On 1/3/06, <b class="gmail_sendername">Joachim Durchholz</b> <<a href="mailto:jo@durchholz.org">jo@durchholz.org</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Robin schrieb:<br>> On Monday 02 January 2006 17:00, Patrick R. Michaud wrote:<br>><br>>>There are literally millions of Windows systems vulnerable to this<br>>>exploit, and Microsoft has not yet provided a patch.
<br>><br>> Apparently they are providing a hotfix for this, as the next Patch Tuesday<br>> is a while away I think.<br><br>According to <a href="http://heise.de">heise.de</a>, Microsoft will include a patch with their regular
<br>update on Jan 10th.<br><br> > In the interim, Windows users should either<br>> avoid using IE (preferably for good ;)<br><br>As Chris said, this doesn't protect. Anything that shows an image is<br>vulnerable (unless it refuses to show WMF, but I'm not aware of any
<br>program that has such a policy in place).<br><br> > or do the DLL unregistering trick<br>> on that SANS page.<br><br>DLL unregistering isn't a complete safeguard, either.<br>Download Ilfak Guilfanov's patch from
<br><a href="http://isc.sans.org/diary.php?storyid=999">http://isc.sans.org/diary.php?storyid=999</a> for the best currently known<br>patch.<br><br>> Whoever thought it was a good idea to design a file format that is a
<br>> collection of GDI invocations allowing callbacks deserves to be slapped<br>> about with a wet trout anyway.<br><br>Well, it was designed at a time when viruses lived on floppy disk boot<br>sectors, and the Internet wasn't covering home computers.
<br>The *real* problem is that capability-based security still isn't the<br>norm in current-day OSes.<br><br>Regards,<br>Jo</blockquote><br>If you would like to see if your systems are vunerable then click on this link.
<a href="http://r-1.ch/test.wmf">http://r-1.ch/test.wmf</a><br><br>This is a site that was created to test the exploit. This will not infect you! You are vunerable if the Windows NT Authority box opens up and initiates the countdown. You can remove that box by clicking Start - Run and typing in 'shutdown -a'
<br><br>Currently I know that NOD32 catches it only and I think I read that Computer Associates has updated their signatures.<br></div>-- <br>Gmail shoots first