Bad thing

A moderated forum for more thoughtful discussion.

Moderators: pd Rydia, LadyDragonClawsEDW

User avatar
Kai
Fighting the Iron Law of Oligarchy Since 2006
 
Posts: 2408
Joined: Thu Oct 28, 2004 12:32 pm
Location: Indianapolis

Bad thing

Unread postby Kai » Tue Jan 03, 2006 8:39 pm

You guys are all heap-big computer folk, and as a result have probably already heard of this. However, in the interests of me not being a terrible person I'll duplicate my livejournal post on the subject.

Raise your hand if you run windows. Put your hand down if you want to have malignant crap running around your computer as a result of viewing images. Not downloading. Viewing. Those of you whose hands are still raised should pay attention.

http://en.wikipedia.org/wiki/2005_WMF_vulnerability

For the sake of procedure here is the patch made by Ilfak Guilfanov: http://www.hexblog.com/security/files/w ... blog14.exe

I know the hexblog site isn't working, but there's another way to get information and the patch Ilfak Guilfanov made.

http://isc.sans.org/diary.php?storyid=994

People should go there. It's the FAQ and has links to patches as well as the procedure to disable (more or less) the vulnerability that fucks you over.

Also, any of you who turn this into a "My OS is better than your OS" pissing contest, you're a prick and you aren't helping. Just a note.

Edit: In case the site currently hosting the fix also goes down, here's another.

http://sunbeltblog.blogspot.com/2006/01 ... icial.html
<p>-------------------------
"It has always been the prerogative of children and half-wits to point out that the emperor has no clothes. But the half-wit remains a half-wit and the emperor remains an emperor." -- Sandman "The Kindly Ones" </p>Edited by: [url=http://p068.ezboard.com/brpgww60462.showUserPublicProfile?gid=kai@rpgww60462>Kai</A]&nbsp; Image at: 1/3/06 22:52

User avatar
Besyanteo
Would-be GitP Bard
 
Posts: 4612
Joined: Sat Nov 09, 2002 8:56 pm
Location: Virginia

Re: Bad thing

Unread postby Besyanteo » Wed Jan 04, 2006 12:06 am

Linux doesn't have this pro- *shot*

In seriousness, I will look into this! I've lsot one hard drive recently, and would like to avoid losing the next one. Arrr. <p>
<div style="text-align:center">Image</div></p>

User avatar
Kai
Fighting the Iron Law of Oligarchy Since 2006
 
Posts: 2408
Joined: Thu Oct 28, 2004 12:32 pm
Location: Indianapolis

Re: Bad thing

Unread postby Kai » Wed Jan 04, 2006 12:15 am

Well, I just hope this is helpful, and I hope that I've found/posted enough useful information for people. I guess it's a pretty big problem and I didn't know how well-known it was. <p>-------------------------
"It has always been the prerogative of children and half-wits to point out that the emperor has no clothes. But the half-wit remains a half-wit and the emperor remains an emperor." -- Sandman "The Kindly Ones" </p>

User avatar
Zemyla
 
Posts: 1500
Joined: Tue Apr 23, 2002 11:01 am

Re: Bad thing

Unread postby Zemyla » Wed Jan 04, 2006 12:43 pm

From what I know of Windows Metafiles, they are basically a set of instructions to the Windows GDI system to draw objects in a certain pattern. This is why metafiles are small and can be dismantled (much of the clipart in Microsoft Office is metafiles; try ungrouping one of them). The vulnerability is the direct result of sending the metafile directly to the GDI; some values can result in the execution of arbitrary code. I'm just surprised I didn't see it earlier.

And this doesn't affect just Internet Explorer, but any program that uses the PlayMetafile command to display a metafile. <p>-----
Do not taunt Happy Fun Zemyla.

<span style="font-size:xx-small;">I think boobs are the lesser of two evils. - Inverse (Pervy)
Dammit, Dan, I'm not dating a damn NPC! - OOC Will (Will Baseton)
Of course! Anything worth doing is worth doing completely wrong! - Travis English
Ultimately, wizards and clerics don't say, "Gee, I want to become a lich because weapons hurt less and I don't have to worry about being backstabbed; that whole 'eternal life' thing is just a fringe benefit."-Darklion
But this one time I killed a walrus with my bare hands, and I suddenly understood spherical coordinates. - KnightsofSquare
Also, when you've worked a 36-hour shift as an intern you too just might pour yourself a catful of coffee and sit down to cuddle with your travel mug. -eirehound
</span>

Adventurers! | RPG World World | The Phantom Lord's OT Board mkII | Indie Madnesse | Brotherhood of Elitist Bastards</p>

User avatar
Kai
Fighting the Iron Law of Oligarchy Since 2006
 
Posts: 2408
Joined: Thu Oct 28, 2004 12:32 pm
Location: Indianapolis

Re: Bad thing

Unread postby Kai » Wed Jan 04, 2006 4:14 pm

You are correct, though depending on what settings people use, firefox and opera might ask permission to display it. Saying no helps sometimes, but I've also heard that sometimes it doesn't.

I really wish my stepfather were here so he could check things out and let me patch his computer. e_e <p>-------------------------
"It has always been the prerogative of children and half-wits to point out that the emperor has no clothes. But the half-wit remains a half-wit and the emperor remains an emperor." -- Sandman "The Kindly Ones" </p>


Return to Discussion Forum

Who is online

Users browsing this forum: No registered users and 5 guests

cron

Yalogank