Live data from Hacker News

Microsoft: 0Day Exploit Targeting Word, Outlook

krebsonsecurity.com

41–43 of 43 posts

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#41
post #18

Earlier quoted context omitted.

I think the theory is that once you have any beachhead onto a system, that existing local priv escalation exploits and network mapping techniques are almost always sufficient to complete the exploitation of your corporate network. So if you have 5 people using 5 different email clients, all 5 of those must be kept secure from spear phishing or email-viewing vulnerabilities to avoid having a hacker get a beachhead on…

> you only have to keep that 1 safe This argument may appeal to the self-indulgent system administrator who believes he alone knows perfection. In reality, there is no perfection. One must know there are things one does not know. If China is stock-piling zero days against Outlook, how are you to know? In fact, if there is anything we have learned from biological systems, surely it is that when a monoculture falls, it…

Well, let me reiterate: "(and you'd have to keep it safe anyways)".

You're right that no one is perfect, but that's no reason to expand the number of directions threats can come from.

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#42
post #28
post #27

Earlier quoted context omitted.

This is one of the biggest false assumptions that I see smart people making. Unless you have verified the implementation under the hood, you have no knowledge that the parser and renderer are not being executed on a rich text part regardless of what is displayed on the screen.

Unless it's multi-part MIME which is usually the encapsulation mode for RTF based email. In that case, there's usually a plain text copy attached to the body as well which doesn't need to be read by the parser or any of the rich text stuff. Confirmed: Content-Type: multipart/alternative; boundary="_000_1B81DC42240AEE4B96F487A2683E7EEB0A6AE7505BTHHS2E12BE2Xh_" MIME-Version: 1.0 --_000_1B81DC42240AEE4B96F487A2683E7EEB0…

...and if the vulnerability is in the MIME parser itself?

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#43
post #42
post #28

Earlier quoted context omitted.

Unless it's multi-part MIME which is usually the encapsulation mode for RTF based email. In that case, there's usually a plain text copy attached to the body as well which doesn't need to be read by the parser or any of the rich text stuff. Confirmed: Content-Type: multipart/alternative; boundary="_000_1B81DC42240AEE4B96F487A2683E7EEB0A6AE7505BTHHS2E12BE2Xh_" MIME-Version: 1.0 --_000_1B81DC42240AEE4B96F487A2683E7EEB0…

...and if the vulnerability is in the MIME parser itself?

It wouldn't be if the mitigation was to stop viewing RTF as it says on technet...
Post reply on HN