MS responds to “intentional backdoor”, WMF claim



Microsoft is disputing claims by Steve Gibson, that the WMF vulnerability was an intentionally placed backdoor. There is a response to the claims in the Microsoft Security Incident Response blog. Apparently since the SetAbortProc procedure relates to printing, previous versions of Windows ignored the call unless printing was involved. (Why did windows start paying attention to it otherwise?)


Among other things….

It can run into the vulnerability when converting a raw WMF to a printable EMF

Which does start to make sense in a way…. When IE opens a wmf in Windows Picture and Fax viewer (in XP/2000) it converts it from a raw WMF to a printable EMF… that explains a bit more on how this works. For details on the difficulty that Steve Gibson ran into with triggering the vulnerability…

Now, there’s been some speculation that you can only trigger this by using an incorrect size in your metafile record and that this trigger was somehow intentional. That speculation is wrong on both counts. The vulnerability can be triggered with correct or incorrect size values. If you are seeing that you can only trigger it with an incorrect value, it’s probably because your SetAbortProc record is the last record in the metafile. The way this functionality works is by registering the callback to be called after the next metafile record is played. If the SetAbortProc record is the last record in the metafile, it will be more difficult to trigger the vulnerability.

And an explanation of why the problem on Win9x is not “critical”…

The reason Windows 9x is not vulnerable to a “Critical” attack vector is because an additional step exists in the Win9x platform: When not printing to a printer, applications will simply never process the SetAbortProc record. Although the vulnerable code does exist in the Win9x platform, all “Critical” attack vectors are blocked by this additional step. The remaining attack vectors that we have identified require extensive user interaction and are not rated “Critical”. Again the “Critical” rating refers to code execution attacks that could result in automated attacks requiring little or no user interaction.

Good explanations and response to the charges from what I can see. It’s more than the response I expected from Microsoft. Frankly it’s somewhat refreshing to see them talking so candidly about a(n already patched) vulnerability and how it works.

Related Posts

Blog Traffic Exchange Related Posts
  • WMF vulnerability not an accident? Was it an intentional backdoor? I'm not quite sure if I'm willing to attribute to design, what I could attribute to a mistake... but, slashdot has pointed out that Steve Gibson in his latest Security Now! podcast (link is to transcript), is suggesting that it appears as though the WMF vulnerability of recent weeks appears......
  • How to Remove APCProtect | APCProtect Removal Guide APCProtect is the latest rogue antivirus product in the wini family of rogue security sotware. It is generally pushed through sites that claim in order to view a video you need to install a video codec update or flash player update. This "update" is actually the loader for apcprotect. Once......
  • How to Remove PCSProtector | PCSProtector Removal Guide PCSProtector is a rogue antivirus application from the winisoft family of rogues. They are essentially clones of each other and all resemble each other with the minor modification of the name of the rogue and it's files. These rogues are typically distributed by trojan horse activity as well as malware......
Blog Traffic Exchange Related Websites
  • Microsoft reveals Six Windows 7 Editions Microsoft has announced that the upcoming Windows 7 will boast of six editions - Starter, Basic, Home Premium, Professional, Ultimate and Enterprise. But unlike Windows Vista, upgrading to a higher, more featured version will not result in loss of existing features from the lower version. Also Windows 7 is designed......
  • Review of Windows Live Writer When you find a tool that makes life easier, there is nothing more exciting. The need for corporations to simplify and systematize their processes has to do with working smart and taking advantage of things that allow workers to reach their goals without having to work quite as hard. One......
  • What is Patch Tuesday? Excellent explanation of Patch Tuesday by TMI Engineering Patch Tuesday is the second Tuesday of each month, the day on which Microsoft releases security patches. Starting with Windows 98, Microsoft included a "Windows Update" system, that would check for patches to Windows and its components which Microsoft would release intermittently. With......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site