[Full-disclosure] RE: WMF round-up, updates and de-mystification



But come on..Steve Gibson's latest "Security Now" podcast claims he has
'looked it over, and it looks good' ...

Mario Contestabile
Developer , RadialPoint
marioc@xxxxxxxxxxxx
Profile: https://www.linkedin.com/e/fps/3704298/



-----Original Message-----
From: Adam Shostack [mailto:adam@xxxxxxxxxxxx]
Sent: January 3, 2006 5:37 PM
To: Gadi Evron
Cc: bugtraq@xxxxxxxxxxxxxxxxx; full-disclosure@xxxxxxxxxxxxxxxxx; FunSec
[List]
Subject: Re: WMF round-up, updates and de-mystification

On Tue, Jan 03, 2006 at 10:28:40AM +0200, Gadi Evron wrote:
| The "patch" by Ilfak Guilfanov works, but by disabling a DLL in Windows.
| So far no problems have been observed by anyone using this patch. You

This is incorrect. Michael Hennessy has reported problems on the
patch-management mailing list:

> I took the SANS advice and de-registered the dll, and also installed
> Ilfak Guilfanov's "temporary patch" on 1 win2k machine and 6 XP
> machines today.
>
> All fine except for one of the XP machines - wouldn't run IE without
> gpf'ing until I uninstalled the patch - but leaving the dll
> de-registered didn't seem to cause any grief anywhere, so far.
>
> FWIW, the iexplore crashes left this in the event log:
>
> Event ID 4097, source : drwatson The application, C:\Program
> Files\Internet Explorer\iexplore.exe, generated an application error
> The error occurred on 01/02/2006 @ 14:49:49.709 The exception
> generated was c0000005 at address 0068E3BA (<nosymbols>)
>
> I suspect that the patch conflicts with an application that is
> specific to this machine.

http://marc.theaimsgroup.com/?l=patchmanagement&m=113624877814460&w=2

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • MS03-026 shows as installed but failed
    ... patch via policy in AD, via SMS, and manually to Windows ... A large percentage of our machines have ... hundred and twenty) to get it to install so the DLL ...
    (microsoft.public.win2000.security)
  • [Full-disclosure] Re: WMF round-up, updates and de-mystification
    ... | So far no problems have been observed by anyone using this patch. ... Michael Hennessy has reported problems on ... > I took the SANS advice and de-registered the dll, ... > All fine except for one of the XP machines - wouldn't run IE without ...
    (Full-Disclosure)
  • Re: WMF round-up, updates and de-mystification
    ... | So far no problems have been observed by anyone using this patch. ... Michael Hennessy has reported problems on ... > I took the SANS advice and de-registered the dll, ... > All fine except for one of the XP machines - wouldn't run IE without ...
    (Bugtraq)
  • Automatically patching machine with hotfix KB824146 using mbsafu.
    ... I didn't want to spend as many hours patching machines with KB824146 exploit ... Mbsafu is an automatic remote patching tool that applies Security updates ... Download and install mbsa. ... Setup a network share with full privileges for the account you will patch ...
    (NT-Bugtraq)
  • MD5s of Unofficial patches and other mistakes
    ... Now that the official patch is out, ... I got too paranoid, for good reason. ... When I saw the source code, which works patching a DLL at run-time based ... I'm offered an MD5 from the SAME distributing site that serves the patch installer. ...
    (Bugtraq)