** HEADS UP ** IE vulnerability. EXTREMELY CRITICAL.

Face it network admins...

This is a mess.... It was going to happen, without question.... This is why we get the big bucks....

Mitigate where you can.... Where you can't, fall back on ACL's, when they won't work research and find a way to give yourself the "heads up" that something went awry. If the risk assessment indicates that functionality has to be lost for certain users and not others so be it.... If you have to isolate certain computers from the network so that certain business functionality can continue then do so - need to receive images... do it on a *nix box and change the file format... The act of doing so in *nix will kill the exploit.... You know what you can do within you own network..... This isn't the time to start "flapping"... Do your job and lets fix this..... As with all the others, it will go away soon....

Quote:

---

Originally posted here by Tiger Shark

This is a mess.... It was going to happen, without question.... This is why we get the big bucks....

---

Um.... big bucks? My sister works at a call center and makes more than I do... I make just under $300 USD weekly.. but enough of the off topic posting

Quote:

---

Mitigate where you can.... Where you can't, fall back on ACL's, when they won't work research and find a way to give yourself the "heads up" that something went awry. If the risk assessment indicates that functionality has to be lost for certain users and not others so be it.... If you have to isolate certain computers from the network so that certain business functionality can continue then do so - need to receive images... do it on a *nix box and change the file format... The act of doing so in *nix will kill the exploit.... You know what you can do within you own network..... This isn't the time to start "flapping"... Do your job and lets fix this..... As with all the others, it will go away soon.... [/B]

---

For those of you that want to use the *nix ability to convert.... Use the ImageMagick convert binary... It's a fairly simple process..

convert <infected file> <new file>

I'd suggest two commands

convert infected.jpg notinfected.png
convert notinfected.png notinfected.jpg

You'll now have a clean jpg (from what I understand and what TS is saying)... Anyone know of a *nix proxy that will let you process files with external commands... It'd be fairly simple to script the proxy to execute those two commands on jpgs... and it's a fairly quick process.

Peace,
HT

I'm assuming this has nothing to do with me as my box is Windows 2000???

Eg ;)

Quote:

---

Originally posted here by Egaladeist
I'm assuming this has nothing to do with me as my box is Windows 2000???

Eg ;)

---

I'd like to hope this is a joke.... but I'm not really sure....

Please let this be a joke...

Peace,
HT

Hi HT,

Well...everything I've read on Sans and here and other places mention Windows fully patched 2003 servers and XP...but I haven't seen 2000 mentioned at all...so...I'm looking for some clarification that 2000 is not affected by this exploit???

Eg ;)

Egal:

You're joking.... Right?

Errr.... Here, read it carefully.

If you're not joking then this is why this stuff succeeds......

HT:

Correct me if I am wrong.... The *nix conversion _should_ work because the *nix will ignore the exploit code as being extraneous and the new file format would not accept it anyway.... That's my thought, I mis-spoke when I said it _will_ remove it.... It's always been my understanding that when you convert file formats "rubbish" in the new format would be dropped. Doing it in *nix would make the converting machine would be immune. Wanna test it for us? ;)

Hi TS,

Ok...

Quote:

---

nternet Explorer will view the image and trigger the exploit without warning. New versions of Firefox will prompt you before opening the image. However, in most environments this offers little protection given that these are images and are thus considered 'safe'.

* What versions of Windows are affected?

All. Windows 2000, Windows XP, (SP1 and SP2), Windows 2003. All are affected to some extent. Mac OS-X, Unix or BSD is not affected.

---

this is the first I've seen 2000 mentioned...as for internet Explorer, have it but don't use it, even my updates are automatic...now...it says Firefox will prompt before opening up the image...I never click or open anything unless I requested it...

so....given these circumstances...how vunerable am I ???

Eg ;)

Do you have the google desktop? Do you use Outlook or outlook express?

Hey Hey,

Eg: Still Vulnerable... a browser is only one attack vector... plain and simple every MS user is at risk for a high potential of harm... it's sort of frightening... The patch is prolly a good idea (if you trust third party patches)


TS: Perhaps this is more wide spread than expected? Althought dealt with a little better on the windows side.... I apparently misspoke as well.. I"m just waiting for a VirtualPC XP image to finish install so I'm playing around with stuff and I attempted to test using ImageMagick's convert. which uses wmf2eps (if you're using a .wmf file)... I got an error using the convert so I ran wmf2eps directly and got the same error...

Quote:

---

colinux:~# wmf2eps --eps -o test.eps /home/htregz/test.wmf
ERROR: player.c (463): libwmf: wmf with bizarre record size; bailing...
ERROR: player.c (464): please send it to us at http://www.wvware.com/
maximum record size = 58
record size = 2580977743

---

Looks like it notes the size and bails... there's also no option to bypass the record size... I'm gonna be around for a little bit longer so I'm gonna keep playing and see what happens.

Peace,
HT

Eg:

Keep flipping back through the ISC daily's.... There is one that says that Firefox is still vulnerable as are some other browsers IIRC.

The problem comes from the fact that most windows third party software doesn't re-invent the wheel when it doesn't have to so it uses system calls to execute code previously written, read: dll's. This is a dll issue, (actually it seems to be a multiple dll issue but there is sufficient confusion going on out there as to what is safe and what isn't that one must defer to the worst case scenario).

When I get to work tomorrow - before my users - I will script the unofficial fix and unregister the dll and send an email to all telling them to expect funny stuff and this it is what it will look like and this is what they should do. The block lists are in place, image files are blocked at the SMTP gateways, the Bleeding Snort rules are in place, (though I understand that they are "iffy" at best), and I have all fingers and toes crossed.....

Time for another beer... It's going to get me or it isn't..... I'm hoping for the latter and if the former occurs I'm hoping for a minimally malicious payload.....

Yes, I could block all internet traffic but I can't be bothered with the grief I will get..... But _one_ hit will get the users a lockdown and they have already been alerted to that fact... ;)

Some instant messengers allow people to display pictures from their machines next to the chat window ( MSN Messenger springs to mind ). Does anybody know if this is vulnerable? I would guess it is, but would like to know for sure.

qwertyman66

Quote:

---

he new vulnerability makes it possible for users to infect their computers with spyware or a virus simply by viewing a web page, e-mail or instant message that contains a contaminated image.

“We haven’t seen anything that bad yet, but multiple individuals and groups are exploiting this vulnerability,” Mr Hyppönen said. He said that every Windows system shipped since 1990 contained the flaw.

---

from here

the exploit still works if the .wmf files were renamed to other image extensions.. like .jpg or .bmp... so filtering .wmf wont 100% work

No, it doesn't work because they are recognized and therefore executed based on their 'magic' If you filtered by the magic at the border you *may* have a chance of blocking them from the outside. No guarantees though.

Hi,

One thing I haven't seen specifically discussed is whether there is a "minimum size" for one of these image files that potentially contains malicious code?

:)

On the Windows 2000 issue..

My desktop PC here is Windows 2000 running Outlook 2000. Outlook can render WMF files embedded in an email message just fine - i.e. not as an attachment, as part of the message body. I guess if you have autopreview then you can infect your PC without even opening the message.

You can also embed WMFs in things like Word documents and other office files. It's been a long time since I've seen DOC files used to carry a malware payload and I guess we're not used to it these days. That'll likely sail past your defences and infect anyone who opens the file.

The thing is that there are just TOO MANY ways that this can get onto your system.

If you are an admin, at the very least you should protect your own PC by deregistering the DLL and installing the unofficial patch. That means that if your organisation does get hit, at least you'll be able to coordinate some sort of response.

It seems that 'older' windows versions are not vulnerable afterall..

http://blog.ziffdavis.com/seltzer/ar.../02/39680.aspx

Quote:

---

Windows 2000, ME, and 98 are NOT vulnerable

...

They say this is based on actual testing. I have to admit that I have been taking the claims that earlier versions were affected for granted and have only been testing myself on XPSP2. Later tonight I hope to test something earlier.

---

http://www.hexblog.com/2006/01/wmf_v...y_checker.html
The nice people at hexblog have created a nice little vulnerability checker..

I ran the checker on a Windows 2000 SP4 PC and it came out as vulnerable. Also, a legacy NT4 box was also flagged as being vulnerable.

Greeting's

I have not read all the 10 pages of the thread but If this is posted before please forgive me. Anyway both Microsoft and SANS have updated their information on the exploit.

