Unpatched Windows Vulnerability

Discussion in 'NOD32 version 2 Forum' started by minceypw, Dec 28, 2005.

Thread Status:
Not open for further replies.
Page 2 of 2
  1. Howard

    Howard Registered Member

    Joined:
    Sep 3, 2004
    Posts:
    313
    Location:
    Wales, UK
    Latest news on this - as minerat's post was I believe intended to suggest - indicates the discussion about heuristics and signature detection is somewhat irrelevant at present http://isc.sans.org/diary.php?storyid=992

    In case I forget amidst this gloomy tale, a particularly happy New Year to all the folk who post at Wilders - with a special wave to the Eset crew :cool: :D
     
    Howard, Dec 31, 2005
    #26
  2. sir_carew

    sir_carew Registered Member

    Joined:
    Sep 2, 2003
    Posts:
    884
    Location:
    Santiago, Chile
    Well, as I said before, no AV detect 100%. It's human impossible.
    Anyway I sent the two WMF files to Eset.
    Thanks.
     
    sir_carew, Dec 31, 2005
    #27
  3. jlo

    jlo Registered Member

    Joined:
    Nov 29, 2004
    Posts:
    475
    Location:
    UK
    Just an update on the Windows Vulnerability.

    http://isc.sans.org/diary.php?rss&storyid=992

    A new exploit has been found which no AV detects yet (According to Internet storm Centre)

    Be Careful out there

    PS Happy 2006

    Cheers

    Jlo
     
    jlo, Dec 31, 2005
    #28
  4. johnpd

    johnpd Registered Member

    Joined:
    May 23, 2004
    Posts:
    80
    Here are some "harmless" test files for the exploit if you want to determine if NOD32 is finding it:

    http://kyeu.info/WMF/

    Please indicate what results you get in both IE and Firefox (if you use it). I received no alerts in Firefox for ".GIF" formats. The ".HTML" format just displayed a page of gibberish. The remaining gave me alerts.
     
    johnpd, Jan 2, 2006
    #29
  5. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    AVI and the rest are pretty much all the same :D

    Cheers :D
     

    Attached Files:

    • AVI.gif
      AVI.gif
      File size:
      16.2 KB
      Views:
      110
    Blackspear, Jan 2, 2006
    #30
  6. YeOldeStonecat

    YeOldeStonecat Registered Member

    Joined:
    Apr 25, 2005
    Posts:
    2,345
    Location:
    Along the Shorelines somewhere in New England
    Yup picked up that test using Opera just fine. :thumb:
     
    YeOldeStonecat, Jan 2, 2006
    #31
  7. Elwood

    Elwood Registered Member

    Joined:
    Sep 12, 2005
    Posts:
    205
    Location:
    Mis'sippi
    I got page of gibberish on the html file, the rest were detected in both Firefox 1.5 and SeaMonkey 1.0b.
     

    Attached Files:

    Elwood, Jan 2, 2006
    #32
  8. jayt

    jayt Registered Member

    Joined:
    Aug 30, 2004
    Posts:
    345
    Location:
    PA - USA
    FYI: found in another forum:

    Posted: Mon Jan 02, 2006 9:27 am
    http://www.realtechnews.com/posts/2401
    Found in anAnti-Virus Coverage for WMF Flaw Still Spotty

    AV-Test, which tests anti-malware products, has been tracking the situation closely and has, so far, analyzed 73 variants of malicious WMF files. Products from the following companies have identified all 73:

    Alwil Software (Avast), Softwin (BitDefender), ClamAV, F-Secure Inc., Fortinet Inc., McAfee Inc., ESET (Nod32), Panda Software, Sophos Plc., Symantec Corp., Trend Micro Inc., VirusBuster

