Microsoft Warns of Zero-Day Under Attack
securityweek.com
securityweek.com
http://secunia.com/advisories/search/?adv_search=1&s=1&searc...
This is a bug in the parser for TIFF files that allows for arbitrary code execution. MS06-001 was based on removing a "feature" of the WMF format (SETABORTPROC) that allowed for arbitrary code execution for legitimate, albeit antiquated, reasons.
TIFF is an Adobe spec, and we all know how great Adobe is at security ...
Actually, TIFF predates Adobe involvement. It was inherited by Adobe when it bought Aldus. The file format was designed in 1986 and last revised in 1992. That's 21 years without an update -- an eternity in the computer world.
Ironically, TIFF used to be known as "Aldus-Microsoft TIFF." Aldus designed the format, and Microsoft provided the marketing muscle to establish it as a de facto standard.
http://technet.microsoft.com/en-us/security/advisory/2896666
It's a GDI component reading TIFF files exploit, it is being used in the wild right now, and the vuln won't be patched until Dec.
So, I guess the question is, how paranoid should I be? MSE, malwarebytes, and GMER all show nothing (as one would expect if it was a zero-day), but going full scorched earth and doing a system wipe on both my drives would be a huge inconvenience right now. I feel like wiping the whole damn thing on principle, but you can't wipe everything every single time you get spooked.
PS: I did some testing, and it doesn't appear that firefox can display a tif file - it prompts for an external program (photoshop, in my case) and there's no application defined for the content type tiff in the firefox preferences.
Opinions appreciated. Thanks in advance.
There is much lower-hanging fruit for them, and your system does not look like their target "difficulty level".
That said with a level of paranoia like yours (that I'm not critiquing) I'm not really sure Windows is the best choice first of all.
Security advisory 2896666 covers only Windows Vista and Server 2008. Since you were browsing on Windows 7, you are not affected.
It further states that you can be attacked if you open an email or file. You say that you did not open any Word documents. That's a start. But did you open any files at all in Microsoft Office? Outlook emails, Excel spreadsheets, Powerpoint presentations, etc.? If not, then you are not affected.
At least, you're not affected by the current version of the attack.
Supporting evidence for this interpretation: http://blogs.technet.com/b/msrc/archive/2013/11/05/microsoft... which includes "We are aware of targeted attacks, largely in the Middle East and South Asia."
That explains why Office 2013 isn't vulnerable. That, plus the fact that it uses DirectWrite instead of GDI.
But then, why is Office 2010 vulnerable? It was released after Windows 7, which isn't vulnerable. Did it ship outdated libraries?
The following Microsoft products are vulnerable:
Windows operating system: Windows Vista SP 2, Windows Vista x64 Edition SP 2, Windows Server 2008 for 32-bit Systems SP 2, Windows Server 2008 for x64-based Systems SP 2, Windows Server 2008 for Itanium-based Systems SP 2, Windows Server 2008 for 32-bit Systems SP 2 (Server Core installation), Windows Server 2008 for x64-based Systems SP 2 (Server Core installation)
Microsoft Office suites and software: Microsoft Office 2003 SP 3, Microsoft Office 2007 SP 3, Microsoft Office 2010 SP 1 (32-bit editions), Microsoft Office 2010 SP 2 (32-bit editions), Microsoft Office 2010 SP 1 (64-bit editions), Microsoft Office 2010 SP 2 (64-bit editions), Microsoft Office Compatibility Pack SP 3
Microsoft communication platforms and software: Microsoft Lync 2010 (32-bit), Microsoft Lync 2010 (64-bit), Microsoft Lync 2010 Attendee, Microsoft Lync 2013 (32-bit), Microsoft Lync Basic 2013 (32-bit), Microsoft Lync 2013 (64-bit), Microsoft Lync Basic 2013 (64-bit)