Another update on the 0day Explorer exploit
Well, it looks like quite a bit took place while I was out on the “zero day exploit front”. It looks as though there is another update at The Sans Institute. The first thing to notice is that they’ve raised their alert level to Yellow over the impending active exploitation of this vulnerability.
Earlier updates on this event on my site are here and the initial post here.
Among the other information that Sans gives this evening is that they’ve tidied their summary from earlier. Essentially this exploit will open a remote shell and allow arbitrary code to be executed at the privilige level of the user. As of 4PM this afternoon Microsoft has announced an advisory on this issue, no patch yet. They are “aggressively investigating” these reports of the vulnerability.
Sans still has their patch available (Follow the above link to find the details.) They do note that this patch may break Activex components that try to activate this dll library. The dll in question of course, is msdds.dll a dotnet (.NET) component and ships with several products. (See earlier post here or the Sans institutes for more details there.)
Microsoft, in their advisory is “concerned” over how this vulnerability was disclosed saying that the practice of notifying the vendor first should have been the way to deal with the issue. (All malicious hackers out there remember when you find a new vulnerability, tell MS first before you start using it.) Realistically, most of the time this is what is done by the responsible IT Security professionals. In this case I notice that the SANS Institute also has an open letter to Microsoft.
The summary of that is that this vulnerability may be zero day, but the underlying problem has been known for 380 days and Microsoft has YET to address the issue. (They point to this information week article as evidence of a similar flaw. It appears that Microsoft has urged users to set “kill bits” on individual Activex/Com objescts and have a write up on how-to in their knowledge base, essentially open regedit and burrow to some really NASTY looking keys and change a dword.
(The key is named by the CLSID of the Activex control, their suggestion for determining the correct CLSID is to uninstall all of them and only reinstall the one you are trying to modify.)
I would hesitate with this myself, I can’t imagine recommending this to ANYONE as a fix for them to try. Ultimately SANS gets at the real problem which is the default policy is to ALLOW the kind of communication that causes this exploit. They also call on MS to change to a default DENY policy and that the issue needs attention and CANNOT wait until Vista and(or) IE7.
There is a workaround suggested at SANS it sounds like it may take a bit to work through and I would not suggest this for someone that’s never used regedit before. Apparently this Knowledge Base article gives more information.
Further there are a few more updates at Security Fix on this afternoons events. They mention both the SANS yellow alert and the Microsoft announcement.
Hopefully we’ll see an out of cycle Microsoft Patch that will take care of this and any other future problems exploiting this ActiveX flaw.