WMF ranjivost Windows-a + (update link)

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

SVITAC ::Da li je neko uočio kočenje ostalih aplikacija u toku skeniranja ..
nakon instalacije zakrpe za kav ?

Bane12 ::
Ne SVITAC nikakvih promena nisam osetio na oba 2 komp-a

I ovde sve radi kako treba...nema "stucanja"

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Znaci gospodo da je sve u redu i da docekamo Novu Godinu kako valja i kako treba ipak je Kav Kav.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Bane12 ::

KAV Distributer ::bobby ::

Privremeno resenje:

1. Click on the Start button on the taskbar.
2. Click on Run...
3. Type "regsvr32 /u shimgvw.dll" to disable.
4. Click ok when the change dialog appears.

Napomena: ukoliko primenite gornje resenje, vas Windows ostaje bez podrske i za JPG fajlove.



I ne samo za JPG vec ce se desiti i:

The Windows Picture and Fax Viewer will no longer be started when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer.

za koje jpg fajlove ako imas ACDSee sta ce mi onda Fax Viewer,nemoj da ovde pricamo o nekima stvarima koje malo ko koristi od Windoze???

Mislim da nisi upoznat sa situacijom. JPG je patentirana kompresija, i za njeno koriscenje u programima se placa licenca. E sada, MS je Windows isporucio sa dll-om za kompresiju i dekompresiju JPG-a, a vecina programa koriste bas taj Windowsov dll da ne bi placali licencu. Neznam za ACDSee, ali IrfanView i XnView koriste taj dll, tako da iskljucivanje jpg-a i wmf-a u Windowsu iskljucuje iste i u programima za gledanje slika.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

I evo wmf ranjivost naravno da je pocela da se zloupotrebljava kroz novogodisnje cestitke - KL tim u Holandiji je otkrio zasada lokalnu epidemiju, ali naravno da je potencijal globalan...

Evo sta pise Roel:

It was only a matter of time, the first IM-Worm exploiting the wmf vulnerability has been spotted.

We have received multiple reports from the Netherlands about an IM-Worm which spreads via MSN using a link to "http://[snip]/xmas-2006 FUNNY.jpg".
This may well turn out to become a local epidemic(in NL), however so far it has not become big.(Not even 1000 bots at this moment)

The jpg is actually an HTML page with a (link to a) malicious wmf file which is heuristically detected as Exploit.Win32.IMG-WMF by Kaspersky Anti-Virus.
This wmf will download and execute a .vbs file which is detected as Trojan-Downloader.VBS.Psyme.br which in turn will download an Sdbot. The IRCBot is detected as Backdoor.Win32.SdBot.gen by KAV.

At the time of writing this SdBot is instructed to download an IM-Worm.Win32.Kelvir variant. As you will know Kelvir is responsible for spreading across MSN.
Looking at this IRCBot it's extremely likely that it has been made for cyber criminals.

Going back to the wmf vulnerability itself, we see number of sites mention that shimgvw.dll is the vulnerable file.
This doesn't seem correct as it's possible to exploit a system on which shimgvw.dll has been unregistered and deleted. The vulnerability seems to be in gdi32.dll.

So while unregistering shimgvw.dll may make you less vulnerable, several attack scenarios come to mind where the system can still be compromised.
It has to be noted that in this case the attack vector of web browsers seems significantly smaller than that of explorer+third party programs.

I'm afraid we have to end this year with the warning to watch out for any unknown imagefile. With the flurry of e-cards and Happy New Year messages this could get really messy, so be careful.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Sistem radi bez problema prilikom scana., sinoć quarantirana tri fajla sa extenzijom WMF.

KAV Personal 5.0.388

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Bane12 ::
za koje jpg fajlove ako imas ACDSee sta ce mi onda Fax Viewer,nemoj da ovde pricamo o nekima stvarima koje malo ko koristi od Windoze???

Inače bi se iznenadio koliko ljudi koristi implementirane programe windowsa ..
Jedna od boljki su i 'thumbnails' prikazi slika u win exploreru ..

Što se tiče pomenutog kočenja .. kada sam malo detaljnije propratio problem .. ustanovio sam da je do oštećenih arhiva na kojima je kav 'kočio' ..

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

MS je najavio zvanican patch za 10. Januar.

Izvor:
http://www.eweek.com/article2/0,1895,1907568,00.asp

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

hexblog.com/2005/12/wmf_vuln.html link više se radi! Trenutni link na privremenu i nesluzbenu zakrpu te koji radi je: savefile.com/files.php?fid=9338108

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Dosada vec postoji 206 razlicitih "exploit"-a koji mogu da iskoriste pomenutu ranjivost Windows-a, a evo najnovijeg testa kako koji antivirus brani od ovoga:


Test results

AV-Test took a range of antivirus products and ran 206 malicious files that exploit the unpatched WMF flaw through them. Some of the products have holes, it turned out.

These products detected all the malicious files:

* BitDefender
* Computer Associates eTrust-VET
* F-Secure
* Kaspersky Lab
* McAfee
* Eset Nod32
* Microso OneCare
* Sophos
* Symantec

These missed just one file:

* Alwil Avast
* Clam AntiVirus
* Aladdin eSafe

These tools missed a number of samples (total in parentheses):

* Fortinet (18_)
* AntiVir (24)
* eTrust-INO (25)
* Panda (25)
* Ikarus (26)
* Norman (26)
* Ewido (47)
* AVG (59)
* VirusBuster (61)
* QuickHeal (63)
* Trend Micro (63)
* Dr Web (93)
* VBA32 (110)
* Authentium Command (119)
* F-Prot (119)

Source: AV-Test

preneto sa:
http://news.com.com/Antivirus+makers+catch+up+to+W.....18696.html

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

KAV Distributer ::Dosada vec postoji 206 razlicitih "exploit"-a koji mogu da iskoriste pomenutu ranjivost Windows-a...

Prije dva dana ih je bilo 70-ak. Brzo se širi...