Windows 98, Me, NT4, 2000 and XP SSL Flawed

JoeSmack writes "In amazingly unexpected news, ComputerWorld is running an article that says the SSL security hole found in Internet Explorer is not a flaw in the browser, but in the operating system itself." The article mentions that Konqueror was patched against the same bug in 90 minutes.

How many apps will this break?

[Vengie]

Uh-oh. IANA Windows Developer....does anyone know how many apps use this API that microsoft might potentially break? (Fixing bugs: good, breaking stuff: bad....)

Browser == OS

[keesh]

not a flaw in the browser, but in the operating system itself

There's a difference? I thought they were the same thing...

Re:Browser == OS

[torndorff]

Actually, the fact that it is in the CVS makes it accessable to anyone who wants it. Granted not many end users will connect to the CVS and get the latest dev version of KDE, but at least it's there.

Windows on the other hand cannot do this. I respect your point in saying they have a lot of money and customers to deal with, but their perspective on security is a bit skewed. No Windows user can fix their SSL flaw if theyre extremely paranoid, they can only hope that MS will sheild the exploit from the script kiddies of the world.

But youre right, LinuxToday is getting bad.

Re:Browser == OS

[optikSmoke]

Actually, the fact that it is in the CVS makes it accessable to anyone who wants it. Granted not many end users will connect to the CVS and get the latest dev version of KDE, but at least it's there.

On top of this, I believe there has been mention of them backporting the fix as far back as KDE2.2.2 so users who don't want to get the fix from CVS can fix their systems.

Re:Browser == OS

[LMCBoy]

The fix was also backported to non-HEAD branches of CVS. So, all you'd have to do is specify a "stable" branch like KDE_3_0_BRANCH.

Re:Browser == OS

[transient]

You generaly don't want to run cvs software on servers.

You also generally don't want to run KDE, or anything else involving X, on servers.

--

Re:Browser == OS

[RelliK]

I pointed out that both Microsoft and the KDE project have a history of poor security

And KDE's history of poor security would be...?

I also mentioned that, just because a fix is in the KDE project's CVS, does not mean that it is available for everyone - that will have to wait until the next release.

Bull shit. Ever heard of Debian's apt-get, Mandrake's urpmi, RedHat's up2date, etc.? It's up to each vendor to make the fix available to the users. You can also install it yourself without waiting for the vendor to catch up.

Microsoft has hundreds of millions of customers across the world, and the systems handle billions of dollars of revenue... this puts a huge responsiblity to get their fixes right and properly tested

Then can you explain why Microsoft releases bugfixes that uhhm break stuff? Despite the fact that Microsoft takes 2-3 months to uhhh "test" stuff, Open Source community has a much better track record in this regard.

Quite frankly, LinuxToday is becoming unreadable by anyone not a) a KDE super-fan b) rabidly anti-Microsoft.

Quite frankly, you are an idiot spreading FUD.

Slow down there.

[Anonymous Coward]

"Then can you explain why Microsoft releases bugfixes that uhhm break stuff?"

Despite your glaring lack of maturity in the above sentence, I figured I would respond.

Microsoft software (Windows/Office/Internet Explorer or any combination of the above) runs on approximately 95 out of every 100 client computers on the Internet. Now, on those computers, you have every piece of weird x86 hardware ever invented, from crappy $5 ISA modems to $5,000 SCSI RAID arrays. You also have Microsoft software that runs on Macintosh, Solaris, HP-UX and FreeBSD computers.

Now, figure that Linux runs on approximately 1 out of every 100 client computers on the Internet. (This is a high guess -- I'm giving Linux the benefit of the doubt here.) Now assume that KDE runs on 100% of those computers (also an extremely high guess.) So for every 1 person who receives the KDE fix, there will be about 92 (I'm taking out the non-Windows, non-Linux users) people who receive the Microsoft fix.

Considering that there are hundreds of millions of people on the Internet, and hundreds of BILLIONS of different hardware configurations, the chance that a Microsoft fix will break something is much higher than the chance that a KDE fix will break something.

"Ever heard of Debian's apt-get, Mandrake's urpmi, RedHat's up2date, etc.? It's up to each vendor to make the fix available to the users."

Oh, I love these arguments. It's funny how most people who run Linux don't trust their vendor enough to release patches in a timely manner, and actually whine about fixes being easy to get. "But I run Linux so I can do everything myself!"

I run about 12 Linux servers. I trust my vendors (Red Hat and Sun Cobalt in this instance) to provide me with timely updates. But the funny thing is that whenever I recommend that people trust their vendor for services like Apache or PHP and use up2date, I get laughed at. In fact, when I say that I use Red Hat and Sun Cobalt, I get laughed at. "Why not just compile everything yourself? Why not just use Debian?" Well, guess what, ladies and gentlemen -- I run a profitable business off of my servers and I don't have time to sit on SecurityFocus all day and make sure I'm not affected by the myriad set of would-be bugs on my servers. I trust my vendor to test the updates on their set of supported hardware and release them to me in a timely manner. I will then run the vendor-supported update tool and download them.

The people I see who are the most rabid advocates of open source are also the most rabid advocates of doing everything themselves -- the epitome of the "trust no one" saying. These are the SAME people, much like yourself, who also say that it's up to the vendor to release patches. I have news for you. You either need to trust your vendor to provide patches, or you need to realize that in the real world, not everyone has time to make a test bed and test that every CVS patch works the way it is claimed to. You can't bash Microsoft for taking time to release tested updates and then claim that Linux is better because you can install a fix that is untested instead of "waiting for the vendor to catch up".

Re:Slow down there.

[pmz]

You also have Microsoft software that runs on Macintosh, Solaris, HP-UX and FreeBSD computers.

