Re: [Full-disclosure] WMF round-up, updates and de-mystification



Microsoft just released patches for this vulnerability:

http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx

Unfortunately there are no Microsoft patches for this critical exploit for Win 98, Win 98 SE, or Win 98 ME. Millions of people still use these operating systems. Why didn't Microsoft issue patches for them? Also, is there an unnofficial patch out there that will work for these operating systems?

Thanks,
Anthony R. Nemmer

InfoSecBOFH wrote:

So this patch is trusted because you said so?

I have tested and confirmed that this patch only works in specific
scnenarios and does not mitigate the entire issue.  Variations still
work.

On 1/3/06, Gadi Evron <ge@xxxxxxxxxxxx> wrote:


Quite a bit of confusing and a vast amount of information coming from
all directions about the WMF 0day. Here are some URL's and generic facts
to set us straight.

The "patch" by Ilfak Guilfanov works, but by disabling a DLL in Windows.
So far no problems have been observed by anyone using this patch. You
should naturally check it out for yourselves but I and many others
recommend it until Microsoft bothers to show up with their own patch.

Ilfak is trusted and is in no way a Bad Guy.

You can find more information about it at his blog:
http://www.hexblog.com/2005/12/wmf_vuln.html

If you are still not sure about the patch by Ilfak, check out the
discussion of it going on in the funsec list about the patch, with Ilfak
participating:
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Occasional information of new WMF problems keep coming in over there.

In this URL you can find the best summary I have seen of the WMF issue:
http://isc.sans.org/diary.php?storyid=994
by the "SANS ISC diary" team.

In this URL you can find the best write-up I have seen on the WMF issue:
http://blogs.securiteam.com/index.php/archives/167
By Matthew Murphy at the "Securiteam Blogs".

Also, it should be noted at this time that since the first public
discovery of this "problem", a new one has been coming in - every day.
All the ones seen so far are variants of the original and in all ways
the SAME problem. So, it would be best to acknowledge them as the
same... or we will keep having a NEW 0day which really isn't for about 2
months when all these few dozen variations are exhausted.

A small BUT IMPORTANT correction for future generations:
The 0day was originally found and reported by Hubbard Dan from Websense
on a closed vetted security mailing list, and later on at the Websense
public page. All those who took credit for it took it wrongly.

Thanks, and a better new year to us all,

      Gadi.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/









--

SKYKING, SKYKING, DO NOT ANSWER

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: [Full-disclosure] Security Alert: Unofficial IE patches appear on internet
    ... created by a vulnerability is as serious as this case and the available ... Microsoft will be inclined strongly against holding on to this patch. ... Microsoft often have patches ready but wait for the corporate known ...
    (Full-Disclosure)
  • Re: Worm in Patch
    ... a naive and trusting nature in your personality believing that you would ... "receive a patch" instead of getting it from a trusted source..? ... Essentially - Microsoft never emails you a patch. ... using Windows XP "prettifications". ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Why do i keep on receiving shutdown system ?
    ... the Microsoft provided information on the matter can be ... The Symantec Repair utility and manual removal instructions can be found ... The patch that would have prevented this whole fiasco for you: ... If you have Sasser, the Microsoft provided information on the matter can be ...
    (microsoft.public.windowsxp.security_admin)
  • Re: NT Authority..
    ... You could have Blaster or you could have Sasser. ... the Microsoft provided information on the matter can be ... The patch that would have prevented this whole fiasco for you: ... After enabling the Internet Connection Firewall or creating the read-only ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: [Full-disclosure] Security Alert: Unofficial IE patches appear on internet
    ... code-independent workarounds (i.e., other than patches) are so poor, ... Microsoft will be inclined strongly against holding on to this patch. ... Microsoft to release a patch out of cycle for "critical flaws". ...
    (Full-Disclosure)