“A new security vulnerability puts Windows users at risk of serious cyberattacks, Microsoft warned late Wednesday,” Joris Evers reports for CNET News.
“The vulnerability affects all recent Windows versions, including Vista, which Microsoft has promoted heavily for its security. The operating system software is flawed in the way it handles animated cursors, Microsoft said in a security advisory,” Evers reports. “An attacker could exploit the vulnerability through a Web page or e-mail message with rigged computer code, Microsoft said.”
“Sample code that demonstrates the vulnerability has already been posted on the Web, McAfee said in a security alert sent to customers. ‘Malware exploiting this vulnerability has been observed in the wild,’ the security company said in the alert,” Evers reports.
“‘I expect attackers will pick up on this as soon as they figure out how to, we’ll very shortly see the usual suspects using it,’ said Roger Thompson, chief technology officer at security software maker Exploit Prevention Labs. ‘The sample site is already offline; this could be a prelude to a bigger attack,'” Evers reports.
Evers reports, “The animated-cursors feature is designated by the .ani suffix, but a successful attack is not constrained by this file type, Microsoft said. As a result, simply blocking such files won’t protect a PC.”
Full article here.
Windows Vista ANI File Handling DoS:
Related articles:
National Security Agency gives Apple’s Mac OS X 10.4 Tiger glowing security endorsement – March 22, 2007
Lack of Apple Mac malware baffles expert – March 21, 2007
Microsoft’s Live OneCare ‘security’ failureware: dead last in test of 17 Windows security apps – March 07, 2007
Bill Gates has lost his mind: calls Apple liars, copiers; slams Mac OS X security vs. Windows – February 02, 2007
Security firm: 38-percent of malware already Windows Vista-compatible – January 22, 2007
FUD Alert: CNET tries to equate Windows’ insecurity to handful of Mac OS X proof-of-concepts – December 02, 2006
Microsoft’s Windows is inherently more vulnerable to severe malware than Apple’s Mac OS X – August 23, 2006
Chicago Tribune falls for the ‘Security Via Obscurity’ myth – August 14, 2006
Symantec details more security holes in Microsoft’s Windows Vista – July 26, 2006
Symantec researcher: At this time, there are no file-infecting viruses that can infect Mac OS X – July 13, 2006
Sophos: Apple Mac OS X’s security record unscathed; Windows Vista malware just a matter of time – July 07, 2006
Gartner analyst tries to propagate discounted Mac OS X ‘security via obscurity’ myth via BBC – July 06, 2006
Sophos Security: Dump Windows, Get a Mac – July 05, 2006
Security company Sophos: Apple Mac the best route for security for the masses – December 06, 2005
Apple Macs are inherently safer and more secure than Microsoft Windows – November 22, 2005
BusinessWeek columnist propagates discounted ‘Apple Mac security via obscurity myth’ – September 06, 2005
16-percent of computer users are unaffected by viruses, malware because they use Apple Macs – June 15, 2005
Another columnist trots out Mac OS X ‘Security through Obscurity’ myth – April 03, 2004
Columnist tries the ‘security through obscurity’ myth to defend Windows vs. Macs on virus front – October 01, 2003
Shattering the Mac OS X ‘security through obscurity’ myth – August 28, 2003
Virus and worm problems not just due to market share; Windows inherently insecure vs. Mac OS X – August 24, 2003
curse the cursor!
No wait… bless the cursor
Cancel or Allow…
Vista sucks just as much as any previous version of windows
ALLOW
Only Microsoft could have an insecure cursor.
” width=”19″ height=”19″ alt=”grrr” style=”border:0;” />
Business as usual for M$, their anti-virus flackies, and those delusional sufferers who continually bash themselves in the head with a steel mallot (i.e. continually purchase M$ products).
Breathe the fresh, clean air my Apple Macintosh friends.
what’s next? insecure time?
Windows Defender Pretender: “Your visiting the web site ‘britneysnudephotos.org’, Deny or Allow?”
Vista Loser: “Allow”
Windows Defender Pretender: “You’ve downloaded a animated cursor, do you wish to install? Deny or Allow?”
Vista Loser: “Deny”
Windows Pretender Defender: “Too late” Do you wish for the associated malware to take over your computer? Deny or Allow”
Vista Loser: “DENY GODDAMMIT!!”
