1's Mission Critical Cloud: Your Cloud, Your Way Peer 1 Hosting's Mission Critical Cloud offers the ultimate in flexible customization of infrastructure, resources and support. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!