In case you've had you're head in the sand recently I'm sure you must know about the recent WMF bug found in all recent versions of Windows.
The vulnerable function is in SetAbortProc and can be called from a malicious WMF file as they include executable code by definition. Windows automatically runs this a WMF file when previewing / displaying - including from a web page!
WINE is also vulnerable, and still is. However, from a brief look at my svn repo I think ReactOS is safe. SetAbortProc is in gdi32.dll, and our version is well out of sync with WINE. I'm not sure if this is intentional (I don't know which dll's we share directly), but whoever implements this function must be very careful.
More info at: http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx
They also have a patch there so anyone running Windows on their machine is recommended to patch it immediately.
Cheers, Martin
Wine isnt anymore vulnerable to the WMF exploit, its fixed in the CVS. Next step has to be a gdi sync.
first try: http://www.winehq.org/pipermail/wine-patches/2006-January/023208.html actual patch http://www.winehq.org/pipermail/wine-patches/2006-January/023232.html potential NULL pointer dereference: http://www.winehq.org/pipermail/wine-patches/2006-January/023447.html
--- M Bealby mbealby@gmail.com a écrit :
In case you've had you're head in the sand recently I'm sure you must know about the recent WMF bug found in all recent versions of Windows.
The vulnerable function is in SetAbortProc and can be called from a malicious WMF file as they include executable code by definition. Windows automatically runs this a WMF file when previewing / displaying - including from a web page!
WINE is also vulnerable, and still is. However, from a brief look at
Kind regards, Sylvain Petreolle (aka Usurp) --- --- --- --- --- --- --- --- --- --- --- --- --- Tired of a proprietary Windows on your computer ? Use free ReactOS instead ( http://www.reactos.org )
We do not use that code afaik.
Maarten Bosma
Sylvain Petreolle wrote:
Wine isnt anymore vulnerable to the WMF exploit, its fixed in the CVS. Next step has to be a gdi sync.
first try: http://www.winehq.org/pipermail/wine-patches/2006-January/023208.html actual patch http://www.winehq.org/pipermail/wine-patches/2006-January/023232.html potential NULL pointer dereference: http://www.winehq.org/pipermail/wine-patches/2006-January/023447.html
--- M Bealby mbealby@gmail.com a écrit :
We do not have SetAbortProc implement at all. With other word it is unimplement. And it is nothing to be worry for.
----- Original Message ----- From: "Sylvain Petreolle" spetreolle@yahoo.fr To: "ReactOS Development List" ros-dev@reactos.org Sent: den 16 January 2006 15:32 Subject: RE: [ros-dev] WMF Bug / SetAbortProc
Wine isnt anymore vulnerable to the WMF exploit, its fixed in the CVS. Next step has to be a gdi sync.
first try: http://www.winehq.org/pipermail/wine-patches/2006-January/023208.html actual patch http://www.winehq.org/pipermail/wine-patches/2006-January/023232.html potential NULL pointer dereference: http://www.winehq.org/pipermail/wine-patches/2006-January/023447.html
--- M Bealby mbealby@gmail.com a écrit :
In case you've had you're head in the sand recently I'm sure you must know about the recent WMF bug found in all recent versions of Windows.
The vulnerable function is in SetAbortProc and can be called from a malicious WMF file as they include executable code by definition. Windows automatically runs this a WMF file when previewing / displaying - including from a web page!
WINE is also vulnerable, and still is. However, from a brief look at
Kind regards, Sylvain Petreolle (aka Usurp) --- --- --- --- --- --- --- --- --- --- --- --- --- Tired of a proprietary Windows on your computer ? Use free ReactOS instead ( http://www.reactos.org ) _______________________________________________ Ros-dev mailing list Ros-dev@reactos.org http://www.reactos.org/mailman/listinfo/ros-dev
-
M Bealby -
Maarten Bosma -
Magnus Olsen -
Sylvain Petreolle