See other Science/Tech Articles
Title: Attacks Escalate As Microsoft Announces Emergency .ANI Patch
Source:
informationweek.com
URL Source: http://www.informationweek.com/news ... icle.jhtml?articleID=198701798
Published: Apr 5, 2007
Author: RickyJ
Post Date: 2007-04-05 00:40:17 by RickyJ
Keywords: Enough, Already!
Views: 139
Comments: 9
Attacks Escalate As Microsoft Announces Emergency .ANI Patch Microsoft is getting ready to release an off-cycle patch Tuesday for the bug that has spawned more than 100 malicious sites and a worm over the last few days. By Sharon Gaudin InformationWeek April 2, 2007 12:03 PM Microsoft is releasing an off-cycle patch Tuesday for the .ANI vulnerability that saw an escalating number of threats appearing over the weekend. "From our ongoing monitoring of the situation, we can say that over this weekend attacks against this vulnerability have increased somewhat," Christopher Budd, security program manager at Microsoft's Security Response Center, wrote in a blog Sunday. "Additionally, we are aware of public disclosure of proof-of-concept code. In light of these points, and based on customer feedback, we have been working around the clock to test this update and are currently planning to release the security update that addresses this issue on Tuesday, April 3, 2007." Budd added that Microsoft's technicians will be testing the patch, which will be released on an 'as is' basis with no warrantees, right up until its release. It's possible, he noted, that they will find an issue that will force the release to be delayed. The amount of attacks against the vulnerability intensified over the weekend, according to F-Secure, which noted that the first worm using the exploit was discovered roaming the Internet on Sunday. "We've seen a lot of activity relating to the .ANI exploit during the weekend," said Mikko Hypponen, chief research officer at F-Secure, in an e-mail to InformationWeek. "This vulnerability is really tempting for the bad guys. It's easy to modify the exploit, and it can be launched via Web or e-mail fairly easily." Websense Security Labs reported that researchers there now are monitoring more than 100 Web sites that are spreading the .ANI zero-day exploit. Proof-of-concept code also is in the wild. "Currently, the majority of the attacks appear to be downloading and installing generic password-stealing code," Websense reported on its blog. "Most sites are hosted in China. Interestingly, the most popular domain space being used is .com." The .ANI vulnerability lies in the way Windows handles malformed animated cursor files and could enable a hacker to remotely take control of an infected system. The bug affects all the recent Windows releases, including its highly-touted Vista operating system. Internet Explorer is the main attack vector for the exploits. "In order for this attack to be carried out, a user must either visit a Web site that contains a Web page that is used to exploit the vulnerability, view a specially crafted e-mail message, or open a specially crafted e-mail attachment sent to them by an attacker," Adrian Stone, a Microsoft researcher, said in a blog. "While the attack appears to be targeted and not widespread, we are monitoring the issue and will update the advisory and blog as new information becomes available." Last Friday, eEye Digital Security released a patch designed to prevent the latest exploit from working. The Zeroday Emergency Response Team (ZERT) also released a patch "which addresses the core of the vulnerability, by ensuring that no more than 36 bytes of an "anih" chunk will be copied to the stack buffer, thus eliminating all potential exploit paths while maintaining compatibility with well-formatted animated cursor files." The patch is available for Microsoft Windows 98, 2000, XP, Server 2003, and Vista. The Internet Storm Center is advising users that this is an unofficial patch and should be removed when Microsoft releases its own patch.
Post Comment Private Reply Ignore Thread
Top • Page Up • Full Thread • Page Down • Bottom/Latest
#1. To: All (#0)
I have had enough of MS and the supposed security they have touted for their Operating Systems. A new "bug" has been found that allows a remote user to take control of a users computer and do as they please. Enough! I use to think it was just a case of incompetence on the part of some of MS employees, now I think it is deliberate and I am furious. I have little doubt MS is working with the government to spy on Americans and I am threw using their software on my home computer. I should have switched to Linux sooner but I make a living writing applications for Windows and I never had the time to switch. Now I am making the time, enough is enough!