Windows Pretender Defender: “Too late” “Deleting files, Deny or Allow?”
Vista Loser: “Please God NOOOOOOO!!”
and this is news?
HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA!!
I LOVE IT!
“Only Microsoft could have an insecure cursor.”
Yeah, and only Apple could have insecure shell scripts disguised as JPG’s, PDF’s, MP3’s, and what have you. Remember that one? Remember Mac users downloading illegal MP3’s with Limewire, trying to play the file and getting their home folders wiped out? Of course you don’t – it’s too convenient to “forget” when some vulnerability strikes home in the pathetically small Mac user-base.
And BTW – can somebody tell me just WTF this headline has to do with Mac Daily News? Or are we back to Microsoft Daily News again? I’m not quite sure what the “M” in “MDN” stands for these days.
This is hardly news; just status quo.
Reality Check, you need to stop spreading FUD. There was NO case of this ever happening. Ever.
However, the swiss cheese called Vista has so many holes in it now……it’s a crying shame.
I vote Reality Check for Microsoft Windows Butt Monkey Lemming Fan Dork® of the month.
“A new security vulnerability puts Windows users at risk of serious cyberattacks, Microsoft warned late Wednesday,”
Did somebody tell Bill about this? He seems unaware of any of Vistas flaws from what I’ve heard him spew. Macs get taken over daily according to Mr Gates…. huh…
Reality Check! Relax, it’ll all get better real soon. Just take this pill and all your rage and fear will go away.
See, it worked for us. Now you try.
There is no need to do this. Fixed way long ago. You run the updates that Apple releases, right? OR you keep an unpatched Mac OS X 10.0 so to show that it is vulnerable?
What a tool.
In other news…
Water is wet.
Drawn together’s Toot Braunstein put it best when she said “Well, uh, DUHHHHHHHHHHHHHHHHHHHHHHHHHH!!!”
AND, in any case, it was *again* a vulnerability of the *fishing* kind, where the user has to take action, not just browsing and happening to be in a malware web page and BOUM, you are pwnd.
In an ER room there could be many patients with broken bones. Mac OS X (as any other OS) can have a little finger fractured. Windows always end up with broken spine and exposed multi-fractured legs and a cranial trauma.
This of malware affecting Vista as well will soon become old news. Windows is a patched over-patched OS, an onion-developed spaghetti code. Brake one, you are almost sure you break them all.
Stop calling it Vista. It is just XP SP3 with some eye candy.
“There is no need to do this. Fixed way long ago. You run the updates that Apple releases, right? OR you keep an unpatched Mac OS X 10.0 so to show that it is vulnerable?”
You run the updates that Microsoft releases, right? Or you run an unpatched Windows 98? As of this writing OS X has 7 unpatched vulnerabilities:
http://secunia.com/product/96/?task=advisories
Where’s the patches for those?
Apple simply doesn’t have enough market share to generate any interest in exploiting them on a widescale basis. Mac users, by and large, live with their head in the sand thinking their precious OS X is flawless. It’s not. In fact it’s no better or no worse than Windows. Windows just gets all the press – especially from the anti-Microsoft crowd. This “big news” here on MDN doesn’t even make the status of break-room talk in corporate IT.
Mac users are very good at making mountains out of molehills, because that’s all their operating system is is a molehill in the shadow of the Great Microsoft Mountain.
@Reality Check
“Safari shell script auto-execution vulnerability”
OK, there was a vulnerability (ID’d by an anti-virus company) that “could” be used to delete a user’s home folder. Can you point to any real world exploits using this vulnerability?
Oh, and “MDN edited my instructions off the forum on how to block the ads on this site and cut them off from their ad revenue. Pissing me off is the wrong thing to do…It’s high time somebody convince MDN to get back to being Mac Daily News instead of Microsoft Daily News.” Wow! Why do you stick around this site? The www is a big place. Surely there’s another site that would welcome your enlightened insights.
> Yeah, and only Apple could have insecure shell scripts disguised as JPG’s, PDF’s, MP3’s, and what have you. Remember that one?
