New IE6-SP1 vulnerability

[Guest wsxedcrfv]

http://www.microsoft.com/technet/security/...ory/979352.mspx

This is a *previously unknown* vulnerability that has been identified as being responsible for a massive, sophisticated attacks against Google and possibly other corporate networks inside and outside China.

Microsoft is saying only that IE 5.01 SP4 on Win-2K SP4 is not affected, but IE6-SP1 on 2K *is* affected (why no mention of IE 5.5?).

See also: http://blogs.technet.com/msrc/default.aspx

There is also another new critical vulnerability for Win-2K (Embedded OpenType Font Engine):

http://www.microsoft.com/technet/security/...n/ms10-001.mspx

Any idea if this extends to win-9x/me?

I've been looking for POC code to test, but can't find any. Milworm seems dead (no new code posted since last September?)

[cluberti]

Microsoft is saying only that IE 5.01 SP4 on Win-2K SP4 is not affected, but IE6-SP1 on 2K *is* affected (why no mention of IE 5.5?).

Because IE 5.5 hasn't been supported for years (support ended for IE5.5 on it's last supported platform, W2K SP3, on December 31, 2003). Microsoft only comments on supported configurations. I can't comment on the rest, although it's quite possible Win9x systems are vulnerable as the font engine didn't change much from Win95 - WinXP, and finally got an overhaul in Vista.

[Guest wsxedcrfv]

Microsoft is saying only that IE 5.01 SP4 on Win-2K SP4 is not affected, but IE6-SP1 on 2K *is* affected (why no mention of IE 5.5?).

Because IE 5.5 hasn't been supported for years (support ended for IE5.5 on it's last supported platform, W2K SP3, on December 31, 2003). Microsoft only comments on supported configurations.

But note that Microsoft *did* make specific mention of IE 5.01 in relation to Win-2K. If IE 5.01 is no longer supported (and I believe that it's not) then such a statement does not fit with Microsoft's support policy, and leaves the door open to the question -> why mention IE 5.01 and not IE 5.5?

[Steven W]

There's a download for Win 2K:

http://www.microsoft.com/downloads/details...;displaylang=en

I'm assuming the only file of interest to be extracted is fontsub.dll, version 5.0.2195.7348.

*** Please note: I'm not saying this is or is not compatible with win9X or ME***

Edited January 16, 2010 by Steven W

[cluberti]

But note that Microsoft *did* make specific mention of IE 5.01 in relation to Win-2K. If IE 5.01 is no longer supported (and I believe that it's not) then such a statement does not fit with Microsoft's support policy, and leaves the door open to the question -> why mention IE 5.01 and not IE 5.5?

IE 5.01 and IE6 SP1 are supported on W2K - IE 5.5 is not. Microsoft changed the IE support policy somewhat when XP was released - prior to Windows XP, Microsoft only supported the IE version that shipped directly with the OS at install (IE 5.0) and the last version available when the product went into extended support (IE6 SP1). The "middle" product (IE 5.5) was retired on 31 December 2005. Microsoft currently supports IE6, IE7, and IE8 on Windows XP systems even though IE7 is the "middle" product - IE8 released before XP went into extended support, and IE6 was the version that installed with XP, but Microsoft currently continues to support IE7 on XP. I don't know if that's going to be permanent or not until 2014 when XP EOLs (I hope not), but it might.

So, to recap, see here for a list of supported IE versions and the versions of Windows they're supported on. IE 5.01 and IE6 SP1 are supported on W2K SP4 until W2K EOLs on 13 July 2010, but IE 5.5 was retired on 31 December 2005.

[Prozactive]

There's a download for Win 2K:

http://www.microsoft.com/downloads/details...;displaylang=en

I'm assuming the only file of interest to be extracted is fontsub.dll, version 5.0.2195.7348.

*** Please note: I'm not saying this is or is not compatible with win9X or ME***

I believe it's t2embed.dll, version 5.00.2195.7348

[dencorso]

There's a download for Win 2K:

http://www.microsoft.com/downloads/details...;displaylang=en

I'm assuming the only file of interest to be extracted is fontsub.dll, version 5.0.2195.7348.

*** Please note: I'm not saying this is or is not compatible with win9X or ME***

No. Prozactive is right! You'll just need t2embed.dll, v. 5.0.2195.7348. Win 9x/ME don't use fontsub.dll.

