Slashdot Mirror
Businesses Urged To Use Unofficial Windows Patch
frankie writes "ZDNet is reporting on the latest dire pronouncements about the WMF vulnerability. The problem is so serious that security experts are urging IT firms to use the unofficial patch. Microsoft's current goal is to release the update on Tuesday." From the ZDNet article: "This is a very unusual situation -- we've never done this before. We trust Ilfak, and we know his patch works. We've confirmed the binary does what the source code said it does. We've installed the patch on 500 F-Secure computers, and have recommended all of our customers do the same. The businesses who have installed the patch have said it's highly successful" It's big enough that even mainstream media is covering the flaw.
It brings interesting schemes into my mind. Oh don't mind me, I'm just going to grab my tin foil hat.
do.what.promptcmds
Why not just block wmf files at your corporate site? That would be easier than applying an unofficial patch on all the systems, and then having to roll it back when the official MS patch comes out.
If you're curious as to what all they do, you can take a look here. A sample quote from the article:
In some cases, particularly when the Internet Explorer browser is involved, the testing process "becomes a significant undertaking," Toulouse said. "It's not easy to test an IE update. There are six or seven supported versions and then we're dealing with all the different languages. Our commitment is to protect all customers in all languages on all supported products at the same time, so it becomes a huge undertaking."
Not to trivialize the severity of this current problem, but ever notice that regardless of the severity or type of problem/virus/etc... there's allways a press release from F-Secure?
Also, the quote in the headline is from F-Secure recommending installation of the 3rd party patch, not from ZDNet as the headline may lead you to believe.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
This article isn't anything like the one that I submitted.
Mine looked more like this (body content from memory):
will be to compare the Microsoft released patch to the unofficial one.
It would be deliciously muddying for Microsoft if someone discovered significant parts of the unofficial patch in the official one.
One site (maybe one of ebaumsworld's ads, I believe--I won't link there) tried to do something with it. avast! alerted me with its usual "Caution. A virus has been detected" sound and "abort connection" dialog and all of that. Don't know if it succeeded (nothing unusual now, though my browser did show a naughtier site instead that time; I visited a few times again and it showed my intended site as usual, with much less naughtiness)
You can hold down the "B" button for continuous firing.
Is it possible to use the .wmf exploit to install the .wfm exploit patch?
It's good to see that Microsoft is keeping things consistent in this new year. As an administrator, I was worried I would have to learn something new. Rinse, lather, patch, repeat.
"Now the trouble about trying to make yourself stupider than you really are is that you very often succeed." -C.S. Lewis
No problem, always happy to share, but WTF? Can't they call the company whose malware remover gets installed? Why can't they ask them some questions or lean on them to uncover the originator of this scam?
fak3r.com
Yesterday (Jan 2). All 1300+ computers got patched and rebooted. I'm patching my home computers tonight...
The Doormat
If you're not outraged, then you're not paying attention.
Will Windows Update be able to overwrite the unofficial patch when the official one is released? Does WU do a hash check of some sort to verify if the files that is is replacing are versions that it is allowed to replace?
That's not nearly enough: the real culprit seems to be gdi32.dll.
shimgvw.dll calls gdi32.dll's Escape() function using SETABORTPROC. How many other dlls do the same? (The unofficial patch is supposed to ignore that parameter when Escape() is called.) How many other parameters allow for similar exploits?
And just try to run a Windows machine with gdi32 unregistered... look ma, no graphics!
This sucks, big time.
Of course, there's also another question with the WMF patch: many programs still allow exporting to WMF. There wasn't really much of a standard vector graphics format for win32 for a long time - iirc during my undergrad, I would frequently export my Matlab, Maple, and Autocad images to EMF before importing them into Word.
Early on, I distincly remember using WMF, mostly because I assumed something with Windows in the name would have better support from Word and the operating system. Presumably other users made the same mistake.
Will we be opening old documents and finding the images broken if this patch disables part of the MS WMF parsing ability?
I understand that most technical writers are just trying to target the masses and trying to keep it simple for them. However, the reason for that is to convey the message accurately. I put emphasis on that since they are the ones reaching the "Normal People" and have their attention and their trust. Of all people that should watch their use of buzzwords or technical jargon, it's them. As a self-proclaimed geek, I can holler out all the misuses of terms in the mainstream media until I'm blue in the face (or more efficiently and painlessly, post them on some website), but I won't reach as many people as they do. So I'm in agreement with the grandparent post on this one. Words do matter and the ones with the responsibility to use them correctly should do so with greater prejudice. I, on the otherhand, will watch from the stands and throw beer cans at them once in a while.
I have witnessed first hand how Guilfanov's unofficial patch will break some legaccy apps. The one in question was a 16-bit app (based on Access 2.0). After applying the patch, it was impossible to print some forms (we received an error). Sure, we uninstalled the patch and printing was OK again.
So therefore the interesting thing about the upcoming Microsoft patch is, how are they going to patch the hole without breaking the legitimate uses of the affected gdi functions???
It has nothing to do with how Microsoft does business. I'm just saying that your example of the Linux kernel hacker who patches a flaw and gets a whole free OS in return doesn't have to be diametrically opposed to what this individual has done, just that the benefits he will receive will differ. I agree with you, in that Microsoft should not receive the benefits of an open source environment without doing their part. Maybe Microsoft should give this guy a job...?
Stasis is death. Embrace change.
Out of curiosity, I checked for this dll on PCs with Windows 3.1, Windows 95, Windows 98, and Windows NT 4.0. There is no trace of its existence anywhere. I also checked File Manager on all these OSes by clicking File - Associate and then checked to see if .wmf was registered. It was not in any of those cases.
Naturally, the dll and the file association exist on Windows XP. (I copied NT 4's File Manager over to verify that it opens with rundll32.)
Does anyone know if older versions of Windows are impacted in any way? Is there a Proof Of Concept out there that I can use to verify?
More importantly, any 3rd party program that incorporates the use of WMF should be redesigned. You can't fix a vulnerability caused by a data structure that is insecure by design and still try to allow programs using WMF to function as normal. The logical thing to do would be to remove WMF implementation from Windows--thus disabling any application that uses WMF and are essentially vectors for potential exploits, then leave it up to the various 3rd party application authors to fix their own design flaws, which should be relatively easy--just stop relying on WMF.