GRC | Security Now! Notes for Episode #58

Resource links for Security Now! Episode #58:

Two Serious New Windows Problems

Late Breaking News (9/26):

Official Microsoft VML Vulnerability
Patch Is Now Available

Windows Update is now carrying
Microsoft's official VML patch.
You should run Windows Update to obtain the patch, reboot your machine as Windows Update will require, then re-register the VGX.DLL file if you had previously unregistered it, since Windows Update does not automatically re-register the previously vulnerable DLL file. (See instructions for re-registering the previously vulnerable DLL below.)

You can then verify that your system is no longer vulnerable by displaying this benign VML vulnerability test page, which will use VML to display two red star filled rectangles:

http://www.isotf.org/zert/testvml.htm

NOTE: You MAY receive a false-positive warning from your Anti-Virus software when you display this page if it has been recently updated to detect exploits of the VML vulnerability. This is NORMAL, expected, and completely benign since the testing page must contain a version of the exploit in order to test whether your browser is susceptible.

If the DLL is NOT re-registered, you will see a blank space instead of the red-filled rectangles. If the DLL is still vulnerable (the patch didn't "take"), your browser will crash harmlessly.

UPDATE: A Third-Party Non-Vendor Patch
and Benign Vulnerability Test is Available

A reputable group known as "ZERT" — Zeroday Emergency Response Team — has produced a very nice GUI and Command Line patch utility which repairs the VML buffer overrun design flaw in Microsoft's VGX.DLL file.

Since VML is very rarely used on the web, "unregistering" the vulnerable DLL to take it completely out of service is probably the more prudent countermeasure. But if you choose to unregister the DLL you will need to remember to re-register it later. And corporate users may wish to employ ZERT's CommandLine tool to patch all Windows systems network-wide. (Full source code is included to allow independent verification of the utility's operation.)

This ZERT page contains the latest information on this alternative:

http://isotf.org/zert/

Additionally, and either way, a simple and benign vulnerability test page is available from their download page. It will (a) crash your IE browser if your system is currently vulnerable, (b) display two red rectangles if your browser has VML enabled (registered) and safely patched, or (c) pop-up a dialog box informing you that your IE is immune to this vulnerability if VGX.DLL is unregistered and you have scripting enabled to allow the pop-up. (If scripting is disabled for untrusted sites you'll just get a blank page.)

See the details of this testing page here:

http://isotf.org/zert/download.htm

Note that using this patching solution will "re-register" the VGX.DLL file for use by your system. So if you want double protection you could patch the file then follow the instructions below to also unregister it (though doing either is also certainly sufficient).

Microsoft's VML Security Advisory — "Vulnerability in Vector Markup Language Could Allow Remote Code Execution." This advisory provides a general overview of the problem and, fortunately, also provides a robust interim work-around to disable Windows' and IE's VML parsing. This can and should be used until Microsoft has repaired the buffer overrun in the VGX.DLL VML parser that is being actively exploited on the Internet.
How to protect your system:
As detailed in Microsoft's VML security advisory (see link above), you can quickly, easily, and safely protect your system from possible VML exploitation by "unregistering" the defective DLL. The system will no longer be able to render web-based vector markup language graphics, but you won't notice any difference since few sites use VML for benign purposes.

Simply copy this command from this page (highlight the entire line then type Ctrl-C to Copy it into the clipboard), then open the "Run..." dialog by pressing your system's Start button and choosing "Run..." Press "Backspace" to remove anything that might already be in the "Open" field, then type "Ctrl-V" to paste the command into the field. Press "OK" to execute the command and you should receive a dialog confirming that the VGX.DLL file has been "unregistered" ...
```
regsvr32 -u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"
```
Please tell your family and friends and the word. Since this newly discovered Windows VML defect is being actively exploited by thousands of web sites to install malware, and since viewing malicious eMail with many versions of Outlook will also cause this to occur, EVERY Windows user is a potential victim. Please help people to protect themselves.
How to "re-register" the VGX.DLL:
Once Microsoft has repaired this defect, which should happen no later than the second Tuesday in October (Oct. 10th) — and after you have applied those October security updates — you should re-register the repaired VGX.DLL file by repeating the steps above, but using a command without the "-u" argument, as follows:
```
regsvr32 "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"
```
At that time, please also remind anyone you may have helped to protect themselves through un-registering the DLL to re-register it AFTER they have updated their system with the current October patches.
Windows 2000 Compressed File Corruption
. . . or as Microsoft's official update page is titled: "Compressed files that are larger than 4 kilobytes may be corrupted when you create or update the files." A serious "regression" error was introduced into last month's (August 2006) security patches for Windows 2000 systems. This error can cause corruption of NTFS-compressed files on systems that have had security update 920958 (MS06-049) applied.

If you are using Windows 2000 (any flavor) and keeping it current with monthly security patches, you should IMMEDIATELY apply this patch to cure the error that was introduced in August's security update:

Obtain the Windows2000-KB925308-x86-ENU.EXE package now.

And, again, please inform anyone you know, who is using Windows 2000, about this critical issue.