I don't know either whether that file works in 9x/ME or not, but I almost bet it will.

So, let's stop discussing in circles and start testing it? What do you all say?

[MDGx]

Hi,

I've had this fix [older builds of t2embed.dll] at my site for years.

The last one was compiled by erpdude8 (Q961371), not long ago.

It does apply to all Win9x + ME OSes and to NT4, no matter the MS IE edition [4.x, 5.x or 6.0] installed.

This fix requires MS IE 5.5 or newer installed:

http://www.mdgx.com/toy.htm#IEX

Get IE 6.0 SP1 here:

http://www.mdgx.com/ietoy.htm#6S1

Get IE 5.5 SP2 here:

http://www.mdgx.com/ietoy.htm#IE55

Here's the new T2EMBED.DLL security fix from MS01-001 (Q972270)...

http://www.mdgx.com/upd98me.php#011610

Whenever you run the fix [on intended OSes], you''ll be greeted by this ReadMe:

Unofficial Windows 98/98 SP1/98 SE/NT4+SP6a/ME Embedded Web Fonts T2EMBED.DLL 5.00.2195.7348 Q972270 Security Vulnerability Fix

REQUIREMENTS:

* This Fix requires MS IE 5.5 SP2 or newer already installed:

http://www.mdgx.com/toy.htm#IEX

* Windows NT 4.0 requires Service Pack 6a (SP6a) already installed:

http://www.mdgx.com/wnt4.htm#SP6

Everything here applies only to English editions.

This fix/update is cumulative. This means it includes ALL BUG fixes from all previous official + unofficial patches/(hot)fixes/updates. Do NOT replace with ANY other older file version(s) UNLESS having problems with current file version(s).

This Fix replaced obsolete MS09-029 (Q961371) Security Vulnerability Fix.

NOTE:

Provided 'as is', without any warranties, expressed or implied.

Use at your own risk!

INSTALL:

This Fix copies T2EMBED.DLL 5.00.2195.7348 and backs up (renames) original T2EMBED.DLL as T2EMBED.ORI into:

- Windows 98/98 SP1/98 SE/ME: %windir%\SYSTEM [%windir% = usually C:\WINDOWS].

- Windows NT4+SP6a: %windir%\SYSTEM32 [%windir% = usually C:\WINNT].

UNINSTALL:

How to uninstall this Fix and restore original file:

First make sure all instances of Internet Explorer are closed.

Then: Start button -> Settings -> Control Panel -> Add/Remove Programs -> select "Unofficial Q972270 T2EMBED.DLL Security Vulnerability Fix" -> click Add/Remove button -> click OK button -> reboot if prompted.

MORE INFO:

- Microsoft Security Bulletin MS01-001:

http://www.microsoft.com/technet/security/...n/ms10-001.mspx

- MicroSoft Knowledge Base (MSKB) Article Q972270:

http://support.microsoft.com/?id=972270

WinME users can get it here:

http://www.mdgx.com/web.htm#MEU

Win98/98 SE users here:

http://www.mdgx.com/web.htm#9SU

WinNT4 users here:

http://www.mdgx.com/wnt4.htm#NT4

WinNT4 users are required to install SP6a first:

http://www.mdgx.com/wnt4.htm#SP6

HTH

[dencorso]

Way to go!!! Thanks! You do rock, MDGx!

[Prozactive]

Thanks MDGx! I knew about but failed to mention your earlier t2embed.dll EOT Font Engine updates. Thanks for updating your update so quickly. I was able to manually update t2embed.dll by extracting it from the recent Microsoft Win2000 KB972270 update and copying it into %windir%\System after renaming the existing outdated version.

[galahs]

So, if I have Internet Explorer 6 instaled, but don't use it to surf the internet. Am I still vunverable from this exploit?

[BenoitRen]

Possibly, yes, as IE's core gets embedded in applications.

[Steven W]

I assumed wrong, my bad. As for the other, likely more serious, problem there's no patch yet. Someone was asking for code. I found this:

http://blog.metasploit.com/2010/01/reprodu...ie-exploit.html

Not sure how useful it will be for 9x/ME.

[Steven W]

Possibly, yes, as IE's core gets embedded in applications.

Yeah, Microsoft's decision to tie IE to Windows had to be one of the worst decisions ever made. This exploit is just one in a long list of examples why.

[Andrew T.]

Good thing I don't have IE...