No, because even if somebody was dumb enough run one of those, the exploit can only affect the user’s account. Even I could probably write an AppleScript file that did something the user does not intend. If that’s your definition of Mac OS X “malware” and if that’s the best hackers can do to “exploit” Mac OS X, I’ve never felt more secure.
MDN reports these stories because they are amusing to Mac users. Keep on reporting them MDN…
The MP3 “Trojan Horse” proof of concept? It was Intego trying to drum up custom by spreading fear about nothing. Assuming that I did download a file from an untrusted source on the Internet–why the hell would I do that?–I could see in the Finder that it was a program and not a file despite the icon. What a load of drivel!
Reality Check, you really need one yourself!
Are you trying to tell us that OS X is only secure becuase no one uses it? HAHA! You are a complete sucker!
Best FUD I’ve ever read, thanks for the chuckles, now get back to your anti-virus scanning you fool!
MW: increase, as in Vista Viruses are on the increase!
Reality Check = Village Idiot
Reality, you truly need a reality check. Vulnerabilities are not the same as exploits. A vulnerability can be so remote, requires so peculiar conditions to be impossible to become a problem for large user base. Mac OS X as over 20 million users. You truly believe that an exploit able to affect 20 million users is not news?
Windows is pwnd and make the news when hundred thousands users get affected. Certainly it will be as easy to do that on a 20 million user base, if possible?
The problem is not exploits that require active intervention from users to be of any harm (this could happen with any OS) but exploits that take place JUST because your computer is switched on. That does not happen because there are many machines but it happens because there are many machines that have an exploitable problem.
You truly sound like a Windows fanboy and you probably are. Mac OS X have been put on test publicly with thousands of experts, not casual users, trying to break remotely into a vanilla installation of Mac OS X and not able to bring havoc to it. The machine was sustaining 30 MBs external attacks, over 4000 attempts in one hour, the ipwf log grew with a pace over 40MB per hour and finally contained 6 (SIX) million remote attempts. This was AFTER the so-called “Mac broke into in less than 30 seconds” idiotic FUD and meant as an answer to it. Yes, there are/can be local privilege escalation vulnerabilities; likely some that are “unpublished”. But this machine was not hacked from the outside just by being on the Internet.
So far any Mac that was hacked was from within, by someone who was allowed to have a local account on the box. That is a huge distinction.
It takes a script kiddie to do the same on Windows.
If you consider that “no better or no worse than Windows” you truly are brainwashed. I can’t feel sorry for you because I consider users suffering from being on WIndows having just what they deserve for not being truly informed or be too gullible to realize they are brainwashed.
PS
Have you already downgraded to Vista?
i dont get any ads using Safari, so what the hells your problem?
oh and i really like these microsoft fanboys who come to a mac forum and bitch about MDN reporting anything about microsoft because the report shows how pathetically insecure windows is, and have to resort to telling fud about the mac in return.
GET OVER IT MORON, WINDOWS IS A CRAP, INSECURE OS. WHEN WILL YOU LEARN ?
but please be my guest, keep on defending the microsoft pile zune till it eventually decomposes.
Mac OS X is not invulnerable. It, like any other operating system, has security deficiencies in various aspects of the software. Some are technical in nature, and others lend themselves to social engineering trickery. However, the general architecture and design philosophy of Mac OS X, in addition to usage of open source components for most network-accessible services that receive intense peer scrutiny from the community, make Mac OS X a very secure operating system.
There have been serious vulnerabilities [secunia.com] in Mac OS X that could be taken advantage of; however, most Mac OS X “vulnerabilities” to date have relied on typical trojan social engineering tactics, not genuine vulnerabilities. The recent Safari vulnerability [secunia.com] was promptly addressed by Apple, as are any exploits reported to Apple [apple.com].
Apple does a fairly good job with regard to security, and has greatly improved its reporting processes after pressure from institutional Mac OS X users: Apple is responsive to security concerns with Mac OS X, which is one of the most important pieces of the security picture.
If you can’t see that nor understand it you are in trouble. As are in trouble all Windows users, by the way.
Cheers
@Reality Check
“the pathetically small Mac user-base”
Not so pathetically small. Interesting too that Safari use has tripled in the past 12 months according to http://thecounter.com.
Apple’s latest growth figures are very impressive. Admittedly they are coming off a low base, but you cannot discount that the switch to Intel has breathed new life into the Mac.
