Microsoft Security Advisory (2719662)

[ronjor]

Vulnerabilities in Gadgets Could Allow Remote Code Execution

General Information
Executive Summary

Microsoft is announcing the availability of an automated Microsoft Fix it solution that disables the Windows Sidebar and Gadgets on supported editions of Windows Vista and Windows 7. Disabling the Windows Sidebar and Gadgets can help protect customers from vulnerabilities that involve the execution of arbitrary code by the Windows Sidebar when running insecure Gadgets. In addition, Gadgets installed from untrusted sources can harm your computer and can access your computer's files, show you objectionable content, or change their behavior at any time.

An attacker who successfully exploited a Gadget vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Applying the automated Microsoft Fix It solution described in Microsoft Knowledge Base Article 2719662 disables the Windows Sidebar experience and all Gadget functionality.

Recommendation. Customers who are concerned about vulnerable or malicious Gadgets should apply the automated Fix It solution as soon as possible. For more information, see the Suggested Actions section of this advisory.

https://technet.microsoft.com/en-us/...visory/2719662

[Breakfastofchumps]

Thanks for this.

[siljaline]

Thanks, Ron - fixed via Services and MSCONFIG.

[siljaline]

Microsoft fix kills Windows Gadgets, warns it could lead to PC hijacks

Microsoft has warned that a Gadgets feature included in Vista and later versions of Windows could allow attackers to hijack end-user machines and has taken the unusual step of issuing an temporary update that allows it to be completely disabled.

"An attacker who successfully exploited a Gadget vulnerability could run arbitrary code in the context of the current user," company officials said in an advisory issued Tuesday. "If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system." To be successful, they added: "An attacker would have to convince a user to install and enable a vulnerable Gadget."

Article

[gerardwil]

Originally Posted by siljaline

Microsoft fix kills Windows Gadgets, warns it could lead to PC hijacks
Article

Isn't this the same as the original excellent post of Ronjor?

[siljaline]

The article cites the same MS Technet findings and recommendations, otherwise, it is not.

Originally Posted by gerardwil

Isn't this the same as the original excellent post of Ronjor?

[xxJackxx]

I made the registry changes and exported so I could distribute to other machines. I don't see them fixing this ever, since they are wanting to kill gadgets anyway.

[siljaline]

Windows 8 will not support desktop gadgets, for reason cited in this thread, that have yet to be substantiated by Microsoft as written correctly.

It has been reported in many instances the Fit-it's are inverted.

[Thankful]

Originally Posted by siljaline

Windows 8 will not support desktop gadgets, for reason cited in this thread, that have yet to be substantiated by Microsoft as written correctly.

It has been reported in many instances the Fit-it's are inverted.

Is 50906 "Enable" or "Disable"?
The headings and explanations show conflicating results.

[siljaline]

We are not sure, meaning, those in the security community, have implemented both, some desktop gadget functionality is removed, yet desktop gadgets can still be enabled, this is a fix that does not completely work.
I cannot say with 100 % certainty, which is which, or, what will do what.

Originally Posted by Thankful

Is 50906 "Enable" or "Disable"?
The headings and explanations show conflicating results.

[zfactor]

i know some love those gadgets but imo good riddance. i dont use them nor will i ever. over the life of vista and 7 i have seen so many issues from them causing problems with various clients im personally glad to see them go.

[Page42]

I'm not using any Gadgets, so does that mean I need to do anything?
And I have no idea where to find Sidebars (I looked in Accessories), so where is it?

[siljaline]

Please re-read further up the thread for a detailed explanation.

Originally Posted by Page42

I'm not using any Gadgets, so does that mean I need to do anything?
And I have no idea where to find Sidebars (I looked in Accessories), so where is it?

[Page42]

I did read the thread and as a result of reading the thread I have two questions...
1. I'm not using any Gadgets, so does that mean I need to do anything?
2. I have no idea where to find Sidebars (I looked in Accessories), so where is it?

[siljaline]

Assuming Windows 7: desktop gadgets overview, Desktop gadgets FAQ, Microsoft Answers

[Page42]

The vulnerabilities discussed in the Advisory involve the execution of arbitrary code by the Windows Sidebar when running insecure Gadgets.
Does anyone know if I still need to disable Gadgets if I am not running any of them?

[siljaline]

The sidebar is still executed as cited here regardless of what fix-it used.
See:

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows 
Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

Best bet is to not run any desktop gadgets on Vista or Windows 7 regardless if you have run them or not.

[xxJackxx]

Originally Posted by Page42

Does anyone know if I still need to disable Gadgets if I am not running any of them?

I would just get rid of them altogether. Go to control panel, Programs and features, turn Windows features on or off, uncheck Windows gadget platform, reboot when prompted, done. No more gadgets.

[m00nbl00d]

Originally Posted by xxJackxx

I would just get rid of them altogether. Go to control panel, Programs and features, turn Windows features on or off, uncheck Windows gadget platform, reboot when prompted, done. No more gadgets.

That's one of the first things I do when I install Windows 7 clean.

[Page42]

Originally Posted by xxJackxx

I would just get rid of them altogether. Go to control panel, Programs and features, turn Windows features on or off, uncheck Windows gadget platform, reboot when prompted, done. No more gadgets.

@ xxJackxx ...
Thanks, that was very clear! I did as you suggested.
To date, I have been relying upon the description from Microsoft that states, "An attacker would have to convince a user to install and enable a vulnerable Gadget."

[Page42]

Originally Posted by siljaline

Best bet is to not run any desktop gadgets on Vista or Windows 7 regardless if you have run them or not.

Don't run them regardless if you have run them or not?

[xxJackxx]

Originally Posted by Page42

To date, I have been relying upon the description from Microsoft that states, "An attacker would have to convince a user to install and enable a vulnerable Gadget."

Which may be easier to have happen than one would suspect. If you for example install something like Norton Internet Security (or many other products) it installs a desktop gadget as part of the installation and opens it. An attacker would not need to prompt "Hey, install this gadget and run it too", they could slip it into many other processes. I'm sure most of the folks here would not get into that situation to begin with, but it probably wouldn't be any harder than it would be to slip a browser toolbar into your system. Better safe than sorry.

[Page42]

An attacker would have to convince a user to install and enable a vulnerable Gadget.

Well, I'm not very knowledgeable on the topic, but it would seem that the operative phrase is "vulnerable Gadget."
Doesn't seem to me that NIS would install a vulnerable gadget on a user's system.
Bottom line, though, is as you stated... better safe than sorry.

[xxJackxx]

Originally Posted by Page42

...Doesn't seem to me that NIS would install a vulnerable gadget on a user's system...

I don't expect they would, the point was ANY installer could install and run a gadget. That was just an example of how one can appear without you being specifically asked to install one.

[bo elam]

Originally Posted by xxJackxx

I would just get rid of them altogether. Go to control panel, Programs and features, turn Windows features on or off, uncheck Windows gadget platform, reboot when prompted, done. No more gadgets.

Thanks, I also followed your instructions to get rid of them, did not even try them out in my new laptop with W7.

Bo