SANS advisory is now version 3 (even the unofficial patch is now updated to version 1.3)

Microsoft updated their advisory today

Here are the links

1. http://www.microsoft.com/technet/sec...ry/912840.mspx

2. http://isc.sans.org/

I feel its a must read for all members.

Wishing all of you a very happy, prosperous and SAFE new year.

Quote:

---

Originally posted here by the_JinX
It seems that 'older' windows versions are not vulnerable afterall..

http://blog.ziffdavis.com/seltzer/ar.../02/39680.aspx

http://www.hexblog.com/2006/01/wmf_v...y_checker.html
The nice people at hexblog have created a nice little vulnerability checker..

---

That isn't quite true. While only Windows XP and Server 2003 by default associate handlers with WMF files, in older systems (e.g. Windows 2000) applications may have easily associated WMF files with Windows handlers. For all we know, Microsoft Office may have done so. So it's quite possible that owners of Win2000 boxes are in danger.

FYI, MS will issue patch for this on January 10th! http://www.microsoft.com/technet/sec...ry/912840.mspx

My company is currently testing the 3rd party patch by Ilfak against our critical apps our users use. We are coding the script to first run the checker he wrote and if found vulnerable than install patch. If nothing important breaks we'll be deploying the patch and unregistering the DLL starting later today.

3rd party patch: http://www.hexblog.com/2006/01/silen...installer.html
3rd party checker: http://www.hexblog.com/2006/01/wmf_v...y_checker.html

This would not be a good time to be surfing the random Pr0N
site.

Quote:

---

Originally posted here by ric-o
FYI, MS will issue patch for this on January 10th! http://www.microsoft.com/technet/sec...ry/912840.mspx

My company is currently testing the 3rd party patch by Ilfak against our critical apps our users use. We are coding the script to first run the checker he wrote and if found vulnerable than install patch. If nothing important breaks we'll be deploying the patch and unregistering the DLL starting later today.

3rd party patch: http://www.hexblog.com/2006/01/silen...installer.html
3rd party checker: http://www.hexblog.com/2006/01/wmf_v...y_checker.html

---

Hey Hey,

Why would you both deploy the patch and unregister the DLL?? As far as I understand it ones or the other... I ran the Patch (never unregistered a DLL and I haven't found myself vulnerable to any of the tests since)..

Btw... Check out http://handlers.sans.org/tliston/WMFHotfix-1.1.14.msi

It's on the latest SANS Diary Entry... someone has released an MSI for people in corporate environments that want to push it out...

I'm actually kind of jealous.. I spent a few hours playing with WinInstall LE that came with the Server 2000 CD and it won't package files (only access against a share)... which sucked..I wasted time but learned something I guess... anyways.. now there's an MSI if you're interested.

Peace,
HT

Quote:

---

Originally posted here by HTRegz
Why would you both deploy the patch and unregister the DLL?? As far as I understand it ones or the other... I ran the Patch (never unregistered a DLL and I haven't found myself vulnerable to any of the tests since)..

---

From what SANS and couple others are saying the 3rd party patch alone may not protect you. We are testing so if we find major breakage we may just forgo the unregistering of that DLL.

Hey Hey,

Has anyone else seen this or experienced it yet...

Quote:

---

Source: http://www.viruslist.com/en/weblog?d...92530&return=1
Going back to the wmf vulnerability itself, we see number of sites mention that shimgvw.dll is the vulnerable file.
This doesn't seem correct as it's possible to exploit a system on which shimgvw.dll has been unregistered and deleted. The vulnerability seems to be in gdi32.dll.

So while unregistering shimgvw.dll may make you less vulnerable, several attack scenarios come to mind where the system can still be compromised.
It has to be noted that in this case the attack vector of web browsers seems significantly smaller than that of explorer+third party programs.

---

This is the only report of seen of it being gdi32.dll so far (that I can remember)... Everyone was initially pointing at shimgvw.dll..

Peace,
HT

Rc, might be a good idea to hide that for people looking at work or school. Some people are offended by nipples.

Quote:

---

I'm actually kind of jealous.. I spent a few hours playing with WinInstall LE

---

Group Policy is a beautiful thing. ;)

Off Topic. Tiger did you build that bar? Send me the plans it looks nice in my future play room. Right now I am building a HERMS system that will need a bar later.

Well I got totally fuxored going on vacation with no external access to my core systems. The initial scrub check doesn't show anything. I know for a fact that I have some users who make a donkey look intelligent so I have to dig deeper but 99 percent are restricted severely. How many calls do I get a week begging for access to the desktop. If you are cute you get it. wink wink. j/k.

Oh hey HT Welcome to the real world. When **** hits the fan... what do you do? As Tiger hinted and we all hear every day.... risk mitigation. If the risk is high for instance, is it worth filtering and quarantining ALL attachments for your review before users get them? I have done that in the past. Hell back in the day before snort and good virus scanners I would pull the internet right out of the wall plug. That too is an option and today outside correspondence can be granted access past gateway filtering on a case by case basis. With the click of a mouse you should be able to block all external connections save a predetermined critical list. This is a real world disaster prep scenario or lesson. What if you were on vacation? I have to struggle with my own fear of VPNs. :D

Quote:

---

Originally posted here by RoadClosed
Oh hey HT Welcome to the real world. When **** hits the fan... what do you do? As Tiger hinted and we all hear every day.... risk mitigation. If the risk is high for instance, is it worth filtering and quarantining ALL attachments for your review before users get them? I have done that in the past. Hell back in the day before snort and good virus scanners I would pull the internet right out of the wall plug. That too is an option and today outside correspondence can be granted access past gateway filtering on a case by case basis. With the click of a mouse you should be able to block all external connections save a predetermined critical list. This is a real world disaster prep scenario or lesson. What if you were on vacation? I have to struggle with my own fear of VPNs. :D

---

You make some good points... Since I'm a small company.. it's still my goal to get a linux box up and running between the router and the modem... that way I would have more control... I tried to get a small cisco 800 series but it was no go.. and the linksys I've got is one of the first released... they have had new firmware for it since 2001... basically what this means is I have no control over my network.... so killing it would be the only solution.. however it would also be my ass and my job..


On a side note... hexblog.com is down (The ISP Killed it due to the large amount of traffic). If anyone wants to fire me both the patch and the mirror it on a couple of servers and then you can feel free to pass the addresses along to mailing lists, buddies, whatever..

Another humerous thing... The Wall Street Journal Online just published an article regarding this whole WMF incident.... they are refering to it as the well known "metasploit virus"...

Peace,
HT

Mcrosoft's response (5 clicks from frontpage of microsoft.com)..

Quote:

---

Customers who follow safe browsing best practices are not likely to be compromised by any exploitation of the WMF vulnerability. Users should take care not to visit unfamiliar or un-trusted Web sites that could potentially host the malicious code.

---

I thought the Windows slogan was: Where do you want to go today?

So what can we trust..
MSN 'homepages' with user uploaded images ??

To think I had a specimen of a 'bad' wmf on my linux test box before christmas..
And couldn't find out what it was ;)

So that's been over a week, nearing on two..

I actually have a dial up modem connected to an obscure PC. That's pretty safe. But it didn't work. I have come to terms that with the necessity for 24 hours access and I will accept some risk. The other month or two I had a mail server that went unpatched for 6 hours. I sweat the ENTIRE time. But I am going to use a WAN with the VPN gateway outside the local network on it's own dedicated DSL connection. At a point where I can lock the sub-net down more than the local network and where my critical devices stay hidden like a like em.

Quote:

---

Originally posted here by HTRegz
Has anyone else seen this or experienced it yet...
This is the only report of seen of it being gdi32.dll so far (that I can remember)... Everyone was initially pointing at shimgvw.dll..

---

Hey HT:

SANS did a presentation showing how the WMF works...it shows that the shimgvw.dll calls the gdi32.dll. Check this graphic out showing this.

Also, SANS posted the presentation presentation PDF

Quote:

---

Originally posted by HTRegz
On a side note... hexblog.com is down (The ISP Killed it due to the large amount of traffic). If anyone wants to fire me both the patch and the mirror it on a couple of servers and then you can feel free to pass the addresses along to mailing lists, buddies, whatever..

---

Two website are hosting Hexblog's hotfix:
* SANS: here
* CastleCops: hotfix v1.4 and WMF exploit checker

We have tested the hotfix and green-lighted deployment of the patch...which is happening right now.

Road: There were no "plans" for the bar.... I built on the fly.... There's a picture of it up here somewhere in Addicts... look in my uploaded files.

Ok... This is what I did... The process is ongoing but it is working:-

Blocked all internet access
Blocked all attachments
Wrote teeny batch file to unreg the dll
Tested the fix - it only functions reliably on my machines when run as an admin.
Stole script from net to add domain users to admin group and place in domain startup script
Wrote whole set of instructions with pictures and attached files and uploaded to our intranet
Sent email to all staff telling them to reboot and follow instructions on intranet.
Sent similar instructions to the other admins within my network
Used my Aida32 inventory setup to verify the installation

Results:-

Within 1 hour I had 150 fixed boxes - yes I was surprised - that's 25%
Encountered issue with a couple of WinXP boxes reporting that the patch was incompatible - yet the checker indicated it worked and Aida32 indicated it was installed
Encountered on issue of the above where it would not install period with the same error
Encountered a couple of Win2K boxes with the above issue - as of yet I am unsure of the status - I will check back if anyone is interested.
Having checked Aida32 for successful install coupled with the users confirming "invulnerable" by the checker I began adding user IP's to the firewall for internet access - Yes, one by one.

So far it has gone a lot better than expected. Of course, just after I finished last night out comes the MSI.... :rolleyes: ... But that's about par for the course with this exploit.....

My mail store is HUGE so it took all night to scan. Not one blip detected. Got lucky since I wasn't available the whole time. Scanned all boxes will all known footprints... nothing. In the mean time while I was blabbing yesterday I blocked all incoming and outgoing attachments in email. OK not blocked but quarantined. You will be amazed at how many attachments are crap. IN addition internet access was blocked to all but the predefined critical list I mentioned earlier. The means about 5 sites REQUIRED for core business function. The 4661 Mcafee dat file detects this so I babysat my enterprise as all clients were forced updated and scanned. Not a thing. So I am taking no other measures at this point. I guess some of the strict internet filtering helped and some spam blocking along with restricted access to program rights. Speaking of SPAM, anyone use this? Xwall It's just another exchange filter but it works in front of exchange and is only 400 bucks per exchange server and was mentioned in a magazine I respect.

Speaking of user rights...

Quote:

---

Stole script from net to add domain users to admin group and place in domain startup script

---

That would be like opening the flood gates in my user base. :p

--------

Nice bar Tiger. :D

Source:BetaNews.com

Quote:

---

However, the patch won't be available until next week's monthly Patch Tuesday release. The company says it needs time to test the fix and prepare it in 23 different languages for all affected versions of Windows.

---

Cure comming soon ..... :p

Road: Don't think for one minute I told my users why they had to reboot before they ran the fixes.... ;-) I'll be undoing that little gem ASAP... In the long run the risk of an issue with them as a local admin outweighs the combination of them whining if they don't have net access and them fuxxoring my network if they have unpatched access to it. I call it a compromise.... :D

Compromises are good. I was hoping to find something so I could test my incident response program hot off the press. :p On a side note I did find some older viruses hiding out in my exchange store archives. Lesson, scan exchange once a week even if it hogs resources because things go undetected until accessed via on-access scanners. Looks bad. :mad:

For Watchguard Firebox users:

If you are adding individual workstations to allow internet access you can "hack" the .cfg file so that you can "mass-add" IP's.

Get your IP list as a space delimited file.
Add an outrageous IP address in the Control Center to the service you want to allow them out on and save the file.
Open .cfg in Notepad and search for the outrageous IP
Now you know the location of the allowed out IP's
make sure you leave the leading space and the trailing CR/LF(?) - it displays as a little rectangle and copy and paste your space delimited list, (there must be no CR/LF's in the list), into place and save it.
Open the .cfg file in Control Center, (the file itself not the firebox), and save the config to the Firebox....
Voila!!!!!

Hope this helps someone

Nice Tiger. Gives me some other ideas. For one encrypting the cfg file. ;)

Don't you use Websense? Click, no internet. :D

Road:

EFS does the trick

Websense.... Wanna send me two licensed copies for 600 users? Didn't think so... ;)

Quote:

---

Websense.... Wanna send me two licensed copies for 600 users? Didn't think so...

---

Ouch!

But getting a daily report of outgoing packets by catagory.. spyware... spam etc is perhaps worth some effort on the financial front but that is even more than the basic price. Have you tried P2P? J/K!