I work on Solaris every day...where's the Microsoft software? I know that IE is available for Solaris, but I certainly wouldn't be so stupid as to actually install it.

...there will be about 92 (I'm taking out the non-Windows, non-Linux users) people who receive the Microsoft fix

Your giving the Windows users too much credit. The fraction of KDE users who will eventually upgrade KDE is much higher than the fraction of Windows users who will ever bother to patch their systems.

Considering that there are hundreds of millions of people on the Internet, and hundreds of BILLIONS of different hardware configurations, the chance that a Microsoft fix will break something is much higher than the chance that a KDE fix will break something.

Actually, a patch that breaks something because of an odd hardware configuration simply indicates architectural flaws in the OS.

It's funny how most people who run Linux don't trust their vendor enough to release patches in a timely manner, and actually whine about fixes being easy to get.

??.

I don't have time to sit on SecurityFocus all day and make sure I'm not affected by the myriad set of would-be bugs on my servers...

You should at least read up on what is being delivered to you during an "up2date" session, so you know what the configuration of your servers is at any moment. Software changes can have complex ramifications, if done blindly.

I think the rabid Linux people you are going after simply are the people who want to know where they actually are at any given moment. This is actually a responsible attitude towards system administration. If you don't have time for it, perhaps you are overworked and need an assistant?

The people I see who are the most rabid advocates of open source are also the most rabid advocates of doing everything themselves...

So certain Peruvian congressmen are uber-elite system administrators? People who simply want a non-proprietary Office format also write their own kernel modules?

Re:Slow down there.

[Malcontent]

Let's say you need to update a 100 windows machines when MS finally get around to issuing a patch. What do you do? Go to each machine and press windows update, answer a a few questions, click a few buttons, and reboot at least once.

Let's say you need to do the same thing with a 100 debian machines. You write a script which takes about 15 minutes and you run it.

Which costs you less time and money?

Re:Slow down there.

[bergeron76]

You either need to trust your vendor to provide patches, or you need to realize that in the real world, not everyone has time to make a test bed and test that every CVS patch works the way it is claimed to.

I implicity trust Redhat, Mandrake, and all the major Linux vendors for that matter; _implicitly_. Based on nothing more than the fact that they have a proven track record of being trustworthy, and not eavesdropping/abusing/fscking the consumer. Microsoft on the other hand has a notorious reputation for abusing customers, vendors, programmers and competitors. I won't provide any references because I'm quite certain that google will provide more than I care to count. Do the homework yourself if you don't already agree.

If for no other reason than that, I will trust Redhat to provide "vendor" patches because I have no reason not to. For the record, I'm not one of those "paranoid"/"I'll fix the code myself" people you spoke of. I'm just joe-average-sysadmin with my company's best interests in mind.

Re:Slow down there.

[jsse]

"Why not just compile everything yourself? Why not just use Debian?" Well, guess what, ladies and gentlemen -- I run a profitable business off of my servers and I don't have time to sit on SecurityFocus all day and make sure I'm not affected by the myriad set of would-be bugs on my servers. I trust my vendor to test the updates on their set of supported hardware and release them to me in a timely manner. I will then run the vendor-supported update tool and download them.

I feel obliqued to answer regardless of the fact that you choose to be a coward.

Exactly what kind of profitable business you are doing? Yes you could trust your vendors to supply the latest fixes to you in timely fashion, but you don't seem to get the idea of risk management. If your 'profitable business' cannot bear the loss resulted in not-up-to-time fixes from vendors, you must check closely with latest security updates.
Since you mentioned security update site like security focus, have you realize that there's nothing you can do when your vendor like Microsoft who don't give a damn to the security problems in their products and you've no choice but to remove the problematic products until they are generously enough to release the patch?

In conclude, you either has no clue on the word 'risk' or you simply have way too much money to spare(or your boss has way too much spare money to hire the like of you). :)

Re:Browser == OS

[RelliK]

Well, this summer alone, I have seen a fair number of Konqueror security flaws posted

How many? One?

Also, most vendors do not provide CVS packages for things like this. Hell, debian still doesn't even have an official KDE3. And even if there is a CVS version, how many people are going to be quick to hop on it, considering the code in CVS is typically beta at best? And what newbies are even going to know about this?

Some ridiculously stupid mumbles there. Each distribution has an easy way of upgrading the packages. In Debian it's "apt-get updage; apt-get upgrade". In Mandrake & RedHat you just run the GUI updater software. The update icon is right there on the desktop.
Nobody is suggesting that you should install a CVS version of software to get a security fix. The fixes are backported into the stable branches of the software, and vendors package them. Wow, what a concept!

And then your issue on bugfixes. Are you trying to say that OSS patches never break anything?

No, I'm saying that Microsoft breaks stuff more often despite taking months to release a fix.

patch distribution model

[Kris Warkentin]

This is a pretty important point. Just because the KDE people fixed it doesn't mean everyone will have it. Instead of asking, "How long did it take for it to get fixed", we should be asking, "How long until it is widely enough deployed such that exploit writing becomes unprofitable?" It seems to me that even if Microsoft is a little slower getting a bug fixed, the universal "Windows Update" probably gets the patch on a greater percentage of machines more quickly.

Of course, the number of Windows desktops dwarfs the number of KDE desktops so if even a small percentage of Windows installations don't get patched, it would probably be about the same as if KDE never got patched at all. ;-)

Re:patch distribution model

[spectral]

How many people do you know actually go to Windows Update? I've had several people call me and ask me to get rid of the critical update notification because they were too stupid to figure out how to turn it off. They didn't want to update, they wanted to do what they already knew how to do, and didn't care about anything else that got in their way. To expect people to go out of their way to update something like this is a bit skewed. I think a much, much higher percentage of people who use linux (kde/konqueror) would know/care enough to keep up to date on patches and upgrades. Not because they're necessarily more paranoid about security (though i'm sure that's the case for some people), but because they know more and know that it's usually a good idea.

