Hackers jump through holes in Microsoft patch

Paul Roberts   Today’s Top Stories    or  Other Spam, Malware and Vulnerabilities Stories  

Avoiding the Latest Phishing Attacks Computerworld presents a 100% free and online security event today! Client Security Podcast Intercept Spam & Viruses Spam Spikes: A Real Risk to Your Business What to Ask When Evaluating Messaging Security Systems Sign up to receive Security Resource Alerts

September 09, 2003 (IDG News Service) -- Security experts are warning Microsoft Corp. customers about silent Internet attacks that exploit a security flaw in the Internet Explorer Web browser that potentially allows remote attackers to run malicious code on vulnerable machines.
The vulnerability is similar in scope to those exploited by devastating worms such as Nimda, Badtrans and Klez, according to one security company. And, to make matters worse, the flaw is one Microsoft said it fixed weeks ago.
The security hole, known as the "Object Data vulnerability," affects Internet Explorer Versions 5.01, 5.5 and 6.0. It affects the way Internet Explorer processes HTML pages containing a special element called the Object Data tag. If properly exploited, the vulnerability could enable an attacker to place a malicious computer program on a user's machine. No user actions would be required aside from opening an e-mail message or visiting a Web page containing the attack.
On Aug. 20, Microsoft released a patch for Internet Explorer, MS03--032, that it said closed the hole and patched other security holes in Internet Explorer.
According to a message posted to a prominent security discussion group Sunday, however, the vulnerability still exists on machines using Internet Explorer even after applying the patch. That message, posted by a person using the name "http-equiv@excite.com," contained sample code that showed that Internet Explorer is still vulnerable to attack using the vulnerability from HTML pages that are created dynamically using computer script, like JavaScript, embedded in Web pages or e-mail messages.
A Microsoft spokesman confirmed that the company is investigating the reports of new exploits for one of the vulnerabilities addressed in the MS03-032 security bulletin. Microsoft still recommends that customers install that patch, he said, adding that the company isn't aware of any customers who have been attacked using the vulnerability.
Security researchers know of at least one exploitation of the Object Data vulnerability that is already circulating on the Internet, according to a statement by Secunia Ltd., a Copenhagen-based security company.
An e-mail message that contains HTML code that exploits the vulnerability is used to silently retrieve and run a file, "drg.exe," that installs a file called "surferbar.dll" onto the victim's computer, according to the Secunia alert. That file adds a new bar to the affected users' Internet Explorer Web browser with links to pornographic Web sites, the company said.
The Object Data vulnerability is similar to an earlier Internet Explorer security hole dating to 2001, MS01-020, that was exploited by virulent e-mail worms such as Nimda and Klez, according to Secunia.
Security experts familiar with the issue say that Microsoft's failure to thoroughly test its patch against attack scenarios using the Object Data vulnerability is a black eye for the company. "Microsoft should be ashamed. This is a major embarrassment," said Richard Smith, an independent security analyst based in Boston.
The problem with the Object Data vulnerability is similar to a hole found in a prior Microsoft patch, according to Israeli security company GreyMagic Software, which issued a report on that problem in February 2002.
That fact points to problems with Microsoft's patch-testing process, Smith said. "They need to go back and look at how this slip-up occurred. They keep saying they can't prevent bugs, but when the same problems keep occurring over and over, that's a management issue."
A Microsoft spokesman said the company is committed to keeping its customers' data safe and will take "appropriate action" to protect customers when its investigation into the new exploits is complete.
In the absence of a patch from Microsoft to fix the problem, security experts recommended disabling support for Active Scripting on affected Internet Explorer versions. Failing that, users should consider uninstalling the popular browser to protect themselves from attack, experts said.

Reprinted with permission from

For more news from IDG visit IDG.net
Story copyright 2006 International Data Group. All rights reserved.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

"If you're controlling document transmission processes, don't overlook your multifunction printers, advises one vendor...." Read more... "Is it just me or is Twitter suddenly experiencing a much, much heavier spam deluge than usual? And how evil..." Read more... Read more Security posts or See all Blogs

DNS hole prompts synchronized patching effort by IT vendors Microsoft plugs nine holes in Windows, DNS, SQL Symantec warns of new Word attack More top stories...

Microsoft sets XP SP3 automatic download for Thursday Don't give Google a free pass on data collection, privacy advocates say after YouTube ruling XP SP3 to reach most users 'shortly,' says Microsoft

