Microsoft's recent Windows animated cursor (ANI) vulnerability has elicited a strong reaction from the press, the security industry and Microsoft itself. More specifically, the flaw has caused many to question the security credentials of the new Windows Vista operating system and criticize Microsoft's handling of the patch process. The ANI flaw highlighted how challenging it can be for Microsoft to manage software security, despite its progress in recent years.
The ANI flaw -- officially known in the Common Vulnerabilities and Exposures dictionary as the "Windows Animated Cursor Remote Code Execution Vulnerability" (CVE-2007-0038) -- is caused by a buffer overflow error in a system file called user32.dll. It enables attackers to take advantage of the way that Windows handles Resource Interchange File Format (RIFF)-based animated cursors and icon files (.ani, .cur, and .ico). These files are used to replace the default cursor image with cartoon-like alternatives. By deploying a malformed version of one of these files, an attacker can cause a stack-based buffer overflow, leading to memory corruption. After the memory is corrupted, the attacker can execute arbitrary code and take control of the victim's computer. Attackers also have the option to force persistent reboots and cause a denial of service.
So why the brouhaha? Well, the flaw affects several operating systems, from Windows 2000 all the way up through Vista. Microsoft touts Vista as the most secure version of Windows yet, and that the ANI flaw is an operating system-level vulnerability is a tough blow for the software giant. This means that any application relying on the operating system to handle animated cursor files could be an attack vector. Although Internet Explorer has been the main target, other browsers such as Firefox are also vulnerable, as are some email clients. The vulnerability is especially dangerous because the exploit occurs silently and victims can be attacked merely by visiting a Web page or opening an email designed to take advantage of the flaw.
Microsoft first learned of the ANI cursor problem from a private security research firm in December 2006, and many commentators and industry experts have criticized how long it took the company to release the patch. Before criticizing the software giant, however, it's important to realize that patch engineering is a long, complex process. During the second half of 2006, it took Microsoft an average of 21 days to address a publicly disclosed vulnerability and release a patch, according to Symantec Corp.
This ANI flaw was not made public until March 28, and the appropriate fix was released on April 3rd, six days later. The patch was put out a week ahead of Microsoft's monthly Patch Tuesday software update. The security update didn't just patch the animated cursor vulnerability, either; it addressed seven other problems, ranging from a WMF denial-of-service bug to three elevation-of-privilege flaws. Microsoft's response demonstrates the efforts it will go to once it feels its customers are in danger, which it clearly did once news of the flaw was made public.
Perhaps the bigger issue is whether the ANI flaw is just one of many security shortcomings in the OS. Regardless, Vista isn't doomed, and Microsoft's Security Development Lifecycle hasn't failed. Vista will prove to be more secure than its predecessors, and this single vulnerability hasn't halted Microsoft's drive for better security.
As this is such a dangerous flaw, systems that haven't yet been patched should be shored up as soon as possible. The ANI patch does have some compatibility issues with systems running Realtek's audio software, but there are workarounds posted on Microsoft's site. I would also recommend some security awareness briefings or reminders about safe Internet usage. Users should be reminded not to open emails from unknown senders or follow links to sites embedded in emails or Web advertisements. These topics should of course be covered in your acceptable Internet and email usage policies.
About the author:
Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for several SearchSecurity.com Security Schools and, as a SearchSecurity.com site expert, answers user questions on application security and platform security.
