Re: [Full-disclosure] WMF round-up, updates and de-mystification
So this patch is trusted because you said so?
I have tested and confirmed that this patch only works in specific
scnenarios and does not mitigate the entire issue. Variations still
work.
On 1/3/06, Gadi Evron <ge@xxxxxxxxxxxx> wrote:
> Quite a bit of confusing and a vast amount of information coming from
> all directions about the WMF 0day. Here are some URL's and generic facts
> to set us straight.
>
> The "patch" by Ilfak Guilfanov works, but by disabling a DLL in Windows.
> So far no problems have been observed by anyone using this patch. You
> should naturally check it out for yourselves but I and many others
> recommend it until Microsoft bothers to show up with their own patch.
>
> Ilfak is trusted and is in no way a Bad Guy.
>
> You can find more information about it at his blog:
> http://www.hexblog.com/2005/12/wmf_vuln.html
>
> If you are still not sure about the patch by Ilfak, check out the
> discussion of it going on in the funsec list about the patch, with Ilfak
> participating:
> https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
> Occasional information of new WMF problems keep coming in over there.
>
> In this URL you can find the best summary I have seen of the WMF issue:
> http://isc.sans.org/diary.php?storyid=994
> by the "SANS ISC diary" team.
>
> In this URL you can find the best write-up I have seen on the WMF issue:
> http://blogs.securiteam.com/index.php/archives/167
> By Matthew Murphy at the "Securiteam Blogs".
>
> Also, it should be noted at this time that since the first public
> discovery of this "problem", a new one has been coming in - every day.
> All the ones seen so far are variants of the original and in all ways
> the SAME problem. So, it would be best to acknowledge them as the
> same... or we will keep having a NEW 0day which really isn't for about 2
> months when all these few dozen variations are exhausted.
>
> A small BUT IMPORTANT correction for future generations:
> The 0day was originally found and reported by Hubbard Dan from Websense
> on a closed vetted security mailing list, and later on at the Websense
> public page. All those who took credit for it took it wrongly.
>
> Thanks, and a better new year to us all,
>
> Gadi.
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>