This old laptop: Revitalizing an aging notebook on the cheap All it takes is a couple hours and about $125 to breathe new life into an old laptop. Here's how. Bill Gates moves on Is Microsoft's Golden Age over? What are Gates' most memorable quotes? Find out in Computerworld's complete coverage of the end of the Bill Gates era at Microsoft. Five things you should never tell your boss There are some things your CIO definitely doesn't want to hear. Also don't miss the flipside, Five things you should always tell your boss. Hands-On: Firefox 3 fixes what's broke and keeps what's right With its latest version, Mozilla's browser continues to raise the bar for what Web browsers should be. Windows Vista A to Z Reviews, analyses, how-tos, visual tours, hot issues and predictions about Microsoft's new OS. More Continuing Coverage After 9/11: Homeland SecurityAsk a Premier 100 IT LeaderBlackBerry Legal BattleData Security BreachesElectronic VotingFirefoxH-1B VisasHP's Boardroom ScandalHandheld DevicesHurricane Katrina AftermathMicrosoft Legal IssuesMicrosoft's VistaOpen SourceRFID TechnologySCO's Linux FightSarbanes-Oxley ActSpamVoice Over IPWi-FiWindows Meta File VulnerabilityWindows XP Service Pack 3 IT Careers 2010 Four years from now, the IT field will be a vastly different place. Will you be ready? More Special Reports Premier 100 IT Leaders 2007 Best in Class2006 Computerworld Horizon Awards2006 Premier 100 IT Leaders2006 Salary Survey2007 Best Places to Work in IT2007 IT Forecast2007 Premier 100 IT Leaders40 Years of ComputerworldASPs, Take TwoBest Places to Work in IT 2003Best Places to Work in IT 2004Best Places to Work in IT 2005Best Places to Work in IT 2006Business Intelligence Home RunsBusiness Intelligence: Smarter BIBusiness Intelligence: The Future of BICRM Goes VerticalCRM: Sober CRMCareer Planning Guide 2005Careers: IT Profession 2010Computerworld Horizon Awards 2005Data Management: Mining for GemsData Management: Taming Data ChaosDevelopment: Hard-Workin' Web SitesDevelopment: New Tools New ChoicesDevelopment: The New World of Application DevelopmentDevelopment: The Web Services TsunamiDevelopment: Web Services HurdlesDisaster Recovery: Preparing for the WorstE-commerce Grows UpE-mail/Groupware: Big DecisionsFaces of Mobile ITForecast 2006Global MobileHardware: Multiple Cores, Multiple ChallengesHardware: On-Demand Un-HypedHardware: The Shape of Things to ComeHorizon Awards: 10 Cool Cutting Edge TechnologiesIT Management: Guide to Managing VendorsIT Management: Navigating Global ITIT Management: Recovery AheadIT Management: The Future of ITIT Management: The Resourceful Project ManagerInnovative Technology Awards 2004Management: Reinventing ITMicrosoft in TransitionMobile/Wireless Leaders and LaggardsMobile/Wireless: The Untethered WorkerMobile/Wireless: Tiny Gadgets, Huge CostsNetwork Management: Taking ControlNetworking: Turbulence Ahead!Networking: VoIP Goes MainstreamOperating Systems: In the Slow LaneOperating Systems: Linux Goes GlobalOperating Systems: Should You Nix Unix?Outsourcing: Offshore Buyer's GuideOutsourcing: Outsourcing DangersPremier 100 IT Leaders 2004 Best in ClassPremier 100 IT Leaders 2005 Best in ClassROI: Do the Math!Salary Survey 2003Salary Survey 2004Salary Survey 2005Security Action PlanSecurity: Compliance HeadachesSecurity: Proactive SecuritySecurity: Risk and RewardSecurity: Tips From Security ProsSouped-up SecurityStorage: Battling ComplexityStorage: Cheap & Secure Data StoresStorage: Stretching Your Storage DollarsStorage: The Lean Storage MachineStorage: The New Rules of StorageStorage: The Ultimate Backup GuideSupply Chain: Missing LinksSupply Chain: RFID Reality CheckThe Business of SecurityWeb 2.0 SecurityWireless: Wireless At Work All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone See your link here

Why SaaS is Vital to Email and Web Security Why SaaS is Vital to Email and Web Security Download this webcast, free, compilments of Webroot Software Go to the webcast  Managing Mobile Data with Endpoint Security for Laptops Download this white paper now, compliments of Computerworld and Absolute Software. (Source: Absolute Software) A NetworkWorld survey of IT professionals found that only 1 in 100 employees consistently follow data security policy. This paper outlines endpoint security for laptops that restricts data access beyond encryption to safeguard against insider threats and user error. Read this whitepaper to learn lessons from recent data breaches, limitations of traditional data security, and how to remotely wipe out data and monitor computers that go off the network. Download this executive briefing  Top 10 Reasons to Upgrade Get this white paper now! (Source: Symantec) Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery. Download this white paper  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. Virtualization Analysis for VMware A Guide to Understanding Messaging Archiving Archiving Compliance with Sunbelt Exchange Archiver View more whitepapers

• DNS hole prompts synchronized patching effort by IT vendors
• Microsoft plugs nine holes in Windows, DNS, SQL
• Symantec warns of new Word attack
• More top stories 

Try Fluke Networks' EtherScope Analyzer on your network FREE Quickly solve the wide range of problems you encounter - 10, 100 and Gigabit, twisted pair and optical fiber, LAN or wireless LAN. The EtherScope Analyzer combines the essential tools you need to monitor network traffic and switch interfaces, discover devices, networks, VLANs, access points, mobile clients and more. See the power of this portable network analyzer on your network. Request free trial now *Terms and conditions: Evaluation units are available only for a limited time and will be scheduled on a first-come first-served basis. Not available in all geographies. Limited quantities available; customers requesting evaluation units may be waitlisted for the next available unit. It will be at the discretion of Fluke Networks to accept or decline requests for this free evaluation.