RTP-area local music and culture

[Chris Calloway <ifoufo AT yahoo.com>]

> but want to know if I should install the third-party non-Microsoft patch now
 
 well, if you want to get your advice from a.m.c-h, then:
 
 ordinarily, i would say no. reasons why:
 
 a) i attempted to get the source code for the patch from guilfanov's blog in 
order to inspect it and to attempt to recreate the executable. the source was 
only *conveniently* available by running the patch from what i can see. 
that's not the behavior of a *trusted* security expert. this has also been 
questioned in the comments of guilfanov's blog without answer from guilfanov.
 
 b) inspecting the patch file with an extractor did not reveal the packaging 
of any source code in the patch executable as promised by guilfanov.
 
 c) guilfanov did not provide the patch in a secure fashion. only secondary 
sources have added pgp keys, and then only to their repackaged msi. that's 
not the behavior of a *trusted* security experts.
 
 d) the patch *didn't run* on a network isolated scratch machine when i 
attempted it. it was not even recognized as an executable file by the shell. 
that seems very strange. i have not inspected the psp header of the 
executable to see why it isn't recognized. if i could run it on an isolated 
machine, i'd run it under a debugger to see what it was doing first.
 
 e) guilfanov in his blog said he had never created an msi before. this 
doesn't sound like "arguably one of the best low-level Windows experts in the 
world" to me.
 
 f) nobody is linking to advisories from established threat detection 
centers. everybody commenting from on high are secondary sources of threat 
information. is this a joke between isc, steve gibson, f-secure, and others 
to see what kind of social engineering can be perpetrated upon the fearful?
 
 g) guilfanov has sold buggy code in the past: 
http://www.woodmann.com/crackz/Tutorials/Quine2.htm
 
 h) add to the above that guilfanov is apparently leaving it up to the 
community to test his patch. when people scream about why hasn't ms released 
a patch yet...
 
 i) guilfanov's vulnerability checker, released after his patch, was rapidly 
shown to be thwarted by the most common anti-virus checkers. this does not 
further inspire confidence.
 
 but there are attack vectors for this vulnerability other than the wmf 
viewer unregistered by regsvr32 -u. xp *should* also require the 
re-unregistration of shimgvw.dll upon each reboot. if you can get the patch 
to actually run on your machine, maybe you want to consider it in view of 
these caveats.
 
 note: there was massive misinformation circulating in the mefi thread. 
jackflash was the only one to really get it right.
 
 3