God is always good! thanks for keeping us informed.
Galatians 3:29 And if ye [be] Christ's, then are ye Abraham's seed, and heirs according to the promise.
I used PC's for years, and kept hoping that Microsoft would finally straighten up and release a decent OS. My last PC had ME pre-installed. That was enough to send me running screaming into the Apple camp, where I've been ever since. OS X is a very decent OS, and I'm very happy with my Apple computers.
"It was an interesting day." - President Bush, recalling 9/11 [White House, 1/5/02]
#2. To: RickyJ (#1)
#3. To: RickyJ (#1)
 | Gold and silver are real money, paper is but a promise. |
#4. To: Elliott Jackalope (#3) (Edited)
If it were only open source I might go for it. I am threw trusting any company partly owned by MS, as Apple is. Most Mac aficionados don't want to hear that their beloved Apple is partly owned by the beast, but it is true. One of the reasons that MS hasn't tried to totally kill Apple off is that they like to use them as guinea pigs to see what people like before they develop it themselves.
OS X is a very decent OS, and I'm very happy with my Apple computers.
God is always good!
"It was an interesting day." - President Bush, recalling 9/11 [White House, 1/5/02]
#5. To: Elliott Jackalope (#3)
One Word... Macintosh.
............
Just a reminder... giving away FREEDOM TO FASCISM dvd's is a wonderful way to help Ron Paul.
Note: All my DVD's now contain two videos. And, I have nicer labels now.
#6. To: RickyJ (#4)
I know MS made a big investment in Apple in the late 90's, but I thought they sold that off a few years later. If anyone has the full story on that I'd like to hear it. Anyways, I still like my Macs a lot. They do what I need them to do with a minimum of fuss and bother, and that's what I need in my computers.
| Gold and silver are real money, paper is but a promise. |
#7. To: RickyJ (#1)
I'm going to take one of my old 500 processor computers out of the closet, backup all of the programs I have on it that I like as well as my photos etc, then I'm going to reformat and install open souce Linux so if I screw up, I won't wreck this XP machine. I'll let you know how I make out..
eNOUGH!
Law Enforcement Against Prohibition
In a CorporoFascist capitalist society, there is no money in peace, freedom, or a healthy population, and therefore, no incentive to achieve these.
- - IndieTX
"Peace? There's no money in peace! What we need is a war!"
--Three Stooges
#8. To: IndieTX (#7)
I have my XP pro installation backed up daily, wouldn't have it any other way with all of the holes Windows has, don't want to ever lose any data again like I did when MS Blaster hit in 2003. I was mad at myself for not being properly protected from that virus, but I should have been mad at MS for leaving such extreme security holes open in the first place, and MS Blaster was an extremely bad virus, at least it was for me. I lost a whole HD worth of data, with most of my school projects on it. I had no backup so the loss was complete. Doesn't really matter, I didn't learn much in school that I didn't already know anyway. I am going to use Norton's Partition Magic to partition my hard drive so I can dual boot either XP pro, or Linux Unbuntu. I can't completely get away from MS yet, at least not until I have a job writing software for Linux, but I will use it for general surfing the net and I am looking forward to learning more about it.
I'm going to take one of my old 500 processor computers out of the closet, backup all of the programs I have on it that I like as well as my photos etc, then I'm going to reformat and install open souce Linux so if I screw up, I won't wreck this XP machine. I'll let you know how I make out..
God is always good!
"It was an interesting day." - President Bush, recalling 9/11 [White House, 1/5/02]
#9. To: RickyJ (#8)
Another option to dual booot is a hosted operating system. http://vmware.com offers software that lets you run a "guest" operating system, like windoz, on a linux system so you can switch from one to the other with both running simultaneously. It does put a load on the computer so I wouldn't bother with it with less than a 2 ghz system and 512 meg ram, but it does work. win4lin is another provider for dual OS systems, but last I checked they were not up to snuff on hosting XP/2000 and above, but it is much cheaper. (Vmware is one or 2 hundred).
Top • Page Up • Full Thread • Page Down • Bottom/Latest