People who only want to use AIM, Winamp, IE, and whatever email program they've been trained to use (probably outlook express) don't want to deal with "SSL Vulnerability!" notifications popping up in their system tray.

And they certainly don't care enough to go looking for fixes in Windows Update, even though the link to it is right at the top of the start menu.

Re:patch distribution model

[TobyWong]

No developer has control over the end user and how often they feel like updating/patching so the best they can do is expedite matters on their end. So yes, we should be asking "how long did it take for it to get fixed" because that is something the developer has direct control over.

Re:Browser == OS

[tshak]

Great post. Although Linux patches are generally more prompt, one has to consider the testing aspect. A corporation has to answer to customers if a patch breaks. If a Linux (or another OSS program) patch breaks, they claim it was "Alpha" and can "patch the patch" (read: APATCHY web server). This still gives a slight edge to OSS in the long run, but it's not as dramatic as "90minutes vs. 45 days".

Re:Browser == OS

[DunbarTheInept]

A corporation has to answer to customers if a patch breaks.

On the surface of it that would appear to be a true statement. But the existance of Microsoft is a counterexample. They often have broken patches and nobody bothers calling them to task for it.

Re:Browser == OS

[the eric conspiracy]

they claim it was "Alpha" and can "patch the patch" (read: APATCHY web server

The "patchy" web server has a security record so far superior to Microsoft's IIS that the edge is more like 4 milliseconds vs. 4 billion years.

The number and severity of compromises of IIS is legendary (the FBI has ranked IIS as the number one security problem on the internet). There have been times where the servers I administer have been recieving more hits from compromised IIS installations trying to spread virii than they have from legitimate users. The problem got so severe last summer that my broadband ISP had to block port 80 to keep their network up.

And this is NOT an issue of population base causing statistics to be skewed - the patchy web server has more installations than all others combined.

Re:Browser == OS

[Tony Hoyle]

We tried to install Win2k service pack 3 on two test machines to see if it broke anything. It destroyed them, right back to the 'can't find NTLDR' prompt.

Does microsoft answer to all the machines that SP3 breaks? (Some companies might not be as careful as us and could lose important data). No, the EULA explicitly states that they have zero liability even if sp3 triggers World War 3 (before GWB does).

Anyone who uses the 'liability' FUD about MS software deserves shooting. If it breaks, you get to keep both pieces (to coin a phrase).

the funny thing

[vectus]

is that for most consumers, this doesn't even matter. I mean, they will be effected by the security hole, but if their computer gets hacked or something, they'll end up just blaming their own lack of computer knowledge. They'll eventually install the patch from windows update (if they know how to access windows update), and then blindly keep surfing the net and playing "who wants to be a millionaire".

Re:the funny thing

[mosch]

Actually, I prefer to play Who Wants To Smoke My Honeybear [zooass.com].

Oh, that's good then...

[MrFenty]

...Scott Culp, manager of the Microsoft Security Response Center said that the SSL flaw doesn't affect any other application outside Internet Explorer and that it's a client-side issue only.

Glad it's only a client side issue then.

But, of course

[A5un]

Internet Explorer is part of the Operating system, no?

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:These statements don't agree..

[platypus]

Indeed, I was on to post the exact same.

In other words:
"Well, that is because Internet Explorer is the real one and only operating system service you need if you want ssl."

Re:These statements don't agree..

[Moonshadow]

So if I'm using Mozilla on Windows, is it safe?

If this is an OS-level flaw, then it would stand to reason that there would be a problem in actually using ANY SSL on that OS. Scope and all that. So which is it? Do I need to boot in to Linux to buy anything online until the patch is released, or what?

Re:These statements don't agree..

[sohp]

Either Microsoft is saying it's an O/S problem in order to continue their desire to persuade consumers that the browser and the O/S are one, or they are saying that there is a library that with an API that no one outside of the IE team uses. The latter assertion is just as troubling given the background of Microsoft's assertion that their own internal programmers do not have special access to APIs. Maybe it is a real library, with a publicly a documented API, but no one else -- not even other Microsoft programmers -- have seen fit to reuse it? It's hard for me to see how Microsoft's spokespeople could spin this in any way that doesn't raise eyebrows about the state of the Windows/IE combination.

Re:These statements don't agree..

[Patman]

Does anyone else see something amusing in these two statements when
taken together?

Nah. To me, it simply shows that the app providers don't trust Microsoft's implementation. For whatever reason, they've chosen to find their own methods of crypto rather than relying on MS.

Re:These statements don't agree..

[lgraba]

I think that there are two amusing things in these two statements:

One: 'it makes sense to put it into the OS so any application can use it', followed by 'the only applicatio that uses it is IE'.

Two: I though IE WAS part of the OS, not an application.

Re:These statements don't agree..

[cloudmaster]

Probably "no one knows it's there" - based on my previous experience with locating documentation to various windows' feature sets... :)

He he he

[legLess]

Quoth the article:

Microsoft officials said it makes sense for the operating system to provide cryptographic services to any application that needs it, instead of each application having to include its own cryptographic technology.

But Culp said that the SSL flaw doesn't affect any other application outside Internet Explorer and that it's a client-side issue only.

Translation:
"This is the best way to do it. Of course, that's not how we actually do it."

Re:He he he

[poot_rootbeer]

A better translation might be:

"Cryptography is included in the Windows API. For some reason, no one trusts it enough to use it except our IE development team."

Re:He he he

[larien]

Or it could be:

"Cryptography is included in the Windows API. No-one else uses it because we don't disclose that API"

Didn't mention Windows 95

[SpanishInquisition]

So I guess it's safe.
It's a good thing I didn't upgrade.

Re:Didn't mention Windows 95

[ncc74656]

So I guess it's safe. It's a good thing I didn't upgrade.

IIRC, Win95 was end-of-lifed a while back. Whatever holes remained in Win95 at that time will never be fixed.

(Then again, IE was never an integral part of Win95. You could presumably run Win95 & Mozilla (assuming Mozilla supports Win95...turns out that it does [mozilla.org]) and not run into these problems.)

Re:Didn't mention Windows 95

[Anonymous Coward]

I wonder if this is why my computer thinks it's 1902. And here I thought my ssl certs wouldn't expire for another 101 years.

favorite quote

[nestler]

Microsoft officials said it makes sense for the operating system to provide cryptographic services to any application that needs it, instead of each application having to include its own cryptographic technology.

This "makes sense" up until the point where you have to patch your kernel instead of upgrading a library. When OpenSSL had a bug, they fixed it and you could upgrade OpenSSL. When Konqueror had this specific bug, it could be uprgraded easily enough. Now Windows users have to patch their entire OS to fix this (or just use another browser that doesn't use the crypto-in-the-kernel routines).

Re:favorite quote

[GiorgioG]

This "makes sense" up until the point where you have to patch your kernel instead of upgrading a library. When OpenSSL had a bug, they fixed it and you could upgrade OpenSSL. When Konqueror had this specific bug, it could be uprgraded easily enough. Now Windows users have to patch their entire OS to fix this (or just use another browser that doesn't use the crypto-in-the-kernel routines).

Why is everyone nitpicking over this? What difference does it make if one has to patch an application or an OS (Is an OS not an application?) What other crypto services do you use in Windows at the moment outside of your browser? Ok, Ok, I know you all hate MS/Windows, but this is just childish.

Re:favorite quote

[topham]

Because it takes Microsoft far longer to release a patch for an OS than an application.

By the way, read the article and you find out that according to Microsoft the bug only effects IE, yet it is contained in an OS level API.

Huh? Shouldn't that mean anything using that same API would have the problem? Unless of course this is just one piece of the IE code they toss in an in-appropriate DLL.

No, can't be. Microsoft wouldn't do that.

Re:favorite quote

[rmohr02]

Shouldn't that mean anything using that same API would have the problem?

Yes. But nobody but M$ stupid enough to trust M$'s closed source encryption API.

Re:favorite quote

[topham]

Thats funny.

According to the EULA Microsoft Isn't responsible for the code either.

I'm a programmer by trade.

Microsoft doesn't have a fucking clue.

Re:favorite quote

[topham]

I sure as hell could have implemented the API in question without this fuckup.

I could also patch the source code in about 10 minutes, then check the propgation of the error code and verify it is handled correctly, another 10 minutes. Longer if it isn't of course, but again, not the end of the world, other Certificate errors are already handled.

Send it off for 3rd party testing and have results back within what, an hour?

Add in the time to generate a certificate for testing, blah blah... Your not talking days. Regardless.

And no, Microsoft doesn't have a a god damn clue how to write an OS or divide functions up between appropriate DLLs.

By the way, go ahead and try to sue Microsoft based on the assumption that EULA won't stand up in court. You can't.

Re:favorite quote

[Amazing Quantum Man]

Here's a question - who do I sue if that bug in Konqueror causes me to lose money? Nobody!

Here's another question. Who do you sue if that bug in IE causes you to lose money? Nobody! Read the EULA!

Re:favorite quote

[sphealey]

Here's a question - who do I sue if that bug in Konqueror causes me to lose money? Nobody! Microsoft is a corporation, they have to be sure whatever they fix doesn't create 14 other security holes or Joe Schmoe will sue their pants off and in turn piss off their shareholders.

Who do you sue if a bug in any software product by SuperMegaSoft causes you to lose money? I have been involved with software contracts large enough to bring even Microsoft to the negotiating table, and even though the software purchased under those contracts did have bugs that caused us to lose money, and even though we had pretty good lawyers, we didn't have a chance in the world of collecting a penny via lawsuits.

sPh

Re:favorite quote

[Ed Bugg]

Ummm I use crypto services outside of my browser all the time. My VPN client that I use to attatch to my company's network. I at times have a need to send encrypted/signed emails. My network uses Novell's NDS which heavily uses digital certs (hidden from the user) for authentication. My wife's computer is running WinXP and everytime it loads a driver it checks the digital signature on the driver.
I'm sure that others that use Windows more than I do can come up with other applications that use the crypto API.

Re:favorite quote

[proj_2501]

The term "operating system" often means more than "kernel". Library patches can be a real pain in the butt to apply if, especially if you've been distributing statically linked binaries!

Re:favorite quote

[Verizon Guy]

Yeah, just ask RMS... "The kernel is Linux, but the Operating System is GNU."

Re:favorite quote

[tswinzig]

You are looking at this from the perspective of a linux user. When someone says 'the OS' you think the kernel. But when Microsoft says 'the OS' they mean the kernel and the thousands of .dll's that work with the kernel. I'd be VERY SURPRISED if the crypto functionality they're talking about is actually in the kernel!

Re:favorite quote

[j7953]

Umm, even Microsoft doesn't implement all of the Windows API in the kernel. The cryptography services are a shared library, just like OpenSSL.

What goes around comes around...

[R2.0]

This is the result of "integrating" IE into the OS. Now when there is a "browser" sesecurity problem, it's really an OS problem.

Sorry MS - kill by integration, be killed by integration. It's a circle of life kinda thing...

Re:What goes around comes around...

[platypus]

Hmm,
actually the idea to put security sensitive piece of software in a library isn't bad.
While I have no idea how this specific case is handled in linux, it's clear that also in linux cryptographic libraries exist and are used throughout different apps.

>ls -1 /usr/lib /usr/lib/libssl.a /usr/lib/libssl.so.0 /usr/lib/libssl.so.0.9.4

see?

Re:What goes around comes around...

[OnyxRaven]

Blockquoth platypus:

actually the idea to put security sensitive piece of software in a library isn't bad.
While I have no idea how this specific case is handled in linux, it's clear that also in linux cryptographic libraries exist and are used throughout different apps.

Exactly right and having the crypto in a library every can get at is a good thing. What you missed was that this windows problem isnt in the security library it should have been in.

"Company officials added that the flaw isn't in Microsoft's CryptoAPI application program interface (CAPI) either, which would have left a number of applications and Windows services vulnerable, not just Internet Explorer."

So they screwed up and didnt include this code for verifying trust signatures in their API, its somewhere in the OS.

And although knowing MS's previous security problems, its highly unlikely that this a problem in the kernel, since it affects NT based as well as 9x based systems.

Re:What goes around comes around...

[Verizon Guy]

Before everyone goes berzerk over "Microsoft the Evil Integrator!", I'm gonna take a wild stab at it and say the problem lies somewhere in here:

C:\WINNT\system32>dir crypt*.*
Volume in drive C is Local Disk
Volume Serial Number is 46D4-73A2

Directory of C:\WINNT\system32

08/23/2001 07:00 AM 554,496 crypt32.dll
08/23/2001 07:00 AM 70,144 cryptdlg.dll
08/23/2001 07:00 AM 29,184 cryptdll.dll
08/23/2001 07:00 AM 48,640 cryptext.dll
08/23/2001 07:00 AM 53,248 cryptnet.dll
08/23/2001 07:00 AM 51,200 cryptsvc.dll
08/23/2001 07:00 AM 470,016 cryptui.dll
7 File(s) 1,276,928 bytes
0 Dir(s) 19,188,736,000 bytes free

Quick fix

[Subcarrier]

You can disable SSL in the advanced options menu. ;-)

Long-term fix

[Damek]

Use a different web browser.

(or better yet, a different OS altogether...) ;-)

It doesn't make too much sense

[thelinuxking]

The article says: "SSL flaw doesn't affect any other application outside Internet Explorer and that it's a client-side issue only" But if it only affects IE, and not programs such as netscape (which also of course runs on windows), then technically it IS a problem with IE!

Uh-oh

[buzzdecafe]

Here's a golden opportunity for MS to ramrod another "We can root your machine" EULA down the throats of desperate Windows Victims.

Oh good, it's not an IE bug

[freerangegeek]

We only wrote bad code that made it through QA for 5 different versions of the OS dating back to the mid 90s. Of course, with Palladium, our new secure platform, things like this will never happen. Good thing we got that patch out quick!

(Oh wait, that was the Konqueror people!)

We'll I'm sure with our new secure computing focus it will be out any time now. Please don't stop doing ecommerce, just because all your personal data can be hacked, just use Passport.

(Oh wait, that happens with Passport too!)

Ummmm...

Yet again...

[estoll]

I am so shocked to hear Microsoft didn't follow the standards when implementing SSL. I wonder what other technologies they have failed to implement according to the standards everyone else follows?

Re:Yet again...

[Scutter]

I am so shocked to hear Microsoft didn't follow the standards when implementing SSL.

Neither did Konqueror. Blame where blame belongs, please. It's trendy to just blame everything on the Big Evil Empire, but let's not forget they aren't the only ones who have bugs.

Re:Yet again...

[ergo98]

Sweet time? Indeed, saying that the Konquerer team fixed it in 90 minutes makes them sound very irresponsible, not proactive : Every change like that can have hundreds of ramifications, and I assure you that there is a programmer at Microsoft who could point to a particular segment of code and say "There, we just need to change that line right there". But after several high profile incidents where someone did a change and it broke a dozen large applications, they seem to be a lot more weary about that nowadays. Working in software development, I've seen many situations in large systems where someone wanted to rush out an incompletely thought out feature or fix and the net result was disaster.

Re:Yet again...

[estoll]

Monopolistic is the key in your reply. It is easy to blame the big guy when they are screwing you.

We really depend on the bugs

[tshoppa]

Seeing continued OS-level design flaws in Microsoft products is, to me, reassuring. When MS goes ahead with Palladium I'm now quite confident that it will be riddled with fundamental design flaws that will make its "security" (read: capitalist totalitarianism rule over the masses) a joke.

90min to the fix, but how long to the masses?

[lalleglad]

In order to make sure we compare apples to apples and oranges to oranges, I suppose it would be fair to ask the question of when the Konqueror fix will be available to the normal and possibly rather non-sophisticated public consumer crowd?

I mean, when the fix becomes ready from MS (weeks or months, but it will) it will be applicable to most users of Windows, but the current fix for Konqueror after 90min weren't immediatly ready for the masses.

So, when will it?

Bug is in inet.dll

[sneakerfish]

MS TCP/IP stack is in inet.dll. That is probably where the bug is.

I was a beta tester for IE4 (so flame me, OK) and I found a bug in the HTTP1.1 keep-alive implementation. They never saw it because they tested only against IIS and I tested against Apache which implemented it correctly of course.

They didn't want to fix it until I explained that %60 (at the time) of the web runs on Apache servers.

In fact the MS product manager wanted me to call "the Apache company and have them fix Apache." Duh. Me- "There is nobody to call sir, and the problem is YOUR problem and not theirs."

They delayed IE4 for two weeks after it had gone gold to fix it. So don't flame me.

Anyway, that bug was in inet.dll, and I bet this one is too.

Re:Bug is in inet.dll

[platypus]

IE4 was so uncompliant on a deeper level, it wasn't funny.
There was a bug with packet fragmentation and redirects that caused internet explorer to display a blank page which said "Object moved, object can be found _here_.", where _here_ was a link to the target of the redirect.
Funnily, their own proxy software tended to cause fragmentation of the redirect packet quite often.

What I didn't understand was how they were capable to produce this bug, this completely negates everything I know about seperating the different layers of transport.

Re:Bug is in inet.dll

[shyster]

MS TCP/IP stack is in inet.dll. That is probably where the bug is.

Yeah, I'm sure the code for checking the heirarchy of SSL certificates is in the TCP/IP stack .dll.

Maybe peer reviewed code isn't really that great of an idea after all....

News

[Citizen of Earth]

Windows 98, Me, NT4, 2000 and XP SSL Flawed

Isn't this supposed to be " News For Nerds"?

things i dont get

[jeffy124]

i saw the article earlier today. there are some things I just do not understand here. first some facts:

• The bug is in the OS crypto services
  
• It's NOT MS's crypto api
  
• Only IE is affected.

Time for rhetorical questions:

Anybody else not see the lack of logic here? MS has two crypto implementations? One for the OS, one for the API? Why the redundancy? Why cant the OS use the API? Or conversely, why is the API necessary when there's the services are in the OS?

How in the world is IE the only app affected? It seems more to logical to assume that any app using this crypto services are also vulnerable.

I'll tell you why

[tunabomber]

Anybody else not see the lack of logic here? MS has two crypto implementations? One for the OS, one for the API? Why the redundancy?

The logic is so obviously simple:

increased redundancy == increased failsafety

So, if one of the crypto API's has a security hole, the OS can rely on the backup API, just like how a bike with one flat tire can be ridden home on the remaining good tire.

I tell you, those MS guys really got some effective circumetry in their noggins!

Re:things i dont get

[J. J. Ramsey]

"Anybody else not see the lack of logic here? MS has two crypto implementations? One for the OS, one for the API?"

Um, maybe one crypto service is for SSL, while the other is for, oh, maybe encrypting files?

There are so many good reasons to bash MS, why invent a bad one?

Let's be fair here

[IamTheRealMike]

Now I'm a Linux user and lover, as anybody who reads my past comments can discover. But let's be fair to Microsoft here - all this talk is of how fast KDE (actually Waldo Bastion) patched the bug, as if this makes them superior to MS.

You know what? I bet the 'soft could do this too. I mean have a guy, or team of guys available 24/7 to patch bugs. And you know what else? They'd still get flack for it, as Microsoft don't release patches straight away - for better or for worse, they do actually test them first (usually), make sure they don't kill wierd and exotic installs etc. I know they've released dodgy patches, but my point is that Microsoft isn't an overnight operation.

And more to the point, how does this patch get to people? Via autoupdate of course. The patch may have been written in 40 minutes, but it's still not available on SuSE auto update (as far as I can tell) despite the fact that Waldo works for SuSE! We really need to stop patting ourselves on the back simply because we can see the progress of the patch and Microsofters can't, otherwise this bullheaded arrogance WILL bite us on the ass.

Re:Let's be fair here

[FreeLinux]

You do have some valid points that should be addressed and probably will be over time. But, lest we forget, this bug was reported to Microsoft a very long time ago. Furthermore, MS has not been trying to fix the bug. Instead they chose to try to place the blame on Verisign.

Regardless, of whether Verisign should shoulder some of the blame or not, Microsoft simply dismissed a potentially serious problem. A week later, we find out that, not only is it Microsoft's problem, but it is in the OS itself not just the browser like we had thought. Conversly, KDE was able to identify the problem and produce a fix in 90 minutes.

Now, to your point about the availability of the patch to everyone, as I said you have point. But, if you check out KDE's site you will find that they clearly state that they do NOT distribute binaries. KDE distributes source code only and that patched source code is, and has been, available. KDE leaves binary distribution up to the distros to handle. So, Suse and Red Hat et al need to step it up a bit but, KDE did a great job!

Re:Let's be fair here

[tshak]

But, lest we forget, this bug was reported to Microsoft a very long time ago. Furthermore, MS has not been trying to fix the bug. Instead they chose to try to place the blame on Verisign.

Sometimes it is better to stick with the facts - even on Slashdot. Microsoft is A) working on a patch and B) claims to have not been alerted until it was publicly released. Here's some facts from MS's website:

Despite the many challenges associated with exploiting the flaw, there is indeed a flaw here and Microsoft is developing a patch that will eliminate it. ...
However, the report, which neglected to discuss any of the challenges associated with actually exploiting the vulnerability, was made public without any advance warning to Microsoft. Responsible security researchers have the safety of users in mind and work with vendors to ensure that the information published about potential vulnerabilities is balanced and, above all, correct.

Reference: http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/news/IARWSV.asp [microsoft.com]

Let's be even fairer...

[2short]

And note that I got the patch from windows update this morning. Total effort required by me: one mouse click.

Wait! what am I saying! this is slashdot, quick, ignore the facts:
"Micro$oft will probably patch this in a year, and then no one will get it cuz it requires 34 reboots to install"

90 Minutes for Konqueror fix.

[FreeLinux]

90 minutes????? What are the KDE boys doing, sleeping???

This is just unacceptable. I cannot believe and refuse to accept that it could take 90 minutes to get a major security fix out for a browser. This is completely unacceptable. It's no wonder everyone uses IE.

I guess the Microsofties were right after all. Support for open source software is nearly impossible to find.

-- Before you post, are you sure you got it?

Well, DUH.

[Spencerian]

I've already gushed about this gem o' news already [slashdot.org], concerning MS's piss-poor plan to introduce better security in their OS's via Palladium...

Trustworthy computing as its finest...

[lysurgon]

...indeed.

Thank's for those memos, Bill.

Hmmm

[Patik]

The article mentions that Konqueror was patched against the same bug in 90 minutes.

Note that this doesn't mean the bug was only there for 90 minutes, it was there for [months, years, I don't know]. Why didn't Konqueror take the initiative to fix this before instead of waiting until it was published? Sounds like they had the fix all along and were just waiting for the announcement so they could look good by fixing it so quickly.

(I thought the Browser was claimed to BE the OS!)

[Jeremiah Cornelius]

Client-side issue is the BIGGEST - most intractable problem. Culp said this to minimize the issue. He only reassures large commercial bodies of their liability,This does not minimize anything.

Dial-up users with ignorance of patch/upgrade will never be able to trust on-line transactions. This is the vast majority of users, and the problem is going to haunt individuals for 2+ years.

On an OS Providing Cryptographic service

[dh003i]

Microsoft officials said it makes sense for the operating system to provide cryptographic services to any application that needs it, instead of each application having to include its own cryptographic technology

Yes, indeed, it does make sense for the OS to provide such a service to any program that wants to use it, so long as that's a GOOD service.

In general, it makes sense to provide everything from outside the program, and just have the program call on outside services. However, that means you need to make the outside services good, and it means that those writing programs don't just string together a bunch of requests (i.e., draw this, check that calls) but also work on looking for fixes to the common outside service, which would be shared by many programs.

In other words, this approach only makes sense when the outside services are OSS / FS / public domain, which means that developers of programs can check their integrity and submit improvements. Otherwise, its just a big black hole for developers: should I trust this cryptographic routine, or shouldn't I? One never knows with proprietary routines. One can check, and improve such routines provided OSS / FS.

MS's master business plan

[dh003i]

Make products buggy as hell, then get people to upgrade and pay them for it by releasing new versions which have fixed the old bugs, but introduced new bugs. Repeat ad infinetum.

In parallel, also make sure to develop file formats and "standards" which aren't backwards compatable and don't work with any other OS', so as to lock people into MS products and force costly upgrades.

Bwuhahahaha.

Microsoft, Libraries and DLL

[topham]

Why is it, every 6 months or so, I get into an argument with somebody over the fact Microsoft doesn't seem to have a clue what DLLs are for?

I have people try to convince me that the integration of Internet Explorer into the Operating System is a good thing.

Where the hell do these people get their training? Microsoft has a tendancy to put function calls where they are convenient for the programmer at hand (not necessarily any future programmers mine you), not in the most appropriate DLL. This isn't unusual, it happens. But why the hell do people justify it??

Why the hell am I using a Web Browser (something whos base design is to browse web pages!!) to manage files on a local computer? The old Windows Explorer worked better and had a more appropriate (although similar) interface.

And then, when I chalenge them on this they always retort: Can you write an OS?

Damnit, yes I can. I don't have the time to write one, but I -could- write one.

Even if I couldn't, Microsoft is very much an example of bad design in general. (They have some well desgiend aspects to a lot of programs too. But Clippy isn't one of those!)

The real question is...

[dubiousmike]

Will this affect my ability to surf pr0n?

The most important thing

[coyote-san]

The most important thing in this story - and why the KDE fans should shut up and hide in a corner - is not the relative time to patch this mindnumblingly stupid bug, but the fact that both Microsoft and KDE made that mindnumbingly stupid mistake in the first place.

I've been auditing some of the SSL code in various applications, and sending in patches where the original submitter thought that SSL "was just like" sockets and didn't bother to do things like checking certificate chains or setting up support for perfect forward secrecy. In some cases the "SSL" support was really just SSL-tunnels in disguise and there was a bit of resistence to changes that would force the secadmin to set up true certificates for server and possibly clients. But most accepted the need, when I pointed out that if you really need to know the server (or client!) that you're talking to you must fully check your certs.

For instance, if your database is used to store information about ongoing criminal investigations, you do not want the bad guys to be able to masquerade as your trusted database. You want certs on the server, you want certs on the client (to keep the bad guys from connecting and adding "exculpatory" evidence to their own files), and you want to validate all of these certs.

It's one thing for a database or NNTP server to have a broken SSL implementation. After all, we don't, yet, expect them to have SSL so the people who need to use it may well check the source for themselves. But there's absolutely no excuse for a web browser to fail to check the path. If there's any question whatsoever, pop up a warning and let the user decide whether "Joe Smith" can be trusted to sign Microsoft's security web site cert.

(* With real SSL tunnels you can still require valid host and user keys all around. With these broken applications, you can't.)

Shared code ok - but what EULA?

[Antity]

From the article:

Microsoft officials said it makes sense for the operating system to provide cryptographic services to any application that needs it, instead of each application having to include its own cryptographic technology.

They're perfectly right. Everybody can have a bug like this. But there are two problems that puzzle me:

1. When will the patches for the OSes be available?
2. And, the worse one: Will the patches for this really ugly security leak will also come with Microsoft's new EULA that gives them access to one's computer?

I really fear the time where users have to choose to either install a patch so fix a severe security hole and sell their (OS and computer data) souls to somebody else or just not fix their OS at all and be open to these man-in-the-middle attacks. This could become a very new quality of unsecured machines from a security point on the 'net: Users that don't want to install patches because they don't want Microsoft to own their machines - and trade this with security. (I can fully understand this.)

With Open Source OSes, if the vendor won't fix a bug like this, somebody else would (maybe even you). With Windows, you have to rely on Microsoft even recognizing something as a bug. And if they do, there's nothing you can do but wait.

Yes, I know, we all know this. But this problem hasn't gone away yet.

In defense of microsoft

[cp5i6]

How many people out there are REAL Windows Admins? Seriously? I bet not that many are true windows admins. Using windows does not qualify you as an admin. I'll admit I'm very weak on my nix admin but that's because I don't bother learning about it. In my mind Windows 2k can be just as good an OS. I bet many of you don't know that Microsoft's knowledge base acutally keeps track of all it's bugs and patches for them before they stick it on Windows Update for the rest of the masses. I bet many of you don't know that microsoft has a tool called hfnetchk ... what does it do?.. It'll download the LATEST patches that microsoft has available for you to use. It'll check your system to see what patches are installed and what aren't and give you a report telling you which article # in MS knowledge base you can find the patch for you problem. More tools you want?... How about Qchain... (which i know many of you don't know about either) that lets the user install multiple patches WITHOUT rebooting your system multiple times. For IIS Windows has IISlockd .. which many wanna-be admins didn't bother finding out during the time when nimda worms were going crazy. And the list goes on I can easily list pages worth of other tools that windows has that most people don't know about because they're ignorant. If anything I'd say windows has done a wonderful job by making people lazy. But let's take a step back. I bet many of you are saying pfft the Nix machines have this and that tool. Think about that for a moment.. why would a multibillion dollar corporation, who have a million times more resources then the average linux programmer, not bother to make a similar tool for windows if it's so useful? Kinda defies logic doesn't it especially since nowadays with IBM's backing of linux MS needs to compete performance and feature wise even more (or are you going to tell me that MS has a stranglehold on IBM?). So before anyone else goes on with the typical. . "wat you expect form MS" read up about what MS really has and acutally maintain an intellectual conversation

What's the problem?

[Anonymous Coward]

If you bothered to read Bill Gate's .plan, you would know that he eventually will own everything.

So, what's he afraid of? Stealing from himself?

Object Moved

[Verizon Guy]

The object can be found here [slashdot.org].

I liked this article under its former name, "IE and Konqueror Bug Makes SSL Insecure"

And to add to the irony, posting a Microsoft-bashing article placed against a giant square ad that says "Microsoft Visual Studio.NET - Try it Now! Get your Trial DVD today!!" is just ignorant.

Re:Not a big deal!

[Skyshadow]

Yeah, along with whoever discovered and reported the problem. Now that's scary.

Re:Not a big deal!

[Wrexen]

Can we stop with the "Foo blah blah DMCA foo!" jokes already? The first 600 or so were funny (ok maybe not), but it's getting old. Especially when the subject matter has nothing to do with copy control circumvention or the ??AA businesses

Re:Not a big deal!

[Otter]

1) Make contrived, stupid DMCA jokes.
2) ???
3) Profit

All your base are belong to us!

Minor problem

[Florian Weimer]

It's sad to say, but given all those unpatched bugs in Internet Explorer [pivx.com], this flaw is a minor issue. Why bother with DNS Spoofing etc., when you just can install and start any executable you want on your victim's computer?

It's funny that Microsoft always comments publicly on the minor bugs, but ignores the serious ones, just until they release a patch.

Re:Konqueror

[captain_craptacular]

Doesn't matter if everyone is qualified. If they aren't their suggestions will be ignored by those who are, who also happen to be those who integrate the suggestions/new code.

Re:this is good news

[Salsaman]

Just use mozilla or kmeleon. They are not affected by this bug.

Re:this is good news

[JabberWokky]

http://sf.net/projects/kde-cygwin/ [sf.net]

Although, as others have pointed out, Konqueror is really a *nix app (not just a Linux app or even an X app, as commonly assumed). You'd be best off just grabbing a copy of Mozilla if you're really worried.

--
Evan (no reference, not even to a certain Toho Industries character)

Re:thought SSL wasn't secure anyway

[Jeremiah Cornelius]

Dsniff was used as part of the practical exploit here.

The BugTraq [securityfocus.com] post describes the nature of a MOTM exploit using this vulnerability.

A BugTraq reader [securityfocus.com] was able to successfully demonstrate this [ipsec.pl] using dsniff and OpenSSL as his tool kit. Screenshots [ipsec.pl] on his site illustrate this, with his own bank account!

Re: integration vs modularity

[Antity]

modularity vs. integration. Now of course it's very nice to offer lots of services built into the operating system, because it means that your developers have to do less work, their apps are smaller, and their time-to-market is significantly shorter, if they can merely use one of your API calls.

Yeah, but it makes it harder to write portable applications.

Surprise, surprise...

(In this case, the article mentions that Internet Explorer is nearly the only application to use these OS functions at all. But the concept is clear - Put more convenient functions into an OS so that vendors won't write them on their own. The resulting product is then bound to this single OS - if the vendor doesn't want to pay more to his programmers to re-program all this code. Most won't, after they've start selling the product. And: This will artifically make porting a product to another OS seem more expensive.)

Re:Windows update was available on 8/16 at 9am EST

[PsychoSpunk]

Yeah, it was for a problem in the Network Manager. Of course, since this was the big 'sploit of the week, you and 2short seem to have mistaken the patch for something that it's not. This morning's patch description [microsoft.com]