full-disclosure - Static Blocking for the WMF Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu Dec 29 16:50:17 2005
From: discussions at lagraphico.com (Discussion Lists)
Subject: Static Blocking for the WMF Exploit - over
	50known variants

Sorry if this was asked before, but how do I know if my machine has been compromised?  I am working on a way to contain any damage caused by this exploit, and it would be helpful to know for sure that what I am doing is working or not working.
 
Thanks!

	-----Original Message-----
	From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Todd Towles
	Sent: Thursday, December 29, 2005 7:16 AM
	To: full-disclosure@...ts.grok.org.uk
	Subject: [Full-disclosure] Static Blocking for the WMF Exploit - over 50known variants
	
	
	Sunbelt has released several sites that are being used to spread bad WMF files 
	 
	http://sunbeltblog.blogspot.com/2005/12/more-than-50-wmf-variants-in-wild.html  <http://sunbeltblog.blogspot.com/2005/12/more-than-50-wmf-variants-in-wild.html?> 
	 
	I have added this sites into my static blocking, but this isn't a great method..but it can only help at this point. Wanted to share this information. 
	 
	 -Todd
	
	
	 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051229/c8764c52/attachment.html