Skip to Content.
Sympa Menu

ch-scene - Re: OT: that new Windows vulnerability

ch-scene AT lists.ibiblio.org

Subject: RTP-area local music and culture

List archive

Chronological Thread  
  • From: Chris Calloway <ifoufo AT yahoo.com>
  • To: RTP-area local music and culture <ch-scene AT lists.ibiblio.org>
  • Subject: Re: OT: that new Windows vulnerability
  • Date: Mon, 2 Jan 2006 06:24:41 -0800 (PST)

> but want to know if I should install the third-party non-Microsoft patch now

well, if you want to get your advice from a.m.c-h, then:

ordinarily, i would say no. reasons why:

a) i attempted to get the source code for the patch from guilfanov's blog in
order to inspect it and to attempt to recreate the executable. the source was
only *conveniently* available by running the patch from what i can see.
that's not the behavior of a *trusted* security expert. this has also been
questioned in the comments of guilfanov's blog without answer from guilfanov.

b) inspecting the patch file with an extractor did not reveal the packaging
of any source code in the patch executable as promised by guilfanov.

c) guilfanov did not provide the patch in a secure fashion. only secondary
sources have added pgp keys, and then only to their repackaged msi. that's
not the behavior of a *trusted* security experts.

d) the patch *didn't run* on a network isolated scratch machine when i
attempted it. it was not even recognized as an executable file by the shell.
that seems very strange. i have not inspected the psp header of the
executable to see why it isn't recognized. if i could run it on an isolated
machine, i'd run it under a debugger to see what it was doing first.

e) guilfanov in his blog said he had never created an msi before. this
doesn't sound like "arguably one of the best low-level Windows experts in the
world" to me.

f) nobody is linking to advisories from established threat detection
centers. everybody commenting from on high are secondary sources of threat
information. is this a joke between isc, steve gibson, f-secure, and others
to see what kind of social engineering can be perpetrated upon the fearful?

g) guilfanov has sold buggy code in the past:
http://www.woodmann.com/crackz/Tutorials/Quine2.htm

h) add to the above that guilfanov is apparently leaving it up to the
community to test his patch. when people scream about why hasn't ms released
a patch yet...

i) guilfanov's vulnerability checker, released after his patch, was rapidly
shown to be thwarted by the most common anti-virus checkers. this does not
further inspire confidence.

but there are attack vectors for this vulnerability other than the wmf
viewer unregistered by regsvr32 -u. xp *should* also require the
re-unregistration of shimgvw.dll upon each reboot. if you can get the patch
to actually run on your machine, maybe you want to consider it in view of
these caveats.

note: there was massive misinformation circulating in the mefi thread.
jackflash was the only one to really get it right.

3







Archive powered by MHonArc 2.6.24.

Top of Page