IMPORTANT: WMF Vulnerability Exploited

[Heeter]

Re: Windows zero day nightmare exploited

I stand corrected, J.

Thanks for your explaination,

Heeter

 

[Steevo]

Re: Windows zero day nightmare exploited

http://www.symantec.com/avcenter/security/Content/15352.html

Disagrees with

Is this issue related to Microsoft Security Bulletin MS05-053 - Vulnerabilities in Graphics Rendering Engine Could Allow Code Execution (896424) which was released in November?
No, these are different and separate issues.

http://www.microsoft.com/technet/security/advisory/912840.mspx

There appears to be a fix? Or not, the fix is for a different issue.

 

[j79zlr]

Re: Windows zero day nightmare exploited

Sure, firefox's resistance to this is a bug in firefox's handling of wmf mimetypes, that actually protects them.

 

[j79zlr]

Re: Windows zero day nightmare exploited

http://www.symantec.com/avcenter/security/Content/15352.html

There appears to be a fix?

I'd trust this over whatever symantec is trying: http://www.hexblog.com/2005/12/wmf_vuln.html#more

Ilfak Guilfanov is an experienced windows programmer, Symantec Corp is not

 

[Steevo]

Re: Windows zero day nightmare exploited

I agree, I have just read that the patch is not for that issue. Stupid Symantec.

 

[NetRyder]

Re: Windows zero day nightmare exploited

Here's a FAQ on the SANS ISC: http://isc.sans.org/diary.php?storyid=994

 

[Perris Calderon]

Re: Windows zero day nightmare exploited

Here's a FAQ on the SANS ISC: http://isc.sans.org/diary.php?storyid=994

that's a great faq net.

I thought unregistering the dll was enough, we see from the interview that it is not.

we also see firefox only offers little protection and both fixes should be invoked regardless of the browser.

nice link

 

[j79zlr]

Microsoft sure is quick in handling their extremely critical vulnerabilities.

 

[NetRyder]

This is just horrible: http://www.f-secure.com/weblog/archives/archive-012006.html#00000759

 

[j79zlr]

Its a pretty bad exploit, I can't believe they still haven't released an official patch. The spyware it installs is a bitch to remove as well. Why is it that both free OS I use, FreeBSD and Gentoo, release patches in hours, yet the OS I pay hundreds of dollars for cannot. Personally I find it repulsive.

 

[Heeter]

Re: Windows zero day nightmare exploited

we also see firefox only offers little protection and both fixes should be invoked regardless of the browser.

Hi J79ZLR,

You mentioned earlier that firefox wouldn't open this type of file. This article mentions that it's more of a Windows problem, than a browser problem.

Hey Guys,

If a machine is infected:

What is the tell-tale signs? What is the fix to remove/repair an infected system?

All I have read about is what a bad bug this is, but cannot find what it does and what we are supposed to do to repair an infected system.

Thanks Guys,

Heeter

 

[NetRyder]

Re: Windows zero day nightmare exploited

Hi J79ZLR,

You mentioned earlier that firefox wouldn't open this type of file. This article mentions that it's more of a Windows problem, than a browser problem.

It is a Windows problem. IE will simply execute the exploit when you visit the malicious site. Firefox has a bug that wrongly handles WMF files, so as a side-effect, it prompts you before opening the file, providing one additional layer of protection. But if you open the file, you're screwed either way, regardless of what browser you're using.

If a machine is infected:

What is the tell-tale signs? What is the fix to remove/repair an infected system?

All I have read about is what a bad bug this is, but cannot find what it does and what we are supposed to do to repair an infected system.

If a machine is infected, you'll know immediately. It'll look something like this:

Make sure you have good anti-virus and anti-spyware tools installed (see the list in my post above for detection stats in this particular case).

 

[Tuffgong4]

I switched from AVG to Avast just because of this

 

[j79zlr]

That doesn't make any sense? Use the unofficial patch and unregister the DLL, you cannot expect any antivirus to be able to successfully identify and stop all new variations of this, which do seem to be rapidly increasing.

 

[j79zlr]

Re: Windows zero day nightmare exploited

Hi J79ZLR,

You mentioned earlier that firefox wouldn't open this type of file. This article mentions that it's more of a Windows problem, than a browser problem.

Hey Guys,

If a machine is infected:

What is the tell-tale signs? What is the fix to remove/repair an infected system?

All I have read about is what a bad bug this is, but cannot find what it does and what we are supposed to do to repair an infected system.

Thanks Guys,

Heeter

Here's a video:

http://www.websensesecuritylabs.com/images/alerts/wmf-movie.wmv

 

[NetRyder]

That doesn't make any sense? Use the unofficial patch and unregister the DLL, you cannot expect any antivirus to be able to successfully identify and stop all new variations of this, which do seem to be rapidly increasing.

While that's certainly true, one can clearly see that some products are better than others, especially due to better heuristic detection techniques in this particular case where variants are springing up rapidly.
Besides that, Avast does seem to consistently perform better than AVG on pretty much every independent test there is out there, so his decision sounds like a good one to me in any case.

 

[Grandmaster]

This is going to be a huge mess...

 

[NetRyder]

This is going to be a huge mess...

Most of us here shouldn't be affected since we know what's involved, but it's definitely a significant threat to the less techie crowd. Seems like it might be a good idea to warn our friends and relatives about this as a follow-up to our New Year's greetings.

 

[Grandmaster]

Most of us here shouldn't be affected since we know what's involved, but it's definitely a significant threat to the less techie crowd. Seems like it might be a good idea to warn our friends and relatives about this as a follow-up to our New Year's greetings.

Yeah I was about to go tell everyone in the house. I just got done disabling the DLL, and installing the unofficial patch.

So many potential systems could get infected, it's a scary thought.

 

[Admiral Michael]

Is it me or does unregistering the dll stop Windows Picture and Fax viewer from working?