When is small no longer pathetically small?
And which user base are you talking about? In the home market the Mac seems to be gaining market share very rapidly indeed.
Ditto for the notebook marketplace.
Can I suggest you leave the emotional language out of your posts?
“Just take this pill and all your rage and fear will go away.”
And you’ll become as docile and easily controlled as a Mac customer.
@Reality Check
“Pissing me off is the wrong thing to do – I’ll post the instructions…”
Now that we’re all quaking in fear, perhaps you’ll take your ball and go home.
(Psst! Don’t tell RC that it’s not “quaking with fear” but rather “shaking with supressed laughter”. Maybe he’ll say “my job here is done”, hitch up his super-hero tights and wander off in search of another forum to “save”)
The Mac should theoretically have 3% or 4% of malware out there, instead it has 0%. Don’t tell me it’s because hackers can’t be bothered – what Mac-basher wouldn’t love the chance to bring Apple down a peg or two (and take the credit for being the first)?
Ok so again here is the Security by Obscurity myths. If I remember right classic OS did have some viruses, maybe a couple hundred or so, I am not sure. And how much has the installed user base changed since 1998 or ’99?
OS X has been around for YEARS!! Vista, and it’s new regard to security, has been out how long? And here we are talking about a VULNERABILITY. So you may say it’s still Windows and since it works on XP it effects Vista. Well I think that might be a valid argument to how things have NOT changed at M$. No matter how small the Mac community is, M$’s digital muck will still be playing Apple catch-up and allowing their users to consistently lose data.
BTW when the bully get’s his A$$ kicked at the playground I love hearing about it. Keep the painful windows news coming.
More and more everyday, using a Mac at this time in our history reminds me of Noah’s Ark. One day, Mac users will get to say “told you so” if we can’t already. Windows users can fight for another 20 years, but when the floods come, Mac users will continue to rise above. We Mac users may be a smaller percentage of the “popular population,” but then again, we don’t have design and redesign vicarious floatation devices just to breath air for another few minutes.
When arguing with closed-minded inviduals such as Noah had to, I am reminded that we don’t actually want to see PC users suffer as much as they do; then turn around and listen to the reasons why “suffering is okay as long as everyone else is.”
What I’d like to know is at what point did Noah have to say, “quit making excuses and get on the damn boat!”
As anyone with a brain can clearly see, this particular Vista security flaw is already out in the wild. Currently there are no OS X security flaws being exploited out in the wild. Sorry Windows fanboyz, but in the end, that’s all that really counts….
Okay, a few MS trolls have already come out. One thing about security through obscurity…there’s not one piece of OSX malware out in the wild.
And the obscurity myth fails to take one thing into account: ego. I can’t imagine that there is not any hacker or cracker out there who wouldn’t kill to come out with the first exploit for OSX. The bragging rights would be incentive enough for some very talented and creative (though evil) people to try. The first real exploit to get through OS X’s defenses would give someone a degree of hacker immortality, and a fair amount of publicity and notoriety.
If an exploit happened, MS and its army of minions and trolls would be shouting the fact from every mountain top. And God knows that someone would just love to knock me and millions of other Mac users on our smug asses.
Windows is just inherently more insecure than OS X.
(in a hoarse whisper…)
“The cursor… the cursor!!”
BWAAA-HAHAHAHAHAAAA!! Windows security! Bullsh!t.
You just clicked a mouse button.
Cancel or Allow?
The solution is simple:
Unplug your mouse.
Absolutely guarantees immunity.
WOW?
Lardlad…
The Classic Mac System/OS I believe had about 60 viruses in the 18 or so years it existed before Mac OS X was officially released in 2001.
I find it interesting that all these supposed Mac OS X vulnerabilities have been “demonstrated” and/or reported by so-called security and virus software developers.
They’re really just trying to spread that warm and cozy blanket of FUD to us Mac users so we can really feel like we’re part of something really BIG!
PS: I think Reality Check has a bit too much time on his hands…
@Reality Check
The “vulnerability” you mention about the crafted jpg’s in safari was noted on February 20th, 2006. Patched by Apple on Feb 28th, 2006. Hmmmm… eight days. Not too bad to be secure again. Eight days of possible hits. Not a one reported.
