8 ms·

Fonts eat a bullet in Microsoft security patch

44 points by iProject 14y ago

datr 14y ago
Microsoft's security announcement here: http://technet.microsoft.com/en-us/security/bulletin/ms12-078 http://technet.microsoft.com/en-us/security/bulletin/ms12-07... The Chromium bug report where the issue was discovered: http://code.google.com/p/chromium/issues/detail?id=146254 http://code.google.com/p/chromium/issues/detail?id=146254
pilif 14y ago
> I have thousands of fonts and have yet to see (or hear) of one that would trigger the security problems supposedly resolved by this update. this is the complete backwards-thinking that causes people not to install security updates. Too bad it's repeated here in bold on a publication and subsequently even linked on HN. Of course none of the fonts you have installed is using the security flaw. But that newly created malicious font that is being used from that ad banner on that website you just visited is certainly going to use the security flaw to install additional malware on your system. This has nothing to do with the existing fonts you deliberately installed but everything with newly created fonts that you don't deliberately install. Another note: I really think MS should have fixed the vulnerability in their font parser instead of just disabling a whole class of fonts in a security update.
- zoop 14y ago
  Is it really backwards thinking when a security update inhibits your ability to get anything done?
- andybak 14y ago
  Do the cost/benefit analysis. "Real problem now that affects by income" vs "unknown future risk." You need to know the chance of a problem and the severity of that problem. My hunch is that in this case "Real problem now" is the worse option for a rational observer.
  - andybak 14y ago
    Ah. I have just noticed that the bug allows remote code execution from just visiting a malicious website. That does rather change the balance somewhat.
    - justinschuh 14y ago
      It's not just remote code execution; it's that this bug triggers in kernel font handling code. So, it bypasses application sandboxes and any other user space protections.
      - DannyBee 14y ago
        I think the best part of this is the phrase "kernel font handling code" Of all the things to put into kernel space ....
        codewright 14y ago
        >Of all the things to put into kernel space .... It's Windows man, this is an old story now.
        justinschuh 14y ago
        Yeah, the GDI is pretty horrible. But in Microsoft's defense, those decisions were made almost 20 years ago for NT4, when prevailing views on security and stability were very different from today. The post DX10 graphics pipeline doesn't do things like this, and is really quite sane and robust. Unfortunately, you need Vista+ for DX10, and even then you still get saddled with the local GDI attack surface.
- Dylan16807 14y ago
  Possible vulnerability is a reason to disable font loading from untrusted network locations. It is not an excuse to break font loading in local content-creation programs.
  - pilif 14y ago
    How would windows know whether that blob it just has been told to load as a font comes from an external machine or not? Disabling all font loading is, besides fixing the parser, the only sensible thing to do from a security standpoint. It is not however at all sensible from a user perspective. They really should have fixed their font parser (and moved it out of the kernel as a secondary goal)
    - Dylan16807 14y ago
      Patch IE, tell mozilla and google about the problem too. Activity that is local to a machine should never be impaired by security patches aimed at the network.
      - pilif 14y ago
        Yeah. This scales really well. Especially because there are no other browsers but from Mozilla and Google (Opera? Smaller ones?) Also, you'd have to tell all makers of email clients and every other network connected application to mark external data as such - how likely do you think this is going to be?
        Dylan16807 14y ago
        I'm just saying to treat it like webgl: a recent feature exposing un-hardened code to network assault that only allows recent/whitelisted drivers. It scales pretty well and puts the burden of network safety where it should be, on the application pulling in network data. If you blocked all potentially-weak code just because someone might feed in network data you'd end up with a brick.
        14y ago
- quotemstr 14y ago
  > MS should have fixed the vulnerability in their font parser In all likelihood, nobody understands how it works, and they're just afraid of touching the code and introducing a new vulnerability.
drzaiusapelord 14y ago
"eat a bullet?" What does that even mean? Come on, is it asking too much for even a semi-professional article here? The reg is a tabloid that's bascially blogspam. HN can do better.
- lambda 14y ago
  "Eat a bullet" is slang which means being shot. As in, the update kills certain fonts. It's also a pun, because fonts contain a character known as a bullet: "•". Yes, the Reg is an IT tabloid; they do an entertaining, sarcastic, and pun-filled take on IT news. I wouldn't call it blogspam in general; they do real reporting, and provide more than the usual blogspam "link, quote, and one sentence summary." In this particular case, the source they quoted probably would have been a better article to post, as it is longer and contains more information.

44 points by iProject 14y ago

datr 14y ago

Microsoft's security announcement here: http://technet.microsoft.com/en-us/security/bulletin/ms12-078 http://technet.microsoft.com/en-us/security/bulletin/ms12-07... The Chromium bug report where the issue was discovered: http://code.google.com/p/chromium/issues/detail?id=146254 http://code.google.com/p/chromium/issues/detail?id=146254

pilif 14y ago

> I have thousands of fonts and have yet to see (or hear) of one that would trigger the security problems supposedly resolved by this update. this is the complete backwards-thinking that causes people not to install security updates. Too bad it's repeated here in bold on a publication and subsequently even linked on HN. Of course none of the fonts you have installed is using the security flaw. But that newly created malicious font that is being used from that ad banner on that website you just visited is certainly going to use the security flaw to install additional malware on your system. This has nothing to do with the existing fonts you deliberately installed but everything with newly created fonts that you don't deliberately install. Another note: I really think MS should have fixed the vulnerability in their font parser instead of just disabling a whole class of fonts in a security update.

zoop 14y ago
Is it really backwards thinking when a security update inhibits your ability to get anything done?
andybak 14y ago
Do the cost/benefit analysis. "Real problem now that affects by income" vs "unknown future risk." You need to know the chance of a problem and the severity of that problem. My hunch is that in this case "Real problem now" is the worse option for a rational observer.
- andybak 14y ago
  Ah. I have just noticed that the bug allows remote code execution from just visiting a malicious website. That does rather change the balance somewhat.
  - justinschuh 14y ago
    It's not just remote code execution; it's that this bug triggers in kernel font handling code. So, it bypasses application sandboxes and any other user space protections.
    - DannyBee 14y ago
      I think the best part of this is the phrase "kernel font handling code" Of all the things to put into kernel space ....
      - codewright 14y ago
        >Of all the things to put into kernel space .... It's Windows man, this is an old story now.
      - justinschuh 14y ago
        Yeah, the GDI is pretty horrible. But in Microsoft's defense, those decisions were made almost 20 years ago for NT4, when prevailing views on security and stability were very different from today. The post DX10 graphics pipeline doesn't do things like this, and is really quite sane and robust. Unfortunately, you need Vista+ for DX10, and even then you still get saddled with the local GDI attack surface.
Dylan16807 14y ago
Possible vulnerability is a reason to disable font loading from untrusted network locations. It is not an excuse to break font loading in local content-creation programs.
- pilif 14y ago
  How would windows know whether that blob it just has been told to load as a font comes from an external machine or not? Disabling all font loading is, besides fixing the parser, the only sensible thing to do from a security standpoint. It is not however at all sensible from a user perspective. They really should have fixed their font parser (and moved it out of the kernel as a secondary goal)
  - Dylan16807 14y ago
    Patch IE, tell mozilla and google about the problem too. Activity that is local to a machine should never be impaired by security patches aimed at the network.
    - pilif 14y ago
      Yeah. This scales really well. Especially because there are no other browsers but from Mozilla and Google (Opera? Smaller ones?) Also, you'd have to tell all makers of email clients and every other network connected application to mark external data as such - how likely do you think this is going to be?
      - Dylan16807 14y ago
        I'm just saying to treat it like webgl: a recent feature exposing un-hardened code to network assault that only allows recent/whitelisted drivers. It scales pretty well and puts the burden of network safety where it should be, on the application pulling in network data. If you blocked all potentially-weak code just because someone might feed in network data you'd end up with a brick.
        14y ago
quotemstr 14y ago
> MS should have fixed the vulnerability in their font parser In all likelihood, nobody understands how it works, and they're just afraid of touching the code and introducing a new vulnerability.

drzaiusapelord 14y ago

"eat a bullet?" What does that even mean? Come on, is it asking too much for even a semi-professional article here? The reg is a tabloid that's bascially blogspam. HN can do better.

lambda 14y ago
"Eat a bullet" is slang which means being shot. As in, the update kills certain fonts. It's also a pun, because fonts contain a character known as a bullet: "•". Yes, the Reg is an IT tabloid; they do an entertaining, sarcastic, and pun-filled take on IT news. I wouldn't call it blogspam in general; they do real reporting, and provide more than the usual blogspam "link, quote, and one sentence summary." In this particular case, the source they quoted probably would have been a better article to post, as it is longer and contains more information.