<<< Date Index >>>     <<< Thread Index >>>

Re: MS released a patch today - MS06-001



Unfortunately, they didn't release a patch for 98, SE, or ME.  :-(

Tony

Duran, Jason IT0 wrote:

Microsoft released a patch for the WMF vulnerability this afternoon.
KB912919
http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx

http://www.microsoft.com/technet/security/bulletin/ms06-jan.mspx

Has anyone looked into this, tried it, or know what it modifies?

In the workarounds FAQ for the vulnerability, it mentions:
(Therefore, I think this is pre-patch release info.

============================================================================
===============================================

Workarounds for Graphics Rendering Engine Vulnerability - CVE-2005-4560:
Microsoft has tested the following workaround. While this workaround will
not correct the underlying vulnerability, it will help block known attack
vectors.

* Unregister the Windows Picture and Fax Viewer (Shimgvw.dll) on Windows XP
Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows
Server 2003 Service Pack 1

Microsoft has tested the following workaround. While this workaround will
not correct the underlying vulnerability, it helps block known attack
vectors. When a workaround reduces functionality, it is identified in the
following section.

Note This workaround is intended to help protect against Web based exploit
vectors and is not effective against exploits that have Windows Metafile
images embedded in Word documents and other similar attack vectors.

Note The following steps require Administrative privileges. We recommend
that you restart the computer after you apply this workaround.
Alternatively, you can log out and log back in after you apply the
workaround. However, we do recommend that you restart the computer.

To un-register Shimgvw.dll, follow these steps:

1.
Click Start, click Run, type "regsvr32 -u %windir%\system32\shimgvw.dll"
(without the quotation marks), and then click OK.

2.
When a dialog box appears that confirms that the process has been
successful, click OK.


Impact of Workaround: The Windows Picture and Fax Viewer will no longer
start when users click a link to an image type that is associated with the
Windows Picture and Fax Viewer.

To undo this workaround after the security update has been deployed,
reregister Shimgvw.dll. To do this, use this same procedure, but replace the
text in step 1 with "regsvr32 %windir%\system32\shimgvw.dll" (without the
quotation marks).


-----Original Message-----
From: Dave Korn [mailto:davek_throwaway@xxxxxxxxxxx] Sent: Tuesday, January 03, 2006 1:10 PM
To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: WMF browser-ish exploit vectors


Evans, Arian wrote in
news:8654C851B1DAFA4FA18A9F150145F92502C16D7A@xxxxxxxxxxxxxxxxxxxxxxxxxx
Here, let's make the rendering issue simple:

Due to IE being so content help-happy there are a
myriad of IE-friend file types (e.g.-.jpg) that one
can simply rename a metafile to for purpose of web exploitation, and IE will pull out the wonderful hey;
you're-not-a-jpeg-you're-a-something-else-that-I-can-
-automatically-handle trick err /feature/ for you.

 Yeh, that's a real dumbass design feature that one.

http://sharepoint2003/bizdir/your_custom_folder_icon.jpg

http://yourcorp_web_based_DMS/surprise_not_a.doc

etc.


Have you tried giving it a mpg/avi/wma/wmv extension and getting it to open in a (perhaps embedded) mediaplayer? That's liable to work as well; mediaplayer is also vulnerable to the choose-an-app-based-on-extension/app-loads-a-viewer-based-on-actual-content desynchronisation attack...


   cheers,
     DaveK


--

SKYKING, SKYKING, DO NOT ANSWER