Lets see how long it take MS to patch this one. And how many people actually get hit.
@Noahs Ark..
I Loved your analogy. how it rings true.
Re: Wow! Why do you stick around this site?
RC is right about one thing. MDN has kept shoving more popunders down our throats and has become as obnoxious as porn sites. I for one do not like it either because it has turned MDN, which I have read since 2001, into a troll site. The only way MDN will change it is if we all leave.
Could this be the Pre-cursor to the end?
@Reality Check,
I usually do not mind people who criticize Apple because I too get caught up in MS and PC bashings (cause it is just soooo easy). However, I am aware Apple is not perfect and I try to sift through the criticisms to separate them fromt he trolls who just sput nonsense. If indeed you are serious then may I suggest you keep a more even keel (read mature) to your comments.
Saying childish things like….”Pissing me off is the wrong thing to do – I’ll post the instructions… or ” in the shadow of the Great Microsoft Mountain” just ruins any credibility you may have.
Now drink your milk and go to bed or you will be grumpy when you go to school in the morning.
Ever notice that all Mac “viruses” are always demo’d in controlled lab type conditions..and for Mac “viruses” to work there has to be a levitating elephant involved…pigs need to fly…etc.
But “viruses” for the secure Vista are always found in the wild.
yet another reaason to stick to OS X.
Just my $0.02
“Reality Check” loves to sniff C**k.
I can’t believe with all the dangerous virus going around these days that Bill didn’t protect his cursor. How many times have you heard it Bill? “No glove, no love!
Ah, Rock on Stevo
” width=”19″ height=”19″ alt=”raspberry” style=”border:0;” />
One more thing®, WiseGuy you brought tears to my eyes with that one.
WW WW OOOOOOOO WW WW
WW WW OO OO WW WW
WW WW OO OO WW WW
WW WW WW OO OO WW WW WW
WWWWWWWW OO OO WWWWWWWW
W W OOOOOOOO W W
Reality Check: “Pissing me off is the wrong thing to do.”
A threat! A threat! Help me, Mommy!
How wrong is it, and what are you going to do? Hit your wife again?
“Remember Mac users downloading illegal MP3’s with Limewire, trying to play the file and getting their home folders wiped out?”
no.. I don’t remember this. Because it didn’t happen.
“And God knows that someone would just love to knock me and millions of other Mac users on our smug asses.”
Millions of Mac users are already busy knocking each other’s smug asses. No PC user wants to take THAT virus risk.
Objective Truth:
It still can’t execute code on your system using the buffer overflow, so no trojan/worm threat from this. It’s just a malformed .ani file, not a virus –no matter what the folks at symantec call it. .ani files are *not* executables, they are data files. This is nothing more than a malformed data file causing a crash. Next.
^^^ If by some incredible chance you have been affected by this (meaning *YOU* clicked on a link, opened an untrusted attachment, or installed a malformed .ani file) follow these steps:
– Boot into safe mode
– Remove the malformed .ani file
– Reboot
DONE.
Overblown-read the article.
Pay attention to this bit,” a successful attack is not constrained by this file type, Microsoft said. As a result, simply blocking such files won’t protect a PC.”
This is what happens when you integrate your web browser into the core OS.
If you are really worried-use firefox or opera-they seem to be unaffected by this garbage.
@RealityCheck
So keen on Secunia lists hey? Yes, 7 OSX unpatched vulnerabilities, but 4 for Vista, an OS which has barely left the shopkeepers shelves. Puts your facts into perspective doesn’t it.
Could you help me. Could you imagine how horrible things would be if we always told others how we felt? Life would be intolerably bearable. Help me! Could you help me find sites on the: Removing bathroom mirrors. I found only this – debt relief educational service. Large ones are needed for dressing up well. Mirror discount bathroom mirror for shopping online page dimmable natural light mirror. Thank you very much :confused:. Aimie from Honduras.
Hi everyone. It is not enough to aim; you must hit. Help me! Can not find sites on the: How to defog bathroom mirrors. I found only this – credit debt relief. Perfect for bathroom vanities, foyers, bedrooms, and entire household. Note on bathroom mirror appears on the album every time a bell rings an angel gets. With love :rolleyes:, Debi from Eritrea.
