> -----Original Message----- > From: Nathan Wallwork [mailto:owen@pungent.org] > Sent: Tuesday, September 09, 2003 1:18 PM > To: Drew Copley > Cc: ADBecker@chmortgage.com; 'GreyMagic Software'; 'Bugtraq'; > full-disclosure@lists.netsys.com; http-equiv@excite.com; > 'NTBugtraq'; 'Microsoft Security Response Center'; > vulnwatch@vulnwatch.org > Subject: RE: BAD NEWS: Microsoft Security Bulletin MS03-032 > > > On Mon, 8 Sep 2003, Drew Copley wrote: > > The only sure way to detect this, I already wrote about [to > Bugtraq]. > > That is by setting a firewall rule which blocks the > dangerous mimetype > > string > > [Content-Type: application/hta]. Everything else in the > exploit can change. > > Just so we are clear, the firewall wouldn't tbe he right > place to catch > this because that string could be split by packet > fragmentation, so you'd > need to look for it at an application level, after the data stream > has been reassembled. Yes, I mean "IPS rule" - "firewall rule" is a bit inaccurate- just a traditional term. Any IPS that does not handle fragmentation, though, has some serious problems. > > Of course, if anyone thinks it is easier to protect their > browser with a > proxy than fix the browser they've got other issues. Yes, exactly. There have been a lot of inaccuracies about this bug. What should be absolutely clear to everyone is that it is a very serious security hole and users should put in a fix on their own system and the systems which they are responsible for. Any kind of "well, my AV protects me from this" is absolutely inexcusable. As Nick Fitzgerald pointed out, I don't even think there is AV which looks at server response codes. This means there is absolutely no protection offered from these products. There is a near infinite number of ways someone could write exploit code doing the same thing for this bug. There is no way AV can protect against the next virus. They don't know it exists. How can they protect against it? Beyond this, if you actually tell people you depend on this kind of solution... You are telling everyone you are vulnerable. You are telling the leagues of the security world "I have this vulnerability on my system, my browser is an open door". People, think. We are not lying and we are not incorrect about this. Those that are not ignorant of this problem have a conscience obligation to secure the systems they are in charge of.
