Unpatched Windows Vulnerability

Discussion in 'NOD32 version 2 Forum' started by minceypw, Dec 28, 2005.

Thread Status:
Not open for further replies.
Page 2 of 2
  1. Howard

    Howard Registered Member

    Latest news on this - as minerat's post was I believe intended to suggest - indicates the discussion about heuristics and signature detection is somewhat irrelevant at present http://isc.sans.org/diary.php?storyid=992

    In case I forget amidst this gloomy tale, a particularly happy New Year to all the folk who post at Wilders - with a special wave to the Eset crew :cool: :D
     
    Howard, Dec 31, 2005
    #26
  2. sir_carew

    sir_carew Registered Member

    Well, as I said before, no AV detect 100%. It's human impossible.
    Anyway I sent the two WMF files to Eset.
    Thanks.
     
    sir_carew, Dec 31, 2005
    #27
  3. jlo

    jlo Registered Member

    Just an update on the Windows Vulnerability.

    http://isc.sans.org/diary.php?rss&storyid=992

    A new exploit has been found which no AV detects yet (According to Internet storm Centre)

    Be Careful out there

    PS Happy 2006

    Cheers

    Jlo
     
    jlo, Dec 31, 2005
    #28
  4. johnpd

    johnpd Registered Member

    Here are some "harmless" test files for the exploit if you want to determine if NOD32 is finding it:

    http://kyeu.info/WMF/

    Please indicate what results you get in both IE and Firefox (if you use it). I received no alerts in Firefox for ".GIF" formats. The ".HTML" format just displayed a page of gibberish. The remaining gave me alerts.
     
    johnpd, Jan 2, 2006
    #29
  5. Blackspear

    Blackspear Global Moderator

    AVI and the rest are pretty much all the same :D

    Cheers :D
     

    Attached Files:

    • AVI.gif
      AVI.gif
      File size:
      16.2 KB
      Views:
      110
    Blackspear, Jan 2, 2006
    #30
  6. YeOldeStonecat

    YeOldeStonecat Registered Member

    Yup picked up that test using Opera just fine. :thumb:
     
    YeOldeStonecat, Jan 2, 2006
    #31
  7. Elwood

    Elwood Registered Member

    I got page of gibberish on the html file, the rest were detected in both Firefox 1.5 and SeaMonkey 1.0b.
     

    Attached Files:

    Elwood, Jan 2, 2006
    #32
  8. jayt

    jayt Registered Member

    FYI: found in another forum:

    Posted: Mon Jan 02, 2006 9:27 am
    http://www.realtechnews.com/posts/2401
    Found in anAnti-Virus Coverage for WMF Flaw Still Spotty

    AV-Test, which tests anti-malware products, has been tracking the situation closely and has, so far, analyzed 73 variants of malicious WMF files. Products from the following companies have identified all 73:

    Alwil Software (Avast), Softwin (BitDefender), ClamAV, F-Secure Inc., Fortinet Inc., McAfee Inc., ESET (Nod32), Panda Software, Sophos Plc., Symantec Corp., Trend Micro Inc., VirusBuster

    These products detected fewer variants: 62 — eTrust-VET, 62 — QuickHeal, 61 — AntiVir, 61 — Dr Web, 61 — Kaspersky, 60 — AVG, 19 — Command, 19 — F-Prot, 11 — Ewido, 7 — eSafe, 7 — eTrust-INO, 6 — Ikarus, 6 — VBA32, 0 — Norman
     
    jayt, Jan 2, 2006
    #33
  9. Jaska

    Jaska Registered Member

    In page http://multitudious.com/test.html there are 3 variants of this exploit. Nod was unable to detect 2 of them before the latest update 1.1348 today. Only BitDefender and Kaspersky found the virus, but now Nod32 has joined the group. Good work
     
    Jaska, Jan 2, 2006
    #34
  10. johnpd

    johnpd Registered Member

    I noticed that the above alert images are saying "Infiltration Detected". My alerts say "Threat Detected". Why would there be a difference?
     
    johnpd, Jan 2, 2006
    #35
  11. Marcos

    Marcos Eset Staff Account

    NOD32 2.5 uses the term "threat" instead of "infiltration". I'd suggest that the guy updates his NOD32 from v. 2.0 to v. 2.5
     
    Marcos, Jan 3, 2006
    #36
  12. johnpd

    johnpd Registered Member

    Has anyone tried that test site recently. My browsers now hang when trying to process the files. Has NOD32 changed something in their latest update?
     
    johnpd, Jan 4, 2006
    #37
  13. Elwood

    Elwood Registered Member

    I can't get the test files to load today, but my browsers don't "hang", there seems to be a problem connecting to the files.
     
    Elwood, Jan 4, 2006
    #38
  14. Upasaka

    Upasaka Guest

    Well I have tried these tests against my system with the patch from GRC.com,removed that and tried the NOD patch ,removed that and applied the official Microsoft update......every patch FAILS the inline plain text test on Internet Explorer.The warning message that my browser is unsafe as it is recognising MIME comes up.So my IE6 browser is still vunerable?
     
    Upasaka, Jan 6, 2006
    #39
  15. Upasaka

    Upasaka Guest


    Anybody else tried this or got any suggestions?
     
    Upasaka, Jan 7, 2006
    #40
  16. alglove

    alglove Registered Member

    The "inline plain text" test does not test for the WMF/GDI32 vulnerability. What it does do is test whether Internet Explorer can be fooled into thinking that a plain text file is javascript, or some other piece of code. When I open it up with Opera, I see this, which is what is supposed to show up:
    Code:
    <html><body>
<img src="pic.wmf">
<script language="javascript">alert('If you see this, your browser is not safe. This is supposed to be a plain text file.');</script>
<!-- IF YOU CAN SEE THIS, YOUR BROWSER IS RECOGNIZING THIS FILE AS A TEXT FILE, WHICH IS GOOD! -->
</body></html>
    Internet Explorer misinterprets this piece of code. People who wanted to spread this "WMF" virus around could use this "misinterpretation" to embed and run an infected WMF file. With the patches installed, Internet Explorer still misinterprets the page, but the WMF file is now harmless.
     
    alglove, Jan 7, 2006
    #41
  17. Upasaka

    Upasaka Guest


    Thank you for that explanation:)
     
    Upasaka, Jan 7, 2006
    #42
  18. Whoknowstbh

    Whoknowstbh Guest

    Whoknowstbh, Jan 10, 2006
    #43
  19. minerat

    minerat Registered Member

    It's my test site, it's funny that it was reposted to here; it's really gotten around :p

    I don't know what's going on with it. I was away on vacation and sometime last week the infected WMFs stopped loading. My host says he hasn't changed anything and theplanet says that they're not doing any type of network filtering on the infected files. Very rarely I'll get the infected file to download, but that's only after wget has been going at it for a while. Fortunately it's less of a pressing concern now that an official patch is out.
     
    minerat, Jan 11, 2006
    #44
Page 2 of 2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice