nanog mailing list archives
Re: WMF patch
From: Robert Boyle <robert () tellurian com>
Date: Thu, 05 Jan 2006 13:10:26 -0500
At 12:54 PM 1/5/2006, you wrote:
Thanks Thomas, something really useful. One thing I am still curious about, I read that there were other image formats can be used in an exploit, GIF, .BMP, .JPG, .TIF can also be used, according to F-Secure. I find this a little confusing, if that dll only deals with WMF file type then the exploit must not be directly connected with that dll Or does that dll handle all of those as well?But then I found this http://www.pcworld.com/howto/article/0,aid,119993,00.aspWhich makes sense. The way a lot of things I have been seeing go on about this they act like WMF is the only format of issue and that obviously is not at all true. I would have more likely ignored this if it really was only WMF files and the MS patch a week or so away.
I believe Windows uses the file header/descriptor data as well as or instead of the extension to know how to handle images. Otherwise, simply renaming/blocking all WMF files would result in an effective mitigation method.
-Robert Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin
Current thread:
- WMF patch Eric Frazier (Jan 04)
- RE: WMF patch Brance Amussen (Jan 04)
- RE: WMF patch Steve Sobol (Jan 04)
- Message not available
- Re: WMF patch Eric Frazier (Jan 05)
- Re: WMF patch Robert Boyle (Jan 05)
- Re: WMF patch Eric Frazier (Jan 05)
- RE: WMF patch Brance Amussen (Jan 04)
- <Possible follow-ups>
- RE: WMF patch Fergie (Jan 04)
- RE: WMF patch Randy Bush (Jan 04)
- RE: WMF patch Sean Donelan (Jan 04)
- RE: WMF patch Fred Heutte (Jan 04)
- Re: WMF patch Valdis . Kletnieks (Jan 04)
- Re: WMF patch Stephane Bortzmeyer (Jan 05)
- Re: WMF patch Alexander Harrowell (Jan 05)
- MPLS Providers Andrew Staples (Jan 05)
- Re: WMF patch Valdis . Kletnieks (Jan 04)
- Re: WMF patch Martin Hannigan (Jan 04)