MS responds to “intentional backdoor”, WMF claim



Microsoft is disputing claims by Steve Gibson, that the WMF vulnerability was an intentionally placed backdoor. There is a response to the claims in the Microsoft Security Incident Response blog. Apparently since the SetAbortProc procedure relates to printing, previous versions of Windows ignored the call unless printing was involved. (Why did windows start paying attention to it otherwise?)


Among other things….

It can run into the vulnerability when converting a raw WMF to a printable EMF

Which does start to make sense in a way…. When IE opens a wmf in Windows Picture and Fax viewer (in XP/2000) it converts it from a raw WMF to a printable EMF… that explains a bit more on how this works. For details on the difficulty that Steve Gibson ran into with triggering the vulnerability…

Now, there’s been some speculation that you can only trigger this by using an incorrect size in your metafile record and that this trigger was somehow intentional. That speculation is wrong on both counts. The vulnerability can be triggered with correct or incorrect size values. If you are seeing that you can only trigger it with an incorrect value, it’s probably because your SetAbortProc record is the last record in the metafile. The way this functionality works is by registering the callback to be called after the next metafile record is played. If the SetAbortProc record is the last record in the metafile, it will be more difficult to trigger the vulnerability.

And an explanation of why the problem on Win9x is not “critical”…

The reason Windows 9x is not vulnerable to a “Critical” attack vector is because an additional step exists in the Win9x platform: When not printing to a printer, applications will simply never process the SetAbortProc record. Although the vulnerable code does exist in the Win9x platform, all “Critical” attack vectors are blocked by this additional step. The remaining attack vectors that we have identified require extensive user interaction and are not rated “Critical”. Again the “Critical” rating refers to code execution attacks that could result in automated attacks requiring little or no user interaction.

Good explanations and response to the charges from what I can see. It’s more than the response I expected from Microsoft. Frankly it’s somewhat refreshing to see them talking so candidly about a(n already patched) vulnerability and how it works.

Related Posts

Blog Traffic Exchange Related Posts
  • How to Remove APCProtect | APCProtect Removal Guide APCProtect is the latest rogue antivirus product in the wini family of rogue security sotware. It is generally pushed through sites that claim in order to view a video you need to install a video codec update or flash player update. This "update" is actually the loader for apcprotect. Once......
  • Version 2 of the WMF exploit vs Windows 98 SE Ok, I wasn't quite satisfied with the results of the tests against the first version of the WMF (Windows Metafile) zero day exploit that's now up to 4 or 5 days or so... Windows 98 is listed as being vulnerable, but there are no patches or workarounds currently available for......
  • How to Remove PCSProtector | PCSProtector Removal Guide PCSProtector is a rogue antivirus application from the winisoft family of rogues. They are essentially clones of each other and all resemble each other with the minor modification of the name of the rogue and it's files. These rogues are typically distributed by trojan horse activity as well as malware......
Blog Traffic Exchange Related Websites
  • Review of Windows Live Writer When you find a tool that makes life easier, there is nothing more exciting. The need for corporations to simplify and systematize their processes has to do with working smart and taking advantage of things that allow workers to reach their goals without having to work quite as hard. One......
  • Have Bad Credit - What Are Your Options? If your credit history is less than perfect, you may think that things like shopping online, paying for bills over the phone or even just using a card to pay for things in a shop are way out of your reach.  This isn't necessarily true. While having a low credit......
  • Microsoft Security Bulletin MS10-046 - Critical Microsoft Security Bulletin MS10-046 - Critical Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198) Published: August 02, 2010 | Updated: August 03, 2010 Version: 1.1 General Information Executive Summary This security update resolves a publicly disclosed vulnerability in Windows Shell. The vulnerability could allow remote code execution if the icon......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site