Manage Learn to apply best practices and optimize your operations.

ANI cursor flaw offers lessons in Vista security

Microsoft's recent animated cursor (ANI) vulnerability, as well as the software giant's response to it, caused some in the security industry to question the software giant's strategy. But there are two sides to every story. In this tip, Michael Cobb explains why the ANI flaw is a more complex problem than vulnerabilities of the past, and what security pros can learn from it.

Microsoft's recent Windows animated cursor (ANI) vulnerability has elicited a strong reaction from the press, the security industry and Microsoft itself. More specifically, the flaw has caused many to question the security credentials of the new Windows Vista operating system and criticize Microsoft's handling of the patch process. The ANI flaw highlighted how challenging it can be for Microsoft to manage software security, despite its progress in recent years.

The ANI flaw -- officially known in the Common Vulnerabilities and Exposures dictionary as the "Windows Animated Cursor Remote Code Execution Vulnerability" (CVE-2007-0038) -- is caused by a buffer overflow error in a system file called user32.dll. It enables attackers to take advantage of the way that Windows handles Resource Interchange File Format (RIFF)-based animated cursors and icon files (.ani, .cur, and .ico). These files are used to replace the default cursor image with cartoon-like alternatives. By deploying a malformed version of one of these files, an attacker can cause a stack-based buffer overflow, leading to memory corruption. After the memory is corrupted, the attacker can execute arbitrary code and take control of the victim's computer. Attackers also have the option to force persistent reboots and cause a denial of service.

For more information:

Even though there are other Windows vulnerabilities to worry about, the ANI flaw is still on some bloggers' minds. 

Should you wait for Windows Vista SP1 before making an operating system upgrade? Michael Cobb explains.

The browser has become a favorite target for attackers. Find out whether our Web browser security expectations are too high. 
So why the brouhaha? Well, the flaw affects several operating systems, from Windows 2000 all the way up through Vista. Microsoft touts Vista as the most secure version of Windows yet, and that the ANI flaw is an operating system-level vulnerability is a tough blow for the software giant. This means that any application relying on the operating system to handle animated cursor files could be an attack vector. Although Internet Explorer has been the main target, other browsers such as Firefox are also vulnerable, as are some email clients. The vulnerability is especially dangerous because the exploit occurs silently and victims can be attacked merely by visiting a Web page or opening an email designed to take advantage of the flaw.

Microsoft first learned of the ANI cursor problem from a private security research firm in December 2006, and many commentators and industry experts have criticized how long it took the company to release the patch. Before criticizing the software giant, however, it's important to realize that patch engineering is a long, complex process. During the second half of 2006, it took Microsoft an average of 21 days to address a publicly disclosed vulnerability and release a patch, according to Symantec Corp.

This ANI flaw was not made public until March 28, and the appropriate fix was released on April 3rd, six days later. The patch was put out a week ahead of Microsoft's monthly Patch Tuesday software update. The security update didn't just patch the animated cursor vulnerability, either; it addressed seven other problems, ranging from a WMF denial-of-service bug to three elevation-of-privilege flaws. Microsoft's response demonstrates the efforts it will go to once it feels its customers are in danger, which it clearly did once news of the flaw was made public.

Perhaps the bigger issue is whether the ANI flaw is just one of many security shortcomings in the OS. Regardless, Vista isn't doomed, and Microsoft's Security Development Lifecycle hasn't failed. Vista will prove to be more secure than its predecessors, and this single vulnerability hasn't halted Microsoft's drive for better security.

As this is such a dangerous flaw, systems that haven't yet been patched should be shored up as soon as possible. The ANI patch does have some compatibility issues with systems running Realtek's audio software, but there are workarounds posted on Microsoft's site. I would also recommend some security awareness briefings or reminders about safe Internet usage. Users should be reminded not to open emails from unknown senders or follow links to sites embedded in emails or Web advertisements. These topics should of course be covered in your acceptable Internet and email usage policies.

About the author:
Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for several Security Schools and, as a site expert, answers user questions on application security and platform security.

This was last published in May 2007

Dig Deeper on Microsoft Patch Tuesday and patch management

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.