Posted on 01/03/2006 11:42:23 AM PST by HAL9000
Just a suggestion, but 64 bit computers, like the AMD64 are not vulnerable, assuming you have XP SP2.
I was thinking, well, it's still safe to go to FreeRepublic, they're only text. Then I realized anyone can link to any image here.
Perhaps we should disable this feature for now?
See phrack #62 for details.
At least we don't still have the Clinton DOJ going after Microsoft while ignoring terrorists.
I'm a Mac user, so I can be smug. Perhaps you should join me :-).
Other than buying a Macintosh or Linux-based computer, I think I would simply turn off images in my browser when viewing FR.
D
Someone else posted this fix from GRC:
There's also a third party fix but I'm leery about using it.
http://www.grc.com/sn/notes-020.htm
UNTIL THIS IS REPAIRED BY MICROSOFT, ANY ATTEMPT
TO DISPLAY A MALICIOUS IMAGE IN WINDOWS COULD
INSTALL MALICIOUS SOFTWARE INTO THE COMPUTER.
This is a so-called "0-day vulnerability" because exploits for the vulnerability appeared before any updates or patches were available.
Although NOT a complete solution, Microsoft has recommended temporarily disabling the automatic display of some images by the operating system and web browser. This can be done, as detailed below, by "unregistering" the "SHIMGVW.DLL" Windows DLL. THIS IS NOT A COMPLETE SOLUTION, but it significantly lowers the risk from this vulnerability from web surfing.
For Windows 2000, XP, 64-bit XP and 2003 server
The temporary patch described above is a FAR superior
solution. ONLY use the de-registration approach below if
you are unable to use Ilfak's temporary patch.
Do not open any "WMF" Windows Metafiles you receive by eMail, and reports are that other file types may also be dangerous.
Anti-virus companies have responded to this, so update your anti-virus signature files for updated protection.
You should IMMEDIATELY disable Windows' use of this
vulnerable DLL until patches from Microsoft are available.
Note that this WILL temporarily disable the "Thumbnail" view
in Windows Explorer and Window's Image and FAX viewer. This is
by design, since these viewers are no longer safe to use until a
non-vulnerable file has been produced by Microsoft and installed.
To immediately disable the vulnerable Windows component:
1) Logon as a user with full administrative rights.
2) Click the Windows "Start" button and select "Run..."
3) Enter the following string into the "Open" field:
regsvr32 -u shimgvw.dll
(You can copy/paste from this page using Ctrl-C/Ctrl-V)
4) Click "OK" to unregister the vulnerable DLL.
If all goes well, you will receive a confirmation prompt, and your system is now safe. No need to reboot, but you might want to just to be sure that any possible currently loaded instance is flushed out.
To eventually re-enable the "SHIMGVW.DLL" component:
Logon as a user with full administrative rights.
Click the Windows "Start" button and select "Run..."
Enter the following string into the "Open" field:
1) regsvr32 shimgvw.dll
(You can copy/paste from this page using Ctrl-C/Ctrl-V)
Same as the one above, but no "-u" for "uninstall".
Click "OK" to re-register the (hopefully) non-vulnerable DLL.
As of last night, I put on my RED HAT, went ROOT, and tipped my FEDORA and left the windows world far behind.
Life is nice.
I disagree. FreeRepublic is already doing it's part to improve security by running on a Linux server. Microsoft is responsible for getting Windows fixed. Good luck to all of the Microsoft customers.
I installed the patch from GRC's recommendation on my XP machines a few days ago, and unregistered the DLL on my W2K machines, and have had no problems thus far.
I tend to trust Gibson fairly well.
I used that temp patch yesterday, and it is now showing my pc has no apparent vunerability.
