Newsletter Archives

• February missing security patch toll: Two zero-days and counting

  Posted on February 28, 2017 at 11:28 CST by woody • Comment in the Forums

  Good report from Dan Goodin at Ars Technica.

  Google’s Project Zero sticks to its 90-day notification policy, and a second 0day has been revealed, this time apparently involving CSS tokens.

  The details are important. For example, there’s no exploit code available for this second 0day. But the first 0day, involving a gdi32.dll heap boundary, is still at large.

  So is the SMBv3 bug that causes crashes, and may lead to deeper exploits.

  Security patches are scheduled to resume on March 14.

  Windows Patches/Security 0day, css tokens, gdi32.dll, smb

• Another Windows 0day appears – gdi32.dll heap boundary error

  Posted on February 17, 2017 at 11:13 CST by woody • Comment in the Forums

  As 0day bugs go, this isn’t an earth-shattering development. But it’s still enough to cause concern.

  Mateusz Jurczyk at Google Project Zero discovered a memory disclosure vulnerability and notified Microsoft on Nov. 17. Project Zero has an automatic 90-day disclosure deadline: If the vendor (in this case Microsoft) doesn’t fix the hole that’s discovered, it will be automatically disclosed 90 days later.

  Sure enough, 90 days passed and, on Feb. 14, the timer rang and the full disclosure popped out, including exploit code.

  This isn’t a huge bug. The bad guy has to get access to your computer before it can be exploited. Once logged on to your machine, the interloper can open a bad EMF file and use it to sneak a peek at system memory that isn’t theirs.

  It seems that security bulletin MS16-074 didn’t fix the problem entirely.

  Yuhong Bao (whom I’ve mentioned before, many times) sent a provocative message to the Project Zero folks. He said:

  I wonder if this was supposed to be part of the cancelled February Patch Tuesday.

  Something to ponder over the upcoming three-day US holiday.

  Windows Patches/Security 0day, EMR_SETDIBITSTODEVICE, gdi32.dll, Mateusz Jurczyk, Project Zero