Home | Recent Posts New Topic
DrJBHL
DrJBHL
Join Date 04/2002
+4263

New Windows Flaw Allows Hack

MHTML Vulberability

January 30, 2011 7:46:57 AM from JoeUser ForumsJoeUser Forums

Windows (ALL current editions) is vulnerable to a hack through it’s MIME HTML handling protocol. This vulnerability would allow malicious code to be run through Internet Explorer and through Opera. This is a variant of XSS (Cross Site Scripting).

Firefox requires an add-on to read and write MHTML files. In it’s default configuration it is not vulnerable, Safari and Chrome are not either.

Microsoft recommended that users lock down the MHTML protocol handler by running a "Fixit" tool it's made available. This is not a patch. That will require more time to develop because this is a Windows vulnerability, not an iE one.

The Fixit tool can be accessed from Microsoft's support site . It has the undo tool there as well for when the real fix comes. This edits the registry and automatically makes a restore point before installing.

The current list of vulnerabilities not fixed by MS can be found HERE.

The CSS flaw I reported on in December can be addressed with a work around you can find HERE. The uninstall for it can be found HERE.

Locked Post
Search this post
Advanced Search
Subscription Options
Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #1 January 30, 2011 9:29:57 AM
from WinCustomize ForumsWinCustomize Forums

Would it be a good idea to go for it even if Firefox is not the open door?

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
DrJBHL
Join Date 04/2002
+4263
Reply #2 January 30, 2011 10:09:50 AM
from WinCustomize ForumsWinCustomize Forums

The CSS 'shim' (last sentence OP) yes. If you can read Gmail in your firefox, then I'd install the others as well. Also if you have unMHT extension install the others in the OP (unMHT: https://addons.mozilla.org/en-US/firefox/tag/MHTML)

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
theAVMAN
Join Date 10/2006
+434
Reply #3 January 30, 2011 10:38:01 AM
from WinCustomize ForumsWinCustomize Forums

Thanks Doc!!!

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #4 January 30, 2011 10:40:47 AM
from WinCustomize ForumsWinCustomize Forums

Then that's what I'm gonna do. One other question Doc. I created a user account for everyday use, not an administrator one, but mistakenly gave it admin status. How can I change that? There doesn't seem to be a way. OT I know but I'm trying to close back doors.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
DrJBHL
Join Date 04/2002
+4263
Reply #5 January 30, 2011 12:11:53 PM
from WinCustomize ForumsWinCustomize Forums

Harley, You're welcome.

Uvah:

Click start and type secpol.msc

This will open up the W7 Security Policy Editor, now browse to Security Settings, Local Policy, Security Options

At the top double click for both the administrator and guest account, choose enabled. Close all windows and restart Windows 7.

You are now able to login to 7 as administrator or guest. A good option is to rename those accounts to make it harder for hackers/friends you don't trust to find your precious login.

After enabling these accounts you should set a password as well, click start then type in cmd, then type net user administrator "password" without the quotes of course, you can do the same with the guest account or any other accounts, for more info on net user type net user /? or net /?

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #6 January 30, 2011 12:47:04 PM
from WinCustomize ForumsWinCustomize Forums

Typed it and got this..... no items match. Did it twice and got the same thing.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
DrJBHL
Join Date 04/2002
+4263
Reply #7 January 30, 2011 1:25:32 PM
from WinCustomize ForumsWinCustomize Forums

Don't know why, Uvah unless you aren't logged on as the Admin.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #8 January 30, 2011 1:40:17 PM
from WinCustomize ForumsWinCustomize Forums

I am believe it or not. Under my nic as Administrator, password protected. I logged off then logged back on. Even changing it back to my name makes no difference.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
DrJBHL
Join Date 04/2002
+4263
Reply #9 January 30, 2011 2:43:28 PM
from WinCustomize ForumsWinCustomize Forums

Only you, Uvah. Suggestion?

PM yrag. We need some entertainment. 

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #10 January 30, 2011 2:48:21 PM
from WinCustomize ForumsWinCustomize Forums

I don't think so.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
yrag
Join Date 08/2001
+393
Reply #11 January 30, 2011 3:03:23 PM
from WinCustomize ForumsWinCustomize Forums

I don't think so.

No balls, no golf.

secpol.msc

You don't have it.

