bugtraq - WMF round-up, updates and de-mystification

Open Source and information security mailing list archives

Message-ID: <43BA35B8.9040404@linuxbox.org>
Date: Tue, 03 Jan 2006 10:28:40 +0200
From: Gadi Evron <ge@...uxbox.org>
To: bugtraq@...urityfocus.com
Cc: "FunSec \[List\]" <funsec@...uxbox.org>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: WMF round-up, updates and de-mystification

Quite a bit of confusing and a vast amount of information coming from 
all directions about the WMF 0day. Here are some URL's and generic facts 
to set us straight.

The "patch" by Ilfak Guilfanov works, but by disabling a DLL in Windows. 
So far no problems have been observed by anyone using this patch. You 
should naturally check it out for yourselves but I and many others 
recommend it until Microsoft bothers to show up with their own patch.

Ilfak is trusted and is in no way a Bad Guy.

You can find more information about it at his blog:
http://www.hexblog.com/2005/12/wmf_vuln.html

If you are still not sure about the patch by Ilfak, check out the 
discussion of it going on in the funsec list about the patch, with Ilfak 
participating:
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Occasional information of new WMF problems keep coming in over there.

In this URL you can find the best summary I have seen of the WMF issue:
http://isc.sans.org/diary.php?storyid=994
by the "SANS ISC diary" team.

In this URL you can find the best write-up I have seen on the WMF issue:
http://blogs.securiteam.com/index.php/archives/167
By Matthew Murphy at the "Securiteam Blogs".

Also, it should be noted at this time that since the first public 
discovery of this "problem", a new one has been coming in - every day. 
All the ones seen so far are variants of the original and in all ways 
the SAME problem. So, it would be best to acknowledge them as the 
same... or we will keep having a NEW 0day which really isn't for about 2 
months when all these few dozen variations are exhausted.

A small BUT IMPORTANT correction for future generations:
The 0day was originally found and reported by Hubbard Dan from Websense 
on a closed vetted security mailing list, and later on at the Websense 
public page. All those who took credit for it took it wrongly.

Thanks, and a better new year to us all,

	Gadi.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives