Microsoft reveals first Vista gadget bugs

Microsoft Tuesday patched several Windows Vista gadgets, the first time it's had to fix the small applications, prompting one researcher to mark the date as the real "arrival of the next-generation of vulnerabilities."

The three bugs detailed in one of the nine bulletins issued Tuesday could let attackers inject their own malicious code into a victim's Vista-powered PC, said Microsoft. Three of Vista's bundled gadgets -- the small applications that sit on the desktop, usually pulling information from other programs or off the Web -- are flawed: the RSS, contacts and weather gadgets. The vulnerabilities in the RSS and weather gadgets are particularly dangerous, since both are enabled by default in a standard Vista installation.

"If a user subscribed to a malicious RSS feed in the Feed Headlines Gadget or added a malicious contacts file in the Contacts Gadget or a user clicked on a malicious link in the Weather Gadget an attacker could potentially run code on the system," Microsoft reported in the bulletin.

Although the bugs can result in remote code executing on the target machine -- a characteristic that usually pegs the vulnerability as "critical" -- Microsoft ranked them one step lower, as "important," in part because Vista's revised account rights settings should deflect the worst kind of damage.

Most third-party researchers, however, fixed attention not so much on the bugs themselves but on the fact that they lived inside Vista's gadgets.

"Six months ago, around the time of Vista release we started talking about the new types of vulnerabilities we might see," said Amol Sarwate, the manager of Qualys' vulnerability research lab. "These vulnerabilities are a testament that this next generation has finally arrived."

Tyler Reguly, a Toronto-based researcher with nCircle Network Security, also tapped the gadget vulnerabilities as among the most interesting of Tuesday. "There was actually an article almost two years ago quoting a researcher at Trend Micro who said that RSS would be the botnets' next stomping ground," said Reguly in a posting to the nCircle blog. "This vulnerability could be proof of that. When you subscribe to an RSS feed you are implicitly trusting that feed. This vulnerability takes advantage of that trust relationship, inserting malicious code into something that you are 'blindly' trusting."

Like Sarwate, Reguly thinks that the RSS gadget bug is a harbinger of bad things to come. "It's a scary thought. This isn't like clicking a link in Internet Explorer...this action has been pre-approved. I'm interested to see where this will lead us."

VeriSign iDefense, which originally reported the RSS bug to Microsoft in March, also spelled out how a hacker could wreak the most havoc with the vulnerability. "If an attacker can find some way to inject data into a trusted feed then they will be able to exploit any subscribers to the feed," the company said in its own advisory, also published Tuesday. iDefense credited Aviv Raff, a security researcher who works for Finjan and is noted for rooting out bugs in Web browsers. In the past, Raff has disclosed vulnerabilities in Apple's Safari and Mozilla's Firefox.

But while these patches are the first to fix Microsoft's tools, flawed gadgets aren't new. Late last month, for example, Yahoo Widgets, a competing gadget platform, was tagged with a critical vulnerability in an associated ActiveX control.

Microsoft's gadget patches can be grabbed via one of the developer's update services.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?