Flaw found that affects every Windows machine

By Liam Tung on Jan 31, 2011 6:29 AM
Filed under Security

No server-side workaround yet.

Microsoft on Friday warned that all Windows desktops and servers were vulnerable to a script-handling flaw that could allow an attacker to spoof information displayed in a browser.

The disclosure was made in response to the publishing of a proof-of-concept distributed on the internet which uncovered problems in the way Windows handles MIME-formatted requests.

Maliciously-crafted script that runs on the client side could “spoof content, disclose information, or take any action that the user could take on the affected Web site on behalf of the targeted user,” Microsoft warned.

“The impact is the same a server-side cross-site scripting issue, but the vulnerability lies in the client,” Microsoft explained.

All Windows-run web services that interact with users via input fields are vulnerable, according to Microsoft.

While Redmond has identified a relatively simple client-side work-around, the temporary fix for servers is more complicated, prompting Microsoft to call in Google and other service providers to help solve the problem.

Without a patch or a server side work-around, Microsoft advised web site operators to tell customers to lock down the MHTML protocol handler.

More information can be found here.

Flaw found that affects every Windows machine

11 comments in this discussion

"@Corsair: When it was freshly released, people were waxing lyrical about Vista, too. In 2 years, it'll be WindowsXXX, it's everything Windows 7 should have been. How much of the server market ..."

By meski

Tags

windows, flaw, security, browser, mhtml, mime

Microsoft touts high cost of running XP

Microsoft to drop 'free' upgrade to Windows 8

Microsoft to patch three critical flaws in May

Attackers use Windows flaw to target activists on Google

Breaking Stories

CommBank suppliers compete for portable workloads

New virus hits Iran computers

Exetel taps artificial intelligence

Hackett steps down from Internode

ACCC approves Optus NBN deal

Comments: 11

Corsair Jan 31, 2011 9:34 AM	Wow. At least there is a client side fix. Plus - it requires the user to actually click on a link so there is some caution users can take. That link to the technet blog (in the article which links to more information) is quite a good one. Will this "fix" be distributed via Microsoft Update?
RaTTyRaTT Jan 31, 2011 11:31 AM	Hope it is. I know many mum/pop & grandparent style users who won't get the idea. Reading the tech info - it is a very nasty approach, especially if hackers can deface and inject code from legitimate websites to do the same thing. Problem is, how much airtime will people be given to know about this? (mass media, etc..) or just us IT News & industry crowds??? I will say (to the detriment I am sure of some) one thing I do really appreciate about Microsoft, regardless of anything else, they take corporate security responsibilities very seriously. They don't 'bury their head in the sand' like another large and well known company does with their products/software. They don't sue exploit finders and suppress information, but they 'do' proactively & yes = reactively address things such as this, when they come out. Only a naive company would bury exploits, hide and disregard until they can smuggle out patches, and threaten to sue people who talk about it. I am sure those in the industry know who I am talking about.
Res Jan 31, 2011 11:39 AM	More of a reason to not use software from a company that has the worst security track record in history, if you use windows, you DESERVE everything you get.
Corsair Jan 31, 2011 12:04 PM	@Res: Seriously? That is such an uneducated comment. Just have a think about the how much of the PC & Server market is dominated by Microsoft. Then think about it this way - the more an OS is out there the more people use it and the more it will tested for vulnerabilities. This, in turn, makes it a better OS. Windows 7 is a great OS (it is what Vista should've been). Microsoft Server software is much better now too. Microsoft have learnt their lessons and now have an OS that is much more open than it used to be. Apple, on the other hand, have become the very thing they accused Microsoft of being. Seriously - if you can't see that then you DESERVE to be called uneducated and blind.
maxama Jan 31, 2011 12:13 PM	@ Res: Macs only have 5% of the global market share. Windows about 92% global market share. Software bugs are a natural part of life...
Ace Jan 31, 2011 12:14 PM	Microsoft has the worst security record in history @Res? Admittedly I haven't researched the topic, but the claim does seem a little outlandish. I read an article about a hacker getting access to 40 million Mastercard CC details. Where did Mastercard come on your list?
himagain Jan 31, 2011 1:33 PM	I'm not sure which does more final damage in our world: Inertia or fashion. That inertia is the greatest problem is most clearly demonstrated in the fact that still only about 10% of the world has begun to use the Unix derivative Linux. Fashion as a giant problem is demonstrated by the success of Apple. Vastly over-priced, difficult to use in the real world (yes, it really is!) and now really just a Linux machine. But, no fashionista would be caught without that ubiquitous funny symbol - always cleverly stuck on the back of the open machine. (Of course, They only use them for email, so the lack of programs and usability doesn't matter much)
Graeme Harrison (prof at-symbol post.harvard.edu) Jan 31, 2011 1:41 PM	Yes, Res should have said "a company with a very poor history in terms of security", rather than using superlatives. I've told him a million times not to exaggerate ;-)
Bob Jan 31, 2011 1:46 PM	@himagain. "only use for email". Rolling around floor in fits of laughter. Keep using Windows (please). It gives the rest of us a competitive advantage.
Ace Jan 31, 2011 2:29 PM	There's an email competition @Bob? How does it work?
meski Feb 2, 2011 5:09 PM	@Corsair: When it was freshly released, people were waxing lyrical about Vista, too. In 2 years, it'll be WindowsXXX, it's everything Windows 7 should have been. How much of the server market is dominated by Microsoft, anyway? By units, unix/linux based servers trounces Windows. (about 65-80+ percent in favour of linux) Revenue isn't relevant. (how can it be, when you can get Linux for nothing?, and Microsoft charge?)