現在、諸般の事情 (w により、メインマシンは Vista SP2 なんですが、本格的に XP は捨てにかかるとしましょう。
例の IE のゼロデイ攻撃の件。Vista とそれ以降の Windows では、ワークアラウンドとしてEMET が有効の模様。脆弱性は、mscorie.dll に存在するようです。
マイクロソフト http://www.microsoft.com/technet/security/advisory/2488013.mspx
> Microsoft Security Advisory (2488013): Vulnerability in Internet Explorer Could Allow Remote Code Execution
マイクロソフト http://blogs.technet.com/b/srd/archive/2010/12/22/new-internet-explorer-vulnerability-affecting-all-versions-of-ie.aspx
> New Internet Explorer vulnerability affecting all versions of IE
> - Security Research & Defense - Site Home - TechNet Blogs(Snip)
> Proof-of-concept exploit bypasses ASLR and DEP
>
> The Metasploit project recently published an exploit for this vulnerability using a known technique to evade
> ASLR (Address Space Layout Randomization) and bypass DEP (Data Execution Prevention).
>
> In a few words, Internet Explorer loads mscorie.dll, a library that was not compiled with /DYNAMICBASE (thus not
> supporting ASLR and being located always at the same base) when processing some html tags. Attackers use these
> predictable mappings to evade ASLR and bypass DEP by using ROP (return oriented programming) gadgets from these
> DLLs in order to allocate executable memory, copying their shellcode and jumping into it. Note that without that
> predictable mapping, the only public ways to evade ASLR and DEP is through:
>
> * Use of this (in case the current vulnerability allows) or another vulnerability as an information leak.
> * Using techniques such as JIT-spraying or similar ones. Please note IE only JITs IE9’s javascript and
> there are security mitigations in place. But third party plugins could JIT in an insecure manner.
>
> We have recently blogged on the effectiveness of ASLR and DEP here.
>
> Recommendation: Use Enhanced Mitigation Experience Toolkit (EMET) to dynamically rebase all loaded DLLs
>(Snip)
↑IE9 Beta では、JavaScript 方面で JIT-spraying が効いているそうですが、CSS に関しては言及がありません。
マイクロソフト http://blogs.technet.com/b/srd/archive/2010/12/08/on-the-effectiveness-of-dep-and-aslr.aspx
> On the effectiveness of DEP and ASLR - Security Research & Defense - Site Home - TechNet Blogs
↑ Vista 以降にしか言及してません。Windows XP では、Process Explorer で見ても、ASLR 関係の項目はグレーアウトしており、そもそも ASLR は無効です。
早々に Windows 7 へ移行ってことで。メインに使うなら SP1 プリロードなヤツにしたかったんですけどねぇ。
※ 2010/12/24 現在、まだ RC1 。Microsoft さん、もう少しだ、がんばって〜。＼(^_＼)(／_^)／
(関連)
マイクロソフト http://www.microsoft.com/japan/windowsserver2008/sp1.mspx
> Windows 7 Service Pack 1 RC および Windows Server 2008 R2 Service Pack 1 RC に関して
インプレス INTERNET Watch http://internet.watch.impress.co.jp/docs/news/20101214_414274.html
> IEに新たな脆弱性、CSS処理の問題でウェブ閲覧だけで悪用される危険性 -INTERNET Watch
Secunia Advisories http://secunia.com/advisories/42510/
> Internet Explorer CSS Import Rule Processing Memory Corruption Vulnerability - Advisories - Community
・・・
http://d.hatena.ne.jp/TsuSUZUKI/20101215/1292420659
※ 2010年12月の Microsoft Update (定例)
いじょうです。
-
- -
