How embarassing. I think it's hubris at this point that keeps Internet Explorer alive. I think it's been obvious for years that Microsoft just doesn't have the engineering talent to make a decent browser. It's time they bow out of that particular arena and focus on areas where they are strong.
Four RCE Zero-Day Flaws Plague Internet Explorer
11–20 of 34 posts
Re: Four RCE Zero-Day Flaws Plague Internet Explorer
#12So, does this affect Windows 10 and the new Edge web browser?
Re: Four RCE Zero-Day Flaws Plague Internet Explorer
#13Earlier quoted context omitted.
This is standard description of a UAF (use-after-free) flaw. Reliability can vary from "30% of the time, it works every time" to perfectly reliable. It just depends on the instance of the bug. It is one of the most common exploitable bug classes found via fuzzing. Because so many browser fuzzing crashes are UAFs, people have put a lot of effort into developing reliable techniques for exploiting them. See e.g: http://…
Thank you, exactly what I needed to understand.
Google's Project Zero team has written some good blog posts on this topic if you want to read more:
http://googleprojectzero.blogspot.com/2015/06/what-is-good-m...
http://googleprojectzero.blogspot.com/2015/06/dude-wheres-my...
Re: Four RCE Zero-Day Flaws Plague Internet Explorer
#14RCE stands for Remote Code Execution
Re: Four RCE Zero-Day Flaws Plague Internet Explorer
#15"Microsoft was initially given a May 12, 2015 deadline, but this deadline was extended to July 19 at the vendor’s request. Since the company failed to meet this deadline, ZDI has decided to inform users of the existence of this flaw." I would expect Microsoft to handle security vulnerabilities with a higher priority. Not sure why they are dropping this on the floor.
I'm sure there's a lot that goes into fixing these, but Adobe surprised many in the security community with their fast and responsible reaction to the zero-day flaws unveiled by the Hacking Team leaks.
Microsoft has the resources to fix these; I'm not sure what their excuse is (and it may be valid), but vulnerabilities like this should take highest priority.
Re: Four RCE Zero-Day Flaws Plague Internet Explorer
#16WTF? Microsoft must have known what would happen. This isn't 1999 anymore. Did they just call HP's bluff? I was under the impression that MS was generally doing a fairly good job as far as taking these reports seriously.
Re: Four RCE Zero-Day Flaws Plague Internet Explorer
#17How embarassing. I think it's hubris at this point that keeps Internet Explorer alive. I think it's been obvious for years that Microsoft just doesn't have the engineering talent to make a decent browser. It's time they bow out of that particular arena and focus on areas where they are strong.
I find it hard to believe this is a lack of engineering talent. MS has some extremely talented people and has pushed out some very neat security stuff well before, say, Apple has. I cannot believe MS has people sitting around saying "well darn we just don't know how to fix this bug for 6 months now". There's gotta be more to the story... I hope.
Re: Four RCE Zero-Day Flaws Plague Internet Explorer
#18"Microsoft was initially given a May 12, 2015 deadline, but this deadline was extended to July 19 at the vendor’s request. Since the company failed to meet this deadline, ZDI has decided to inform users of the existence of this flaw." I would expect Microsoft to handle security vulnerabilities with a higher priority. Not sure why they are dropping this on the floor.
At some point I prototyped a tool that used Ron Rivest's timelock puzzles (repeated squaring modulo the product of two large safe primes takes a long time and isn't parallelizable, but is quick to compute if you can factor the modulus) to encrypt compressed tarballs of zero-day disclosures.
The idea would be that if you found a vulnerability in a product whose vendor was likely to pour more money into gag orders and legal threats than into fixing the vulnerability, you would publish the vulnerability encrypted in such a way that it would take several years of continuous computation to get the decryption key. Legal threats and/or general foot dragging couldn't put the cat back in the bag.
Sometimes I regret not publishing the tool.
Re: Four RCE Zero-Day Flaws Plague Internet Explorer
#19I'm not a 'security researcher', and have only a technical layman's grasp of the issue, but: > "By manipulating a document's elements an attacker can force a dangling pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process,” The first and second sentence there feels like an 'and then a miracle happens' argument ( http://star.ps…
There is an entire industry of exploit frameworks waiting for this sort of thing to be slotted in and then deployed on compromised ad network servers to download CryptoLocker or similar for-profit malware. Things can go bad very quickly.
Re: Four RCE Zero-Day Flaws Plague Internet Explorer
#20"Microsoft was initially given a May 12, 2015 deadline, but this deadline was extended to July 19 at the vendor’s request. Since the company failed to meet this deadline, ZDI has decided to inform users of the existence of this flaw." I would expect Microsoft to handle security vulnerabilities with a higher priority. Not sure why they are dropping this on the floor.
I'm sure there's a lot that goes into fixing these, but Adobe surprised many in the security community with their fast and responsible reaction to the zero-day flaws unveiled by the Hacking Team leaks. Microsoft has the resources to fix these; I'm not sure what their excuse is (and it may be valid), but vulnerabilities like this should take highest priority.
> Microsoft has the resources to fix these;
I agree, and have to assume the time to fix is back testing and checking with big vendors/users if the fix inadvertently breaks something they were relying on. At this point how many windows bugs are now features set in stone and must be carried on in perpetuity because so much software has been built around the buggy behavior?