** HEADS UP ** IE vulnerability. EXTREMELY CRITICAL.

Face it network admins...

This is a mess.... It was going to happen, without question.... This is why we get the big bucks....

Mitigate where you can.... Where you can't, fall back on ACL's, when they won't work research and find a way to give yourself the "heads up" that something went awry. If the risk assessment indicates that functionality has to be lost for certain users and not others so be it.... If you have to isolate certain computers from the network so that certain business functionality can continue then do so - need to receive images... do it on a *nix box and change the file format... The act of doing so in *nix will kill the exploit.... You know what you can do within you own network..... This isn't the time to start "flapping"... Do your job and lets fix this..... As with all the others, it will go away soon....

Quote:

---

Originally posted here by Tiger Shark

This is a mess.... It was going to happen, without question.... This is why we get the big bucks....

---

Um.... big bucks? My sister works at a call center and makes more than I do... I make just under $300 USD weekly.. but enough of the off topic posting

Quote:

---

Mitigate where you can.... Where you can't, fall back on ACL's, when they won't work research and find a way to give yourself the "heads up" that something went awry. If the risk assessment indicates that functionality has to be lost for certain users and not others so be it.... If you have to isolate certain computers from the network so that certain business functionality can continue then do so - need to receive images... do it on a *nix box and change the file format... The act of doing so in *nix will kill the exploit.... You know what you can do within you own network..... This isn't the time to start "flapping"... Do your job and lets fix this..... As with all the others, it will go away soon.... [/B]

---

For those of you that want to use the *nix ability to convert.... Use the ImageMagick convert binary... It's a fairly simple process..

convert <infected file> <new file>

I'd suggest two commands

convert infected.jpg notinfected.png
convert notinfected.png notinfected.jpg

You'll now have a clean jpg (from what I understand and what TS is saying)... Anyone know of a *nix proxy that will let you process files with external commands... It'd be fairly simple to script the proxy to execute those two commands on jpgs... and it's a fairly quick process.

Peace,
HT

I'm assuming this has nothing to do with me as my box is Windows 2000???

Eg ;)

Quote:

---

Originally posted here by Egaladeist
I'm assuming this has nothing to do with me as my box is Windows 2000???

Eg ;)

---

I'd like to hope this is a joke.... but I'm not really sure....

Please let this be a joke...

Peace,
HT

Hi HT,

Well...everything I've read on Sans and here and other places mention Windows fully patched 2003 servers and XP...but I haven't seen 2000 mentioned at all...so...I'm looking for some clarification that 2000 is not affected by this exploit???

Eg ;)

Egal:

You're joking.... Right?

Errr.... Here, read it carefully.

If you're not joking then this is why this stuff succeeds......

HT:

Correct me if I am wrong.... The *nix conversion _should_ work because the *nix will ignore the exploit code as being extraneous and the new file format would not accept it anyway.... That's my thought, I mis-spoke when I said it _will_ remove it.... It's always been my understanding that when you convert file formats "rubbish" in the new format would be dropped. Doing it in *nix would make the converting machine would be immune. Wanna test it for us? ;)

Hi TS,

Ok...

Quote:

---

nternet Explorer will view the image and trigger the exploit without warning. New versions of Firefox will prompt you before opening the image. However, in most environments this offers little protection given that these are images and are thus considered 'safe'.

* What versions of Windows are affected?

All. Windows 2000, Windows XP, (SP1 and SP2), Windows 2003. All are affected to some extent. Mac OS-X, Unix or BSD is not affected.

---

this is the first I've seen 2000 mentioned...as for internet Explorer, have it but don't use it, even my updates are automatic...now...it says Firefox will prompt before opening up the image...I never click or open anything unless I requested it...

so....given these circumstances...how vunerable am I ???

Eg ;)

Do you have the google desktop? Do you use Outlook or outlook express?

Hey Hey,

Eg: Still Vulnerable... a browser is only one attack vector... plain and simple every MS user is at risk for a high potential of harm... it's sort of frightening... The patch is prolly a good idea (if you trust third party patches)


TS: Perhaps this is more wide spread than expected? Althought dealt with a little better on the windows side.... I apparently misspoke as well.. I"m just waiting for a VirtualPC XP image to finish install so I'm playing around with stuff and I attempted to test using ImageMagick's convert. which uses wmf2eps (if you're using a .wmf file)... I got an error using the convert so I ran wmf2eps directly and got the same error...

Quote:

---

colinux:~# wmf2eps --eps -o test.eps /home/htregz/test.wmf
ERROR: player.c (463): libwmf: wmf with bizarre record size; bailing...
ERROR: player.c (464): please send it to us at http://www.wvware.com/
maximum record size = 58
record size = 2580977743

---

Looks like it notes the size and bails... there's also no option to bypass the record size... I'm gonna be around for a little bit longer so I'm gonna keep playing and see what happens.

Peace,
HT

Eg:

Keep flipping back through the ISC daily's.... There is one that says that Firefox is still vulnerable as are some other browsers IIRC.

The problem comes from the fact that most windows third party software doesn't re-invent the wheel when it doesn't have to so it uses system calls to execute code previously written, read: dll's. This is a dll issue, (actually it seems to be a multiple dll issue but there is sufficient confusion going on out there as to what is safe and what isn't that one must defer to the worst case scenario).

When I get to work tomorrow - before my users - I will script the unofficial fix and unregister the dll and send an email to all telling them to expect funny stuff and this it is what it will look like and this is what they should do. The block lists are in place, image files are blocked at the SMTP gateways, the Bleeding Snort rules are in place, (though I understand that they are "iffy" at best), and I have all fingers and toes crossed.....

Time for another beer... It's going to get me or it isn't..... I'm hoping for the latter and if the former occurs I'm hoping for a minimally malicious payload.....

Yes, I could block all internet traffic but I can't be bothered with the grief I will get..... But _one_ hit will get the users a lockdown and they have already been alerted to that fact... ;)