Worst Windows flaws of the past decade

The exploits and oversights that left Redmond with egg on its face

WMF: Wherein malware is foisted

Bug identifier: CVE-2005-4560, MS06-001

Description: Vulnerability in graphics-rendering engine could allow remote code execution

Alias: Windows Metafile vulnerability, aka drive-by downloads

Date published: January 5, 2006

Over the holidays in 2005, security researchers began discussing a newly discovered vulnerability in a Windows library used by the OS to display various kinds of graphics in apps and the OS itself.

The problem stemmed from a particular image file format, native to Windows since the days of Windows 3.0, called WMF (Windows Metafile). Used as the native format for storing graphics within Microsoft Office documents, support for WMF was by that point thoroughly embedded into Microsoft products.

WMF files contain function calls that a program sends to the GDI (Graphics Driver Interface). Someone discovered that WMF files can contain executable code as well. This would allow you to, say, create a WMF file that, merely by being viewing, invokes Internet Explorer to visit a particular URL, download a file, and execute that file. Special.

The aftermath of the discovery followed a familiar pattern. Microsoft issued a patch on Jan. 5, 2006, in record time. But for a long while, unpatched computers running vulnerable versions of gdi32.dll roamed the Internet, slurping up mountains of malware.

The bug had far-reaching effects, enabling malicious code to be foisted on unsuspecting users and executed in a variety of ways: previewing an e-mail containing the malicious WMF file in Outlook; viewing an image preview in Explorer; viewing a malicious WMF in certain third-party graphics programs; indexing a hard disk that contained a malicious file; following a URL link in an e-mail, IM, or on another Web page to a site where the malicious file was embedded in the Web page.

Upshot: We learned that nothing is sacred, that any file format could be considered hostile. And we also got a cool new name for an exploit method: drive-by downloads.

MDAC: The component that keeps on giving (headaches)

Bug identifier: CVE-2006-0003, MS06-014

Description: Vulnerability in MDAC (Microsoft Data Access Components) could allow code execution

Alias: MDAC RDS.Dataspace ActiveX bug

Date published: April 11, 2006

Way back in 1998, Microsoft issued a security bulletin about a component of IIS that ran under Windows NT Server called Microsoft Data Access Components. In the bulletin, MS98-004, Microsoft warned that a part of MDAC called the RDS (Remote Data Service) had a vulnerability that allowed unauthorized people to browse databases.

Flash-forward eight years to the spring of 2006. Microsoft released a security bulletin about a component of MDAC called RDS, which has a vulnerability that permits malicious Web servers to perform drive-by downloads against the unpatched PCs of unsuspecting victims. Eerily familiar.

In the later case, it was an ActiveX control that allowed users to connect to RDS through IE and wreak havoc. The ActiveX control doesn't behave as intended, and can be loaded and exploited if you visit the wrong Web site.

Of course, by 2006, MDAC isn't just loaded on servers; you may have it on your PC. Moreover, the bad guys have changed tactics. No longer content to wait patiently for you to happen upon their malicious Web site, they spam you with links, buy ads based on Google searches, and load their pages with SEO (search engine optimization)-rich keywords. The result, however, is the same: Visit and be exploited.

In fact, the bad guys are now using off-the-shelf exploit software to put malware onto your machine. A tool called MPack that's loaded on malicious Web sites can check to see what browser version you're using and what patches you have installed. Based on this analysis, it delivers the exploits that will do the most damage. More galling is that they don't even bother to hide what they're doing, naming the Web page that performs the exploit "mdac4.php."

Upshot: The MDAC RDS is a complex system, with a multitude of patches available depending on which version you have installed. Manually choosing the right patch can be a complicated task. But with such a serious flaw, you can't afford to make a mistake. Patches like these have helped push advancements in Windows Update, which scan your system and pick the right patch automatically, so you don't have to.

Tags Windows Vistawindows xpWindows 2000windows 98

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Andrew Brandt

InfoWorld

Comments

Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?