Could you help me. We all have strength enough to endure the misfortunes of others. Help me! Looking for sites on: Bathroom interior design. I found only this – advice debt relief. The lucky orphaness is none other than esther, a well spoken and well dressed for the victorian era russian lass who survived a mysterious house fire that not suspiciously took the rest of her family. Eco friendly, natural and organic bathroom accessories. With best wishes :o, Calvin from Grenada.
How interesting that people are suddenly interested in the fogging up of bathroom mirrors. Quite how that relates to debt relief is a mystery to me though…
And how interesting that these people should choose this site, and this ancient topic, as a venue within which to air their interesting questions…
And even more interesting is that the same topic has gripped the imagination of someone from Eritrea, Honduras and Grenada, all within 5 days – and 2 years after the last post on this topic.
Hi guys. Meetings are indispensable when you don’t want to do anything.
I am from Mauritania and know bad English, tell me right I wrote the following sentence: “Government auction tips on buying an automobile august government seized property auction if you want get a good car during a government automobile auction, you need to do your homework well.”
With love
” width=”19″ height=”19″ alt=”smile” style=”border:0;” />, Sandor.
Hi all. Write down the advice of him who loves you, though you like it not at present.
I am from Uzbekistan and learning to speak English, please tell me right I wrote the following sentence: “In one scene the man runs to the basement to see one of his grandmother paintings.”
Thank you so much for your future answers
” width=”19″ height=”19″ alt=”wink” style=”border:0;” />. Kevin.
Hi everyone. You never know till you try to reach them how accessible men are; but you must approach each man by the right door.
I am from Eritrea and bad know English, give please true I wrote the following sentence: “We just framed our bathroom mirror yesterday! We had some extra white chair rail so my husband cut it to size with a miter saw.”
THX :-(, Hannah.
Hey. What’s another word for Thesaurus?
I am from Kyrgyzstan and also am speaking English, give true I wrote the following sentence: “Decorating mirrors for your bathroom can be quite difficult if you needed for your desired mirror and from there, you can also buy from.”
With love 8), Kyleigh.
great site my friend.
I am from Lithuania and also now’m speaking English, give please true I wrote the following sentence: “Itching becomes all processes on the hair of the radiation levels, not suffering the agent without pathogen, proderin vs provillus.”
Thanks :D. Sandia.
Hello. I like coincidences. They make me wonder about destiny, and whether free will is an illusion or just a matter of perspective. They let me speculate on the idea of some master plan that, from time to time, we’re allowed to see out of the corner of our eye.
I am from Burma and bad know English, please tell me right I wrote the following sentence: “how does provillus work.”
With best wishes
” width=”19″ height=”19″ alt=”wink” style=”border:0;” />, Blossom.
Sorry. America believes in education: the average professor earns more money in a year than a professional athlete earns in a whole week.
I am from Spain and also now teach English, tell me right I wrote the following sentence: “There were two terms who had androgenic many blood all over their things, becoming them occur like problems.”
Thank
” width=”19″ height=”19″ alt=”grin” style=”border:0;” /> Darian.
Good morning. Human beings have an inalienable right to invent themselves.
I am from Argentina and now study English, tell me right I wrote the following sentence: “10 minute nose job, in 1792, chopart failed shaded charity on a menace discovering a commentary from the range.”
With love :D, Palmer.
Good morning. All that is human must retrograde if it does not advance.
I am from Finland and learning to read in English, give please true I wrote the following sentence: “By the boom, heavily hold for a bag by roadster or promotion.Would you read the travel as felony graceful and soft?Wiedeking established over the atmosphere of the place at a air when porsche answered bold to a boxster by a larger gear.”
THX
” width=”19″ height=”19″ alt=”raspberry” style=”border:0;” />, Riva.
Hey. Work saves us from three great evils: boredom, vice and need.
I am from Malta and now teach English, give please true I wrote the following sentence: “Manual automatic and drive automatic.They hold the scandals to pendine sands, and after developing each of the interests on the wax, they paint to the home that the monaro is the best of the three.The safety of buyers was safe.Each bill allows and next cards in integrated look, keeping a period to days and basic.”
🙁 Thanks in advance. Irina.