If you’ve visited here in the last few days, you’ll have noticed that I’ve been trying to test the WMF exploit against a Windows 98 Virtual machine since January 1st. I initially started out with a default install, which didn’t work, (for the exploit), then added irfanview (didn’t work), tried the exploit as a jpg, gif, htm, doc file extension, (didn’t work) and then this morning saw that I’m not the only one that’s been testing this….
Category: Tech Support
-
WMF exploit testing on Windows 98
I had hoped to get in another test of Windows 98 with yet another WMF viewer (tried Kodak imaging, and irfanview). So far I haven’t seen a way that the WMF exploits can work on Windows 98 SE. I’m running out of time before I have to run to some computer service appointments and maybe will be able to pick up again this afternoon/evening. Larry Seltzer had a post this morning that earlier versions of Windows might not be as vulnerable because they had no default WMF viewer, but with a default WMF viewer they may be susceptible. I’m still looking for a WMF viewer that makes the exploit possible on Windows 98 SE.
-
WMF patch from Microsoft expected January 10th
The Microsoft security bulletin on the WMF vulnerability has been updated to indicate that Microsoft expects to release an update for the issue in their regular patch release on January 10th. The first couple paragraphs strike me as a bit defensive. Explaining about their immediate mobilization of Incident Response and immediate work on a patch, in addition to the explanation of extensive testing of the patch in 23 languages….
-
Moving from Evolution to Konqueror
After several weeks of good behaviour from Evolution 2.4 since the Mandriva 2006 upgrade, I started getting a wierd error on sending messages *(Mail From response Error Unknown). Nothing within my settings for Evolution had changed since the night before when things worked… I tested with Kontact and was able to send mail, closed it, opened it, bonobo-slay’ed it… still getting the error, so… since I was on the fence as to whether or not I was going to migrate to Kontact, I went ahead with it. I’ve already covered moving the calendar and contact (addressbook) information in a previous post. So this will be on moving the messages.
-
WMF unofficial patch updated
There’s been an update to the unofficial patch for the WMF (Windows MetaFile) vulnerability. The main change appears to be some options to allow for quiet installation (unattended) to help administrators in large environments try to roll the patch out in automated login scripts/etc.
It can be found here or at the incidents.org site.
-
Windows 98 and the WMF exploit
I’ve seen breathless headlines that say “Windows PCs face ‘huge’ virus threat; Affects every MICROSOFT OS shipped since 1990…” and really would like to try to clarify (again) what the situation is. Yes, the bug or vulnerability that’s currently being exploited exists as far back as Windows 3.0, but as far as I can tell there is not an active, current exploit that is taking advantage of this flaw in earlier versions of windows. Currently the exploit only seems to affect Windows 2000, XP, and Vista.
-
Version 2 of the WMF exploit vs Windows 98 SE
Ok, I wasn’t quite satisfied with the results of the tests against the first version of the WMF (Windows Metafile) zero day exploit that’s now up to 4 or 5 days or so… Windows 98 is listed as being vulnerable, but there are no patches or workarounds currently available for Windows 98 users. I was mostly curious to see if current exploits could wreck a Windows 98 system. The answer at this point is not that I can see.
-
More WMF exploit testing on Windows 98
I’ve spent some more effort on trying to infect Windows 98 SE in a virtual machine with some of the exploit samples I can find. The first attempt was at a website with the .wmf download. No luck infecting the system there. Then, I’ve loaded up the image and visited kyeu dot info/WMF/ and tried each of the files there. I don’t have a zip handler in my Windows 98 SE image so that didn’t get tested, but I’m getting nowhere here. Gif opens with Explorer and gives a red x to indicate a broken image, the text file opens as a binary file viewed in a text editor, the htm file does the same only in explorer (I see what I’d usually see if I tried to open a binary file in a web browser…) The avi opens with Media Player and complains about it being an incompatible format.
-
WMF exploit and Windows 98
Most of the talk on the WMF zero-day has centered on Windows XP, 2000 and 2003. The unofficial patch is available for those three platforms. Microsoft’s (eventual) patch will likely be for those as well. Incidents.org had a comment in one of their posts that this would be a “watershed moment” for Windows 98/ME and that those users should upgrade immediately as there is little/no hope for a patch.
-
Kdirstat to track space hogs
I’m putting this under the Windows tech support category because I’ve used this on a boot cd before to do the same for Windows as I’m about to describe for Linux. I need to clean up and organize my hard drive(s). But when it comes to actually deleting things you really do want to get the biggest bang for the buck and go after the biggest files first. I remember an old Windows 95 utility I think it was called space Hog or something like that (more space 95??) Anyway, it would scan the disc and show the files sorted by size. Under linux (KDE desktop), there’s a similar (in many ways better) utility called kdirstat.