Bug gives attackers complete control of Windows PCs

[begood]

A security researcher has warned of a vulnerability in older versions of the Windows operating system that allows attackers to take full control of a PC by luring its user to a booby-trapped website.

The flaw resides in the Windows Help and Support Center, a feature that provides users with online technical support. Malicious hackers can exploit the weakness of Windows by embedding commands in web addresses that activate the feature's remote assistance tool, which allows administrators to execute commands over the internet. The exploit works in XP and Server 2003 versions of Windows and possibly others.

“Upon successful exploitation, a remote attacker is able to execute arbitrary commands with the privileges of the current user,” researcher Tavis Ormandy wrote in an advisory published Wednesday. The attack works against most major browsers, including Internet Explorer 8 if the Windows Media Player is available.

The advisory said Microsoft's security team was alerted to the vulnerability in the help and support feature on Friday. “I've concluded that there's a significant possibility that attackers have studied this component, and releasing this information rapidly is in the best interest of security,” Ormandy wrote.

“Microsoft is investigating public disclosure of a vulnerability affecting Windows XP and Windows Server 2003,” company spokesman Jerry Bryant said in a statement. “We will release more information as we determine the extent of the issue based on our investigation.”

Microsoft engineers place tight restrictions on the remote assistance tools to prevent them from being misused by attackers. But the advisory said it's possible to bypass those protections by tricking the whitelist verification through the use of invalid hex sequences. By combining that weakness with XSS, or cross-site scripting, holes in the Help and Support Center pages, attackers can take full control of a PC simply by exposing a browser to URLs with special commands in them.

“It's a great analysis,” H D Moore, CSO and chief architect of the Metasploit project, told The Register in an instant message. “The core issue itself (not checking the result of the hex decode) is brilliant in how simple it is, and it looks like it took a lot of investigation to determine that it was actually exploitable.”

The advisory provided a proof-of-concept that works for a variety of XP and Server 2003 configurations, but it went on to warn that techniques for exploiting other versions probably exist. The most useful mitigation is to turn off the remote assistance tool, but the advisory provides several other temporary fixes for those who rely on the feature.

Bug gives attackers complete control of Windows PCs ? The Register

[BigT]

Inca o dovada ca cei de la Microsoft nu sunt in stare sa scoata un windows bun. Toate au probleme, unele mai mari altele si mai mari.

[Bebe1911]

Inca o dovada ca cei de la Microsoft nu sunt in stare sa scoata un windows bun. Toate au probleme, unele mai mari altele si mai mari.

Du-te tu si scoate un Windows perfect. Cand va aud.. adevaru ca ai si cumparat windowsu care il ai acum pe pc ca sa ai pretentii. Taci dracu`!

[parazitul29]

nimic nu e impenetrabil,mereu se va gasi unul mai bun care sa-i dea de cap

[strike]

Inca o dovada ca cei de la Microsoft nu sunt in stare sa scoata un windows bun. Toate au probleme, unele mai mari altele si mai mari.

Windows-ul le da clasa mac-ului & linux cand vine vorba de securitate.

[Ellimist]

Pe ce te bazezi cand spui asta?

[strike]

E doar parerea mea, nu vreau sa ma cert cu nici un fan linux sau mac:).Majoritatea exploiturilor au nevoie de interactiunea utilizatorilor pentru ca atacul sa aiba succes.Plus ca de multe ori aplicatiile sunt vulnerabile, nu windows-ul in sine.

Un exemplu foarte bun Adobe.