[VEST] Sigurnosni propust u Windows Graphics Rendering Engine-u!

Naime, svi winovi od 1990 pa do sada su izlozeni novom flaw-u pri obicnom otvaranju slike u browser-u.

http://news.ft.com/cms/s/0d644...b3-11da-ab8e-0000779e2340.html

_{MOD: Izmenjen naslov zbog TOPovanja teme.}

Potpis

Ipak se ++uje.

Već se danima prepričava o toj ranjivosti unutar Windows Graphics Rendering Engine-a. Zakrpa je u izradi pa će vjerojatno uskoro biti dostupna. Napraviti update definicija antivirusa!

Potpis

Knowledge is power.

Microsoft je najavio službenu zakrpu za 10. siječnja, no pojavila se i privremena zakrpa od Ilfak Guilfanova (poznatog po izradi IDA Pro-a) i prvotno je osvanula na Hex blogu (http://www.hexblog.com/2005/12/wmf_vuln.html) no on je trenutačno nedostupan. Od mnogih linkova na kojima se mogla skinuti (i koji više ne rade) probajte sljedeći koji trenutno radi:

http://www.savefile.com/files.php?fid=9338108

Zakrpa je namijenjena Windowsima 2000, XP (32 i 64-bitnim) i Server 2003. Ako ste primjenili privremeno rješenje odregistriranjem shimgvw.dll datoteke, sada to poništite odnosno ponovo registrirajte tu dll datoteku da bi ste ponovo imali thumbnailove (kucajte u Command Prompt sljedeće: regsvr32 shimgvw.dll).

Zakrpa sa gornjeg linka se nalazi u ZIP arhivi, kada ju skinete - otpakirajte ju i pokrenite datoteku wmffix_hexblog14.exe koja će pokrenuti instalaciju. Zakrpa se instalirava poput običnog programa, te se tako i deinstalirava (pomoću Add or Remove Programs u Control Panelu).

Potpis

Knowledge is power.

Novi link za privremenu zakrpu:
http://sunbeltblog.blogspot.co...e-download-for-unofficial.html

'Patch for WMF bug slated for next week'
http://www.securityfocus.com/brief/93

'Worries increase over WMF flaw'
http://www.securityfocus.com/brief/92

'Windows WMF flaw: How to protect against attacks'
http://www.computerworld.com/s...s/story/0,10801,107421,00.html

Potpis

Knowledge is power.

<Mali Misha> wrote in message

news:[email protected]...




Prilicno dobar FAQ o svemu:

http://handlers.dshield.org/jullrich/wmffaq.html


--

p,

p.

Hexblog je proradio; http://www.hexblog.com/index.html

Potpis

Knowledge is power.

Organizacija AV-Test je testirala niz antivirusnih alata pomoću 206 malicioznih datoteka koji iskorištavaju nezakrpani WMF propust.

Proizvodi koji su detektirali svih 206 malicioznih datoteka:

BitDefender
Computer Associates eTrust-VET
F-Secure
Kaspersky Lab
McAfee
Eset Nod32
Microsoft OneCare
Sophos
Symantec

...proizvodi koji su propustili detektirati jednu malicioznu datoteku:

Alwil Avast
Clam AntiVirus
Aladdin eSafe

...proizvodi koji su propustili detektirati mnoštvo malicioznih datoteka (u zagradi se nalazi i točan broj nedetektiranih malicioznih datoteka od strane pojednih antivirusnih programa):

Fortinet (18)
AntiVir (24)
eTrust-INO (25)
Panda (25)
Ikarus (26)
Norman (26)
Ewido (47)
AVG (59)
VirusBuster (61)
QuickHeal (63)
Trend Micro (63)
Dr Web (93)
VBA32 (110)
Authentium Command (119)
F-Prot (119)

http://news.com.com/Antivirus+...F+bug/2100-1002_3-6018696.html

Potpis

Knowledge is power.

Microsoft Security Bulletin MS06-001
Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919)
Published: January 5, 2006

http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx

Eto nama i zvanicne zakrpe.

Ponovo???

10 January 2006
Two new Windows bugs found

By Robert McMillan, IDG News Service

Two new flaws have been found in Windows, just days after Microsoft rushed out a patch covering the same part of the operating system.

A hacker going by the name "cocoruder" has posted details on the unpatched holes to the Bugtraq mailing list. They affect the same graphics rendering engine as the earlier WMF flaw - a hole so serious that security experts recommended people install a third-party patch rather than wait for Microsoft to produce its own.

However, the vulnerabilities are far less serious than the previous flaw in the Windows Metafile format, say security experts.

While the patched flaw was being exploited by attackers to take control of Windows machines, the latest vulnerabilities appear to pose the risk of simply crashing the WMF-viewing software, typically Internet Explorer. However, users would first need to trick a victim into viewing a specially crafted WMF image in order for this to happen, security experts say.

The vulnerabilities can be found in a number of versions of Windows, including Windows XP, Service Pack 2, Windows Server 2003, Service Pack 1, and Windows 2000, Service Pack 4.

Because of the inherent complexity of image formats, there are plenty of opportunities for attackers to find bugs similar to the two that were revealed Monday, said Russ Cooper, security analyst at Cybertrust.

But the new WMF vulnerabilities are not a major cause of concern, he said. "New malformed images that simply crash things aren't really that important unless they can be shown to cause code to execute," Cooper advised. "This is only getting any attention because its WMF and Microsoft just released a WMF patch."

Microsoft refused to comment on the new flaws.

http://www.techworld.com/security/news/index.cfm?NewsID=5120

Potpis

It's a big mistake to allow computer to realise that you are in a hurry.

Microsoft je danas izdao zakrpe za dva kritična propusta. Izdane zakrpe slijede onu objavljenu prošli tjedan. Zakrpe su došle dva dana nakon što su sigurnosni istraživači otkrili dvije dodatne ranjivosti u WMF-u. Ranjivosti, koje mogu uzrokovati DoS, se pojavljuju u načinu kako WMF Graphics Redering Engine procesira ExtCreateRegion i ExtEscape funkcije.

Više informacija:
http://www.securityfocus.com/brief/101
http://www.computerworld.com/s...21,00.html?SKC=security-107621
http://news.zdnet.com/2100-1009_22-6025413.html

Potpis

Knowledge is power.