- NANOG - lists.nanog.org

WMF Microsoft Patch is out
by Jerry Dixon 05 Jan '06

05 Jan '06

FYI all, the Microsoft Official patch is out for WMF and available via Windows Update. Cheers, Jerry

2 1

Re: WMF patch
by Eric Frazier 05 Jan '06

05 Jan '06

At 01:40 AM 1/5/2006, Thomas Kuehling wrote: >Hi Eric > >Am Mittwoch, den 04.01.2006, 08:14 -0800 schrieb Eric Frazier: > > Hi, > > > > I finally decided this was serious enough to do something about it sooner > > than the MS patch, but while this seems to be the official link to the > SANS > > patch http://isc1.sans.org/diary.php?storyid=1010 > > it also is timing out. I have seen a couple of other links from > googling to > > people who have "repackaged" this, but I really don't want to download > > something that doesn't match the SANS MD5.. > > > > Any links or suggestions? > >perhaps it is outdated, but as a workaround, it would be enough to >unregister the DLL wich handles WMF: > >on the Start menu, choose Run, type "regsvr32 -u %windir%\system32 >\shimgvw.dll", and then click OK. > >For more details, visit this link: >http://www.frsirt.com/english/advisories/2005/3086 Thanks Thomas, something really useful. One thing I am still curious about, I read that there were other image formats can be used in an exploit, GIF, .BMP, .JPG, .TIF can also be used, according to F-Secure. I find this a little confusing, if that dll only deals with WMF file type then the exploit must not be directly connected with that dll Or does that dll handle all of those as well? But then I found this http://www.pcworld.com/howto/article/0,aid,119993,00.asp Which makes sense. The way a lot of things I have been seeing go on about this they act like WMF is the only format of issue and that obviously is not at all true. I would have more likely ignored this if it really was only WMF files and the MS patch a week or so away. Thanks, Eric >Mit freundlichen GrÃ¼Ãen >Thomas KÃ¼hling > >-- >Mapsolute Gmbh - Techn. Administration - TK2325-RIPE

2 1

RE: MPLS Providers
by Rump, Bryant 05 Jan '06

05 Jan '06

That's sort of a loaded question. Some provider's offerings are good for different reasons/have different strengths. Your best fit would depend on your individual needs. How many sites will you have, and what is your access method and speed preference? Do you need granular QoS from CPE to CPE or will queuing on the access loop suffice? Prefer or require layer 2 (Martini, Kompella/Lasserre, etc.) MPLS vs. layer 3 (2547)? Do you need the service to support multicast? Does your WAN require the service to support an IGP (OSPF, RIPv2, etc.)? Do you require internet access over the same access loop? Require the provider's network to be physically separate from the public internet? Plus many more... The answers to these questions should significantly narrow your choices. Bryant Rump -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Andrew Staples Sent: Thursday, January 05, 2006 12:36 PM To: nanog(a)merit.edu Subject: MPLS Providers We're looking at purchasing MPLS services for locations nationwide. Does anyone have personal experiences they'd care to share about providers...the good, the bad, the ugly? I'm not looking for public bashing, just data to differentiate one from another. Any comments or direction appreciated. Andrew

1 0

RE: WMF patch
by Fred Heutte 05 Jan '06

05 Jan '06

More info. This seems pretty reasonable: http://castlecops.com/a6445-WMF_Exploit_FAQ.html Steve Gibson is also mirroring Guilfanov's bypass, and says Microsoft's cryptographically signed but unreleased patch is floating around the net now: http://www.grc.com/sn/notes-020.htm In my reading this is a serious vulnerability, but the self- inflating agitation in the "security community" has reached a highly annoying level. I'm in the FTDT (fix the damn thing) school; let's deal with it and get on with it. Every cycle spent moaning about the faults of Microsoft is a lost opportunity for something more productive. Back to /usr/lurk . . . regards, Fred ----------------- > >On Wed, 4 Jan 2006, Brance Amussen wrote: > >> >> Howdy, >> Here is the link to the unofficial patches creators site. >> http://www.hexblog.com/ This is the one sans links to. >> Sans seems to be having a hard day.. No Dshield mailings today either.. >> Isc.sans.org is sporadic as well.. > >According to isc.sans.org, hexblog.com was down due to bandwidth issues >earlier. See the isc.sans.org homepage for details on alternate ways to >get to it. >

