Channel 9 Forums - Coffeehouse - Crashes with animated cursors. What the hell? http://mschnlnine.vo.llnwd.net/d1/Dev/App_Themes/C9/images/feedimage.png Channel 9 Forums - Coffeehouse - Crashes with animated cursors. What the hell? http://channel9.msdn.com/Forums Channel 9 keeps you up to date with the latest news and behind the scenes info from Microsoft that developers love to keep up with. From LINQ to SilverLight – Watch videos and hear about all the cool technologies coming and the people behind them. http://channel9.msdn.com/Forums en Sun, 26 May 2013 00:36:42 GMT Sun, 26 May 2013 00:36:42 GMT Rev9 10 -10 -1 Coffeehouse - Crashes with animated cursors. What the hell?
Don't drag&drop an animated cursor over me, I could stop responding!

]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/253605#253605 Fri, 30 Mar 2007 08:33:23 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/253605#253605 YearOfTheLinuxDesktop 10 http://channel9.msdn.com/Niners/YearOfTheLinuxDesktop/Discussions/RSS Coffeehouse - Crashes with animated cursors. What the hell?
YearOfTheLinuxDesktop wrote:


Well that is quite simply .... unbelievable.

So a drive-by click managed to crash Vista?

So what happened to all that stuff about a vulnerability not propogating down through the layers?

Unbelievable, but I think I already said that.

]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/66cbf1b4422d43638c299dec006b86a0#66cbf1b4422d43638c299dec006b86a0 Fri, 30 Mar 2007 10:30:36 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/66cbf1b4422d43638c299dec006b86a0#66cbf1b4422d43638c299dec006b86a0 Ray6 10 http://channel9.msdn.com/Niners/Ray6/Discussions/RSS Coffeehouse - Crashes with animated cursors. What the hell? I have to say I'm puzzled by a) how they managed to get it to crash like that (assuming all default settings and considering MS quotes below) b) why the email html preview is affected but IE7 in protected mode is not? (why doesn't protected mode apply to email viewing, it's still html?)

Couple select quotes from http://www.microsoft.com/technet/security/advisory/935423.mspx


"Customers who are using Internet Explorer 7 on Windows Vista are protected from currently known web based attacks due to Internet Explorer 7.0 protected mode"

This one is weird:

"By default, Outlook 2007 uses Microsoft Word to display e-mail messages which protects customers from the HTML e-mail preview and attack vector"

So now viewing stuff in Word protects in this case? One would figure that Word would have more features and thus bugs.


"Reading e-mail in plain text on Outlook Express does not mitigate attempts to exploit this vulnerability"

Ouch. This one is surprising. I'd like to ask, how the hel* does the cursor get past that automatically or is there some user action still required?


]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/88d5bad6fb9c48d885339dec006b86ce#88d5bad6fb9c48d885339dec006b86ce Fri, 30 Mar 2007 17:04:57 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/88d5bad6fb9c48d885339dec006b86ce#88d5bad6fb9c48d885339dec006b86ce androidi 10 http://channel9.msdn.com/Niners/androidi/Discussions/RSS Coffeehouse - Crashes with animated cursors. What the hell? I hope c9 doesnt start using animated cursors.

]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/72d13aa8cad541f9a13c9dec006b86f6#72d13aa8cad541f9a13c9dec006b86f6 Fri, 30 Mar 2007 17:08:26 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/72d13aa8cad541f9a13c9dec006b86f6#72d13aa8cad541f9a13c9dec006b86f6 harumscarum 10 http://channel9.msdn.com/Niners/harumscarum/Discussions/RSS Coffeehouse - Crashes with animated cursors. What the hell?
androidi wrote:


I have to say I'm puzzled by a) how they managed to get it to crash like that (assuming all default settings and considering MS quotes below) b) why the email html preview is affected but IE7 in protected mode is not? (why doesn't protected mode apply to email viewing, it's still html?)

Couple select quotes from http://www.microsoft.com/technet/security/advisory/935423.mspx


"Customers who are using Internet Explorer 7 on Windows Vista are protected from currently known web based attacks due to Internet Explorer 7.0 protected mode"

This one is weird:

"By default, Outlook 2007 uses Microsoft Word to display e-mail messages which protects customers from the HTML e-mail preview and attack vector"

So now viewing stuff in Word protects in this case? One would figure that Word would have more features and thus bugs.


"Reading e-mail in plain text on Outlook Express does not mitigate attempts to exploit this vulnerability"

Ouch. This one is surprising. I'd like to ask, how the hel* does the cursor get past that automatically or is there some user action still required?




It sounds like the bug works like this:

Animated cursors (*.ani) show a preview of the cursor as the icon in Windows Explorer.  So, when a malformed animated cursor is placed on the desktop (and probably any other folder), it causes Explorer to stop responding while it attempts to draw the animated cursor as the icon for the file.

There's no way this attack could be automated (unless your email client lets files automatically be downloaded to the desktop).  The cursor file could only end up on the desktop (triggering this bug) if the user decided to download the file, which could be an email attachment or a file downloaded from the web.  If it's in an email attachment, it doesn't matter whether you're using HTML mail or not, you can still download the attachment.

It all boils down to not downloading files from untrusted sources--  if you follow that rule, you're fine.

[edit] It appears that this can also be exploited when an HTML page includes a malformed cursor file as well...  that's why IE7 isn't affected in Protected Mode.  Word's HTML viewing prevents this bug from being exploited because it's not a full featured HTML viewer--  it can't use an animated cursor included in a webpage.

]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/9f4f0d8f38c942f3b1829dec006b872b#9f4f0d8f38c942f3b1829dec006b872b Fri, 30 Mar 2007 17:52:18 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/9f4f0d8f38c942f3b1829dec006b872b#9f4f0d8f38c942f3b1829dec006b872b JonathonW 10 http://channel9.msdn.com/Niners/CannotResolveSymbol/Discussions/RSS Coffeehouse - Crashes with animated cursors. What the hell?
CannotResolveSymbol wrote:

[edit] It appears that this can also be exploited when an HTML page includes a malformed cursor file as well...  that's why IE7 isn't affected in Protected Mode.  Word's HTML viewing prevents this bug from being exploited because it's not a full featured HTML viewer--  it can't use an animated cursor included in a webpage.


"Reading e-mail in plain text on Outlook Express does not mitigate attempts to exploit this vulnerability"

Assuming you're right it still doesn't explain the above quote. How come Word's HTML viewing prevents but a plain text (no html parsing) doesn't? It just doesn't make any sense assuming the bug can be exploited just by opening the mail in plain text and not clicking some .ani attachment or stuff.

]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/8416cbf375c2494b933f9dec006b8757#8416cbf375c2494b933f9dec006b8757 Fri, 30 Mar 2007 19:44:04 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/8416cbf375c2494b933f9dec006b8757#8416cbf375c2494b933f9dec006b8757 androidi 10 http://channel9.msdn.com/Niners/androidi/Discussions/RSS Coffeehouse - Crashes with animated cursors. What the hell? an unofficial patch for this bug came out just today.

]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/e04bf0a86ecd4181b8209dec006b8782#e04bf0a86ecd4181b8209dec006b8782 Fri, 30 Mar 2007 20:34:22 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/e04bf0a86ecd4181b8209dec006b8782#e04bf0a86ecd4181b8209dec006b8782 YearOfTheLinuxDesktop 10 http://channel9.msdn.com/Niners/YearOfTheLinuxDesktop/Discussions/RSS Coffeehouse - Crashes with animated cursors. What the hell? if I remember the article it says that it's a malformed ani file. So the file is corrupt in the first place.

]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/361ba5a327ff4d40892c9dec006b87ab#361ba5a327ff4d40892c9dec006b87ab Fri, 30 Mar 2007 21:58:30 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/361ba5a327ff4d40892c9dec006b87ab#361ba5a327ff4d40892c9dec006b87ab Cybermagellan 10 http://channel9.msdn.com/Niners/Cybermagellan/Discussions/RSS Coffeehouse - Crashes with animated cursors. What the hell? Man, if you can't trust the little walking dinosaur and the drum to not crash your machine, who can you trust?

]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/b4c593e9667742aebb279dec006b87d5#b4c593e9667742aebb279dec006b87d5 Fri, 30 Mar 2007 22:06:01 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/b4c593e9667742aebb279dec006b87d5#b4c593e9667742aebb279dec006b87d5 Lazycoder2 10 http://channel9.msdn.com/Niners/Lazycoder2/Discussions/RSS Coffeehouse - Crashes with animated cursors. What the hell? Well, looks like the patch is getting released early.

]]> http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/8ab8bf30aee44a309df09dec006b8800#8ab8bf30aee44a309df09dec006b8800 Mon, 02 Apr 2007 08:47:08 GMT http://channel9.msdn.com/Forums/Coffeehouse/253605-Crashes-with-animated-cursors-What-the-hell/8ab8bf30aee44a309df09dec006b8800#8ab8bf30aee44a309df09dec006b8800 Bas 10 http://channel9.msdn.com/Niners/Bas/Discussions/RSS