Full Disclosure mailing list archives
Re: WMF round-up, updates and de-mystification
From: "Crist J. Clark" <cristjc () comcast net>
Date: Wed, 4 Jan 2006 14:51:56 -0800
On Tue, Jan 03, 2006 at 06:49:53AM -0500, Larry Seltzer wrote: [snip]
All that said, it's clear to me that the rush to adopt this patch is precipitous. For instance, it's largely unnecessary on Windows 9x, NT, and 2K, unless you rely on a specifically vulnerable app, like Notes.
I have seen this claim in a few places. I have also seen the opposite put forth. On what basis do you say that Win9x, NT, and 2k are not vulnerable? I tested myself whether Internet Explorer (and by extension Outlook Express) will automatically display WMF files. They do. As does Outlook 2k. Is there some reason to believe the underlying WMF handling is different and unexploitable in these OSs? Right now, I'm operating on the assumption that if the picture shows up, u r 0wn3d. FWIW, the "unofficial patch" from Mr. Guilfanov will not install on Win9x or WinNT anyway. (It does on Win2k.) Also, speaking of 3rd party apps like Notes, anyone seen a fairly reliable method to test other 3rd party apps, e.g. Novell GroupWise? -- Crist J. Clark | cjclark () alum mit edu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- WMF round-up, updates and de-mystification Gadi Evron (Jan 03)
- Re: WMF round-up, updates and de-mystification Nancy Kramer (Jan 03)
- Re: WMF round-up, updates and de-mystification gat0r (Jan 03)
- Re: WMF round-up, updates and de-mystification InfoSecBOFH (Jan 03)
- Re: WMF round-up, updates and de-mystification ad () heapoverflow com (Jan 03)
- Re: WMF round-up, updates and de-mystification InfoSecBOFH (Jan 05)
- Message not available
- Re: WMF round-up, updates and de-mystification Crist J. Clark (Jan 04)
- Re: WMF round-up, updates and de-mystification ad () heapoverflow com (Jan 03)
- Message not available
- Re: WMF round-up, updates and de-mystification InfoSecBOFH (Jan 05)
- Re: WMF round-up, updates and de-mystification Nancy Kramer (Jan 03)
- Message not available
- Re: WMF round-up, updates and de-mystification InfoSecBOFH (Jan 05)
- Re: WMF round-up, updates and de-mystification Anthony R. Nemmer (Jan 05)
- Re: WMF round-up, updates and de-mystification Scott Renna (Jan 05)
- RE: WMF round-up, updates and de-mystification Mario Contestabile (Jan 04)
- Re: RE: WMF round-up, updates and de-mystification InfoSecBOFH (Jan 05)
- Re: Re: WMF round-up, updates and de-mystification InfoSecBOFH (Jan 05)