Re: WMF round-up, updates and de-mystification

["Crist J. Clark" <cristjc () comcast net>]

On Tue, Jan 03, 2006 at 06:49:53AM -0500, Larry Seltzer wrote:
[snip]

> All that said, it's clear to me that the rush to adopt this patch is
> precipitous. For instance, it's largely unnecessary on Windows 9x, NT, and
> 2K, unless you rely on a specifically vulnerable app, like Notes.

I have seen this claim in a few places. I have also seen the
opposite put forth.

On what basis do you say that Win9x, NT, and 2k are not vulnerable?
I tested myself whether Internet Explorer (and by extension Outlook
Express) will automatically display WMF files. They do. As does
Outlook 2k. Is there some reason to believe the underlying WMF
handling is different and unexploitable in these OSs? Right now,
I'm operating on the assumption that if the picture shows up,
u r 0wn3d.

FWIW, the "unofficial patch" from Mr. Guilfanov will not install
on Win9x or WinNT anyway. (It does on Win2k.)

Also, speaking of 3rd party apps like Notes, anyone seen
a fairly reliable method to test other 3rd party apps, e.g.
Novell GroupWise?
-- 
Crist J. Clark                     |     cjclark () alum mit edu
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/