 

Control Panel\All Control Panel Items\User Accounts - Change account type

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
DrJBHL
Join Date 04/2002
+4263
Reply #12 January 30, 2011 3:06:56 PM
from WinCustomize ForumsWinCustomize Forums

Thought he had W7 Pro, yrag.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #13 January 30, 2011 3:13:30 PM
from WinCustomize ForumsWinCustomize Forums

I posted in another thread I have home premium. I did change account types in control panel. That I know how to do. Its just that I wanted to change the second user account type and remove admin rights from it. No sense having two of them. I'm getting drawn into this anyway. Okay ...... tell me where I screwed up.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
yrag
Join Date 08/2001
+393
Reply #14 January 30, 2011 3:26:09 PM
from WinCustomize ForumsWinCustomize Forums

I posted in another thread I have home premium.

Shame on you Doc for not taking notes.....

 

Control Panel\All Control Panel Items\User Accounts

Post a snapshot of that panel.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
the_Monk
Join Date 01/2008
+222
Reply #15 January 30, 2011 3:40:49 PM
from Stardock ForumsStardock Forums

 

EDIT:

nevermind that post......lol.......didn't READ that he doesn't have Win7 pro  doh! 

 

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
DaveRI
Join Date 09/2003
+477
Reply #16 January 30, 2011 3:42:48 PM
from WinCustomize ForumsWinCustomize Forums

It has the undo tool there as well for when the real fix comes.

Crap.  Hope I get that part right.  Have visions of doing the final patch without undoing the temporary one.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
the_Monk
Join Date 01/2008
+222
Reply #17 January 30, 2011 3:48:43 PM
from Stardock ForumsStardock Forums

 

Uvah,

If you don't have at least one account as an "administrator" it won't let you take admin rights away from another.  My question is........are you sure that there is at least one admin user in the list?

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #18 January 30, 2011 3:52:19 PM
from WinCustomize ForumsWinCustomize Forums

Okay. Next.

 

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
yrag
Join Date 08/2001
+393
Reply #19 January 30, 2011 4:13:32 PM
from WinCustomize ForumsWinCustomize Forums

I strongly urge a backup.



Control Panel\All Control Panel Items\User Accounts\Manage Accounts\Create New Account

Create a second Admin account (no password). Hit 'Create account'

Click on the new account and enter a different password twice.(ignore the warning).

DO NOT CLOSE DIALOG BOX

Click on original Admin account and change to 'Standard'

Close. Log off/log on to new account

+1
Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
DrJBHL
Join Date 04/2002
+4263
Reply #20 January 30, 2011 4:23:49 PM
from WinCustomize ForumsWinCustomize Forums

Uvah: Here's some backup software for you:  https://forums.wincustomize.com/404683

 

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #21 January 30, 2011 4:34:01 PM
from WinCustomize ForumsWinCustomize Forums

First things first. All done. Problem solved. One admin, one standard and it didn't even hurt. Thank you yrag.

@Doc .... got it.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
DrJBHL
Join Date 04/2002
+4263
Reply #22 January 30, 2011 5:04:49 PM
from WinCustomize ForumsWinCustomize Forums

Good news! Gary, Thanks for your help.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #23 January 30, 2011 6:27:09 PM
from WinCustomize ForumsWinCustomize Forums

What I didn't expect was to have to rebuild my 'desktop' from scratch. Going back after all the .exe's and stuff. Tons-a-fun. lol

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Dr Guy
Join Date 09/2004
+129
Reply #24 January 31, 2011 9:25:48 AM
from JoeUser ForumsJoeUser Forums

I hate workarounds - not for me.  They are usually simple - but have you tried talking your aunt Mabel through them>?????

Thanks for the tip.  I hope MS gets a patch quickly.

Reason for Karma (Optional)
Successfully updated karma reason!
DrJBHL
Uvah
Join Date 05/2006
+874
Reply #25 January 31, 2011 10:19:05 AM
from WinCustomize ForumsWinCustomize Forums

This is a good place to post this. Just now I got a message about an update for firefox called Update Browser. As the author was verified I allowed it to install then I checked out the url http://www.nu-browser.com and got a 404 in return. I quickly uninstalled it. It may or not be genuine but I wasn't going to take the chance.

Reason for Karma (Optional)
Successfully updated karma reason!
Stardock Forums v        Server Load Time:   Page Render Time: