bugtraq - Re: WMF round-up, updates and de-mystification

Open Source and information security mailing list archives

Message-ID: <2be58a30601030334r37d3dam19df4ee9fbaf9f07@mail.gmail.com>
Date: Tue, 3 Jan 2006 03:34:46 -0800
From: InfoSecBOFH <infosecbofh@...il.com>
To: Gadi Evron <ge@...uxbox.org>
Cc: "FunSec \[List\]" <funsec@...uxbox.org>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	bugtraq@...urityfocus.com
Subject: Re: WMF round-up, updates and de-mystification

So this patch is trusted because you said so?

I have tested and confirmed that this patch only works in specific
scnenarios and does not mitigate the entire issue.  Variations still
work.

On 1/3/06, Gadi Evron <ge@...uxbox.org> wrote:
> Quite a bit of confusing and a vast amount of information coming from
> all directions about the WMF 0day. Here are some URL's and generic facts
> to set us straight.
>
> The "patch" by Ilfak Guilfanov works, but by disabling a DLL in Windows.
> So far no problems have been observed by anyone using this patch. You
> should naturally check it out for yourselves but I and many others
> recommend it until Microsoft bothers to show up with their own patch.
>
> Ilfak is trusted and is in no way a Bad Guy.
>
> You can find more information about it at his blog:
> http://www.hexblog.com/2005/12/wmf_vuln.html
>
> If you are still not sure about the patch by Ilfak, check out the
> discussion of it going on in the funsec list about the patch, with Ilfak
> participating:
> https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
> Occasional information of new WMF problems keep coming in over there.
>
> In this URL you can find the best summary I have seen of the WMF issue:
> http://isc.sans.org/diary.php?storyid=994
> by the "SANS ISC diary" team.
>
> In this URL you can find the best write-up I have seen on the WMF issue:
> http://blogs.securiteam.com/index.php/archives/167
> By Matthew Murphy at the "Securiteam Blogs".
>
> Also, it should be noted at this time that since the first public
> discovery of this "problem", a new one has been coming in - every day.
> All the ones seen so far are variants of the original and in all ways
> the SAME problem. So, it would be best to acknowledge them as the
> same... or we will keep having a NEW 0day which really isn't for about 2
> months when all these few dozen variations are exhausted.
>
> A small BUT IMPORTANT correction for future generations:
> The 0day was originally found and reported by Hubbard Dan from Websense
> on a closed vetted security mailing list, and later on at the Websense
> public page. All those who took credit for it took it wrongly.
>
> Thanks, and a better new year to us all,
>
>        Gadi.
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives