And, within 18 days, the Sasser worm was cruising the Internet, hopping from one unpatched machine to another. The poorly coded worm wreaked havoc, shutting down networks around the world. Even though a fix was already available, many users -- in particular, corporate IT managers -- still had not applied MS04-011. By May 1, 2004, work on fixing the unintended damage caused by Sasser had become a round-the-clock operation, says then director of the Microsoft Security Response Center, Kevin Kean, with "a number of war rooms and rotating shifts" for MSRC staffers.
Upshot: What was that about patching as soon as the updates are available? Lessons that should have been learned three years earlier didn't really sink in until Sasser publicly pummeled patchless PCs to pulp.
WMF: Wherein malware is foisted
Bug identifier: CVE-2005-4560, MS06-001
Description: Vulnerability in graphics-rendering engine could allow remote code execution
Alias: Windows Metafile vulnerability, aka drive-by downloads
Date published: Jan. 5, 2006
Over the winter holidays in 2005, security researchers began discussing a newly discovered vulnerability in a Windows library used by the OS to display various kinds of graphics in apps and the OS itself.
The problem stemmed from a particular image file format, native to Windows since the days of Windows 3.0, called WMF (Windows Metafile). Used as the native format for storing graphics within Microsoft Office documents, support for WMF was by that point thoroughly embedded into Microsoft products.
WMF files contain function calls that a program sends to the GDI (Graphics Driver Interface). Someone discovered that WMF files can contain executable code as well. This would allow you to, say, create a WMF file that, merely by being viewing, invokes Internet Explorer to visit a particular URL, download a file, and execute that file. Special.
The aftermath of the discovery followed a familiar pattern. Microsoft issued a patch on Jan. 5, 2006, in record time. But for a long while, unpatched computers running vulnerable versions of gdi32.dll roamed the Internet, slurping up mountains of malware.
The bug had far-reaching effects, enabling malicious code to be foisted on unsuspecting users and executed in a variety of ways: previewing an e-mail containing the malicious WMF file in Outlook; viewing an image preview in Explorer; viewing a malicious WMF in certain third-party graphics programs; indexing a hard disk that contained a malicious file; following a URL link in an e-mail, IM, or on another Web page to a site where the malicious file was embedded in the Web page.
Upshot: We learned that nothing is sacred, that any file format could be considered hostile. And we also got a cool new name for an exploit method: drive-by downloads.
MDAC: The component that keeps on giving (headaches)
Bug identifier: CVE-2006-0003, MS06-014
Description: Vulnerability in MDAC (Microsoft Data Access Components) could allow code execution
Alias: MDAC RDS.Dataspace ActiveX bug
Date published: April 11, 2006