lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed Jan 4 22:52:21 2006 From: cristjc at comcast.net (Crist J. Clark) Subject: WMF round-up, updates and de-mystification On Tue, Jan 03, 2006 at 06:49:53AM -0500, Larry Seltzer wrote: [snip] > All that said, it's clear to me that the rush to adopt this patch is > precipitous. For instance, it's largely unnecessary on Windows 9x, NT, and > 2K, unless you rely on a specifically vulnerable app, like Notes. I have seen this claim in a few places. I have also seen the opposite put forth. On what basis do you say that Win9x, NT, and 2k are not vulnerable? I tested myself whether Internet Explorer (and by extension Outlook Express) will automatically display WMF files. They do. As does Outlook 2k. Is there some reason to believe the underlying WMF handling is different and unexploitable in these OSs? Right now, I'm operating on the assumption that if the picture shows up, u r 0wn3d. FWIW, the "unofficial patch" from Mr. Guilfanov will not install on Win9x or WinNT anyway. (It does on Win2k.) Also, speaking of 3rd party apps like Notes, anyone seen a fairly reliable method to test other 3rd party apps, e.g. Novell GroupWise? -- Crist J. Clark | cjclark@...m.mit.edu
Powered by blists - more mailing lists