5 4

Re: [ok] Re: WMF patch
by Fred Heutte 05 Jan '06

05 Jan '06

I understand the frustration Valdis has with the Microsoft situation. I've done my share of patching and updating and crawling under desks and wrestling with Exchange Server and all the rest, and fortunately (for my sanity) I'm not managing a few dozen M$ desktops anymore. My observation had more to do with the posturing of the "security" vendors (anti-virus, firewall, IDS, etc.) and the broad range of highly important experts who are all clamoring for attention on this and on all the other everyday security issues out there. There is certainly a need for security services and products and activities, but I am just not enamored of the "security mindset." This is just a part of what our job is so let's get on with it. And if we can convince the PHBs that moving off of Windows is (1) feasible, which is obvious; (2) manageable for them, which is not so clear, so much the better. I've broken my hammer pounding this particular nail, so having failed at moving management away from Windows, I moved myself away from management. Fred

3 2

Ilfak's WMF patch
by Gadi Evron 05 Jan '06

05 Jan '06

"securiTeam Blogs" posted an interview with Ilfak, the WMF patch author. He explains what it does, and why: http://blogs.securiteam.com/index.php/archives/176 Just in case some of you don't follow security sources or need another affirmation - I know Ilfak and he is trusted. He is a Good Guy. Gadi.

1 0

Re: WMF patch
by Fred Heutte 05 Jan '06

05 Jan '06

Martin Hannigan quoth: Internet security problems at large haven't even reached the break of dawn yet. Wait until every phone, toaster, baby intensive care sensor, and car is hooked up. Indeed, depending on how you look at it, Vint Cerf's formulation, "IP on everything," is either a promise or a threat. Maybe both. http://content.answers.com/main/content/img/CDE/_IPONEV.GIF http://old-www.nersc.gov/aboutnersc/presentations/future/sld061.htm OK, now I'll shut up. Fred

2 1

Re: [ok] Re: WMF patch
by Brandon Butterworth 04 Jan '06

04 Jan '06

> And if we can convince the PHBs that moving off of Windows is > (1) feasible, which is obvious; (2) manageable for them (3) they won't end up like Peter Quinn http://www.theregister.co.uk/2005/12/29/mass_odf_cio/ brandon

1 0

Large-Scale Manageability [Was: Re: [ok] Re: WMF patch]
by Fergie 04 Jan '06

04 Jan '06

A few dozen? Try >10,000. Or 20,000. Or more. Believe me -- I am glad I'm a network plumber -- I don't envy the administrative job of managing an enterpise boat-load of MS desktops -- it's a nightmare.Bbut it would perhaps be more of a nightmare if they were not MS. I've seen the scope firsthand, and I repect those folks immensely. The problems here are many, and needless to say, we shouldn't be trying to re-hash the debate on the appropriate desktop enterprise OS, etc. -- that's a dead-end. What _is_ handy is that that there nice tools available to roll out patches to each end-system in a manageable fashion. Now -- if only the patch were available... :-) And keeping users' from surfing the web and _not_ clicking on exploit web pages is an exercise left for the reader (without being a network nazi)... - ferg -- Fred Heutte <aoxomoxoa(a)sunlightdata.com> wrote: I understand the frustration Valdis has with the Microsoft situation. I've done my share of patching and updating and crawling under desks and wrestling with Exchange Server and all the rest, and fortunately (for my sanity) I'm not managing a few dozen M$ desktops anymore. My observation had more to do with the posturing of the "security" vendors (anti-virus, firewall, IDS, etc.) and the broad range of highly important experts who are all clamoring for attention on this and on all the other everyday security issues out there. There is certainly a need for security services and products and activities, but I am just not enamored of the "security mindset." This is just a part of what our job is so let's get on with it. And if we can convince the PHBs that moving off of Windows is (1) feasible, which is obvious; (2) manageable for them, which is not so clear, so much the better. I've broken my hammer pounding this particular nail, so having failed at moving management away from Windows, I moved myself away from management. Fred -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

onet.pl
by Dennis Dayman 04 Jan '06

04 Jan '06

Is anyone from onet.pl here? or does anyone have a contact? -Dennis

1 0