    These products detected fewer variants: 62 — eTrust-VET, 62 — QuickHeal, 61 — AntiVir, 61 — Dr Web, 61 — Kaspersky, 60 — AVG, 19 — Command, 19 — F-Prot, 11 — Ewido, 7 — eSafe, 7 — eTrust-INO, 6 — Ikarus, 6 — VBA32, 0 — Norman
     
    jayt, Jan 2, 2006
    #33
  9. Jaska

    Jaska Registered Member

    Joined:
    May 7, 2004
    Posts:
    98
    In page http://multitudious.com/test.html there are 3 variants of this exploit. Nod was unable to detect 2 of them before the latest update 1.1348 today. Only BitDefender and Kaspersky found the virus, but now Nod32 has joined the group. Good work
     
    Jaska, Jan 2, 2006
    #34
  10. johnpd

    johnpd Registered Member

    Joined:
    May 23, 2004
    Posts:
    80
    I noticed that the above alert images are saying "Infiltration Detected". My alerts say "Threat Detected". Why would there be a difference?
     
    johnpd, Jan 2, 2006
    #35
  11. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    NOD32 2.5 uses the term "threat" instead of "infiltration". I'd suggest that the guy updates his NOD32 from v. 2.0 to v. 2.5
     
    Marcos, Jan 3, 2006
    #36
  12. johnpd

    johnpd Registered Member

    Joined:
    May 23, 2004
    Posts:
    80
    Has anyone tried that test site recently. My browsers now hang when trying to process the files. Has NOD32 changed something in their latest update?
     
    johnpd, Jan 4, 2006
    #37
  13. Elwood

    Elwood Registered Member

    Joined:
    Sep 12, 2005
    Posts:
    205
    Location:
    Mis'sippi
    I can't get the test files to load today, but my browsers don't "hang", there seems to be a problem connecting to the files.
     
    Elwood, Jan 4, 2006
    #38
  14. Upasaka

    Upasaka Guest

    Well I have tried these tests against my system with the patch from GRC.com,removed that and tried the NOD patch ,removed that and applied the official Microsoft update......every patch FAILS the inline plain text test on Internet Explorer.The warning message that my browser is unsafe as it is recognising MIME comes up.So my IE6 browser is still vunerable?
     
    Upasaka, Jan 6, 2006
    #39
  15. Upasaka

    Upasaka Guest


    Anybody else tried this or got any suggestions?
     
    Upasaka, Jan 7, 2006
    #40
  16. alglove

    alglove Registered Member

    Joined:
    Jan 17, 2005
    Posts:
    904
    Location:
    Houston, Texas, USA
    The "inline plain text" test does not test for the WMF/GDI32 vulnerability. What it does do is test whether Internet Explorer can be fooled into thinking that a plain text file is javascript, or some other piece of code. When I open it up with Opera, I see this, which is what is supposed to show up:
    Code:
    <html><body>
<img src="pic.wmf">
<script language="javascript">alert('If you see this, your browser is not safe. This is supposed to be a plain text file.');</script>
<!-- IF YOU CAN SEE THIS, YOUR BROWSER IS RECOGNIZING THIS FILE AS A TEXT FILE, WHICH IS GOOD! -->
</body></html>
    Internet Explorer misinterprets this piece of code. People who wanted to spread this "WMF" virus around could use this "misinterpretation" to embed and run an infected WMF file. With the patches installed, Internet Explorer still misinterprets the page, but the WMF file is now harmless.
     
    alglove, Jan 7, 2006
    #41
  17. Upasaka

    Upasaka Guest


    Thank you for that explanation:)
     
    Upasaka, Jan 7, 2006
    #42
  18. Whoknowstbh

    Whoknowstbh Guest

    Whoknowstbh, Jan 10, 2006
    #43
  19. minerat

    minerat Registered Member

    Joined:
    Oct 21, 2005
    Posts:
    14
    It's my test site, it's funny that it was reposted to here; it's really gotten around :p

    I don't know what's going on with it. I was away on vacation and sometime last week the infected WMFs stopped loading. My host says he hasn't changed anything and theplanet says that they're not doing any type of network filtering on the infected files. Very rarely I'll get the infected file to download, but that's only after wget has been going at it for a while. Fortunately it's less of a pressing concern now that an official patch is out.
     
    minerat, Jan 11, 2006
    #44
Page 2 of 2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...