Gibson (at GRC) is a very reliable source. He developed one of the early programs to 'set' hard drive parameters. He's an ancient sage -- in Internet years. lol.
|
|
|||||
|
Search Microsoft.com for: |
|
Microsoft Security Advisory (912840)Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution.Published: December 28, 2005 | Updated: January 3, 2006
On Tuesday, December 27, 2005, Microsoft became aware of public reports of malicious attacks on some customers involving a previously unknown security vulnerability in the Windows Meta File (WMF) code area in the Windows platform. Upon learning of the attacks, Microsoft mobilized under its Software Security Incident Response Process (SSIRP) to analyze the attack, assess its scope, define an engineering plan, and determine the appropriate guidance for customers, as well as to engage with anti-virus partners and law enforcement. Microsoft confirmed the technical details of the attack on December 28, 2005 and immediately began developing a security update for the WMF vulnerability on an expedited track. Microsoft has completed development of the security update for the vulnerability. The security update is now being localized and tested to ensure quality and application compatibility. Microsoft’s goal is to release the update on Tuesday, January 10, 2006, as part of its monthly release of security bulletins. This release is predicated on successful completion of quality testing. The update will be released worldwide simultaneously in 23 languages for all affected versions of Windows once it passes a series of rigorous testing procedures. It will be available on Microsoft’s Download Center, as well as through Microsoft Update and Windows Update. Customers who use Windows’ Automatic Updates feature will be delivered the fix automatically. Based on strong customer feedback, all Microsoft’s security updates must pass a series of quality tests, including testing by third parties, to assure customers that they can be deployed effectively in all languages and for all versions of the Windows platform with minimum down time. Microsoft has been carefully monitoring the attempted exploitation of the WMF vulnerability since it became public last week, through its own forensic capabilities and through partnerships within the industry and law enforcement. Although the issue is serious and malicious attacks are being attempted, Microsoft’s intelligence sources indicate that the scope of the attacks are not widespread. In addition, anti-virus companies indicate that attacks based on exploiting the WMF vulnerability are being effectively mitigated through up-to-date signatures. Customers are encouraged to keep their anti-virus software up-to-date. The Microsoft Windows AntiSpyware (Beta) can also help protect your system from spyware and other potentially unwanted software. Customers can also visit Windows Live Safety Center and are encouraged to use the Complete Scan option to check for and remove malicious software that takes advantage of this vulnerability. We will continue to investigate these public reports. If you are a Windows OneCare user and your current status is green, you are already protected from known malware that uses this vulnerability to attempt to attack systems. Customers who follow safe browsing best practices are not likely to be compromised by any exploitation of the WMF vulnerability. Users should take care not to visit unfamiliar or un-trusted Web sites that could potentially host the malicious code. Microsoft encourages users to exercise caution when they open e-mail and links in e-mail from untrusted sources. While we have not encountered any situation in which simply opening an email can result in attack, clicking on a link in an email could result in navigation to a malicious site. For more information about Safe Browsing, visit the Trustworthy Computing Web site. Microsoft considers the intentional use of exploit code, in any form, to cause damage to computer users to be a criminal offense. Accordingly, we continue to work closely with our anti-virus partners and we are assisting law enforcement with its investigation of the attacks in this case. Customers who believe they have been attacked should contact their local FBI office or post their complaint on the Internet Fraud Complaint Center Web site. Customers outside the U.S. should contact the national law enforcement agency in their country. We continue to encourage customers to follow our Protect Your PC guidance of enabling a firewall, applying software updates and installing antivirus software. Customers can learn more about these steps at the Protect Your PC Web site. The Microsoft Windows AntiSpyware (Beta) can also help protect your system from spyware and other potentially unwanted software. Customers who believe they may have been affected by this issue can also contact Product Support Services. You can contact Product Support Services in the United States and Canada at no charge using the PC Safety line (1 866-PCSAFETY). Customers outside of the United States and Canada can locate the number for no-charge virus support by visiting the Microsoft Help and Support Web site. Mitigating Factors:
General InformationResources:
Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. Revisions:
|
So all will be fine on the 10th...till then be careful..
Excellent timing Gator!
Hey Ernie,
Publishing a novel in a thread is not considered wholesome.
Putting in a link to a page off the side, now that's considerate.
I wanted to catch the fullness of the MS arrongance before they pulled it from their website.......
His shields up is very cool as well.
""It's a problem that there's no known solution from Microsoft," said Alfred Huger, senior director of engineering at Symantec Corp.'s (SYMC) security response team."
But, But ... I thought Symantec's Internet Security was supposed to keep me safe ....
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.