Talk:Windows Metafile vulnerability

message: "Use a safer web browser, such as Mozilla Firefox, which does not allow files to be downloaded and executed without the user's approval."
That was posted by 139.55.9.115 and quickly reverted by User:Violetriga. What was the reason for the reversion? Isn't that a possible solution? --Anthony5429 16:22, 2 January 2006 (UTC)
replies: text: No, it is not.  There isn't any known solution at this time.  See the CERT & WMF FAQ links in the external links section. --That Guy, From That Show! 16:27, 2 January 2006 (UTC)
replies: text: While Firefox might not be completely immune, it IS much safer.  When you visit an infected page, it will use its own graphics engine to display the pictures, rather than sending the data to the windows default, so it will not automatically run the bad files.  It does still download them to your cache however, so if you explore your cache folders with the pictures visible, or if you have a vulnerable indexing service running, you could still get infected, but the browser will not automatically infect you if you view a bad page.JeffStickney 01:27, 3 January 2006 (UTC)
replies: text: That's not entirely correct. The newer version of FF is safer because by default, it will not display the image and prompt you whether you want to download it. Nothing to do with graphics engine. See new comment below about why even an alternative graphics engine / image viewer would not be safe. -- KTC 02:48, 4 January 2006 (UTC)

text: Ah - okay. Thanks. Just making sure the edit had not been incorrectly reverted. --Anthony5429 16:37, 2 January 2006 (UTC)

text: While I have to admit I'm running Linux at the moment as well. Let's be fair, since this time it's not a bug from bad coding or bad design. Rather, it's a design that was right for the time it was designed in, and not the computer world we live in now. Much like TCP/IP doesn't consider much about security in its protocol, because at the time it was designed, it wasn't necessary. -- KTC 01:42, 3 January 2006 (UTC)
thread_title:  Firefox solution 

message: I have asked a question at the village pump re: wikipedia and this problem. Tristanb 04:50, 2 January 2006 (UTC)
thread_title: Wikipedia and exploit question

message: There were a couple of exploits right at the end of 2005. The second one was made public only a few days before 2006.
I'm sure the media will coin a name for this problem, i'm not sure calling it 2005 wmf vulnerability is appropriate considering it's main effect will be in 2006. But for now, I suppose it will do. Tristanb 05:00, 2 January 2006 (UTC)
replies: text: Yeah, there's a tendency with 'current events' to put a time (year, month, etc) in the title, but in this case it doesn't seem neccesary.  Why not just WMF vulnerability or something? Brendanfox 12:14, 2 January 2006 (UTC)
replies: text:  Inveterate future-proofing - "what happens if there's another WMF vulnerability?" I couldn't say whether it's necessary or not, but that's the reason. PeteVerdon 21:16, 2 January 2006 (UTC)
replies: text: Seems unlikely that there would be, given all the attention the format will now see.  Not only that, but what's wrong with having WMF vulnerability as the article that would discuss all the vulnerabilities? It's just one way to get around - what was raised above - which is that this is really taking place in 2006, although it originated in 2005.  --Brendanfox 23:37, 2 January 2006 (UTC)

text: Wouldn't Windows Metafile vulnerability be a better name? --cesarb 23:45, 2 January 2006 (UTC)
replies: text: You're right.  violet/riga (t) 23:52, 2 January 2006 (UTC)
thread_title: Naming of article

message: I don't know if this has any place in the article or not, but back in the mid-nineties I would read speculation in computer magazines that basically said, "Well, hypothetically, you COULD get a virus from a JPG because it can have embedded (if that's the word) code but the user would have to go out of his or her way to execute it, so therefore you are essentially safe with images."  Wow--what a development.  Breaky McWind 13:06, 2 January 2006 (UTC)
replies: text: This is much worse than jpg handling loopholes, like a buffer overflow.  The wmf format explicitly allows code execution.  The Windows GRE blindly does so.  It's basically a built-in payload. What's worse, you can easily hide a wmf file to look like other files, transmit it through any number of programs and code streams, but the GRE will still unwrap the payload for you. --Vector4F 17:28, 2 January 2006 (UTC)
thread_title:  Mid-nineties speculation 

message: What does this even mean? Oh, it got fixed... fruitofwisdom 16:14, 2 January 2006 (UTC)
thread_title: Parrots and Carrots

message: I use a message rule that sends anything containing an attachment to a folder labelled "suspicious", and leave the preview pane off.  If it contains an attached picture file, I won't open it by accident.JeffStickney 18:55, 2 January 2006 (UTC)
replies: text: That isn't so much a workaround as much as it is a security precaution, of the "Don't take candy from strangers" type. --Scottie theNerd 19:41, 2 January 2006 (UTC)
thread_title:  one possible email workaround 

message: Does anyone have a link that works? -- Миборовский U|T|C|E|Chugoku Banzai! 20:03, 2 January 2006 (UTC)
thread_title: That Russian guy's workaround link doesn't work

message: are the symptoms of this infection? —Preceding unsigned comment added by 66.138.18.219 (talk • contribs) 
:You're right, this isn't ever explained on the main page.  Anyone up for explaining it?  My brief version (I don't have time right now to make it perfect) is that the flaw everyone's reporting is the VECTOR for an infection.  That is to say, there's a problem in the WMF file format that allows code to be included in a WMF file which should be executed on a failure to render the image properly.  Malware writers can take advantage of this by creating a malformed WMF file, and then putting into the image file as payload any malicious program they wish.  So 1,000 different malware authors can create 1,000 different viruses/trojans/bad things.  What this means is that there is no one symptom of infection, since you could get infected with any of an infinite number of things via this one vector, the WMF file format vector. Jason t c 22:33, 2 January 2006 (UTC)
replies: text: One of the external links here has a couple of screen capture videos that show systems getting infected. Check those out. -- Миборовский U|T|C|E|Chugoku Banzai! 01:19, 3 January 2006 (UTC)
replies: text: I'm guessing the newspapers will start calling it "Computer HIV". Deltabeignet 20:57, 3 January 2006 (UTC)
thread_title: What exactly...

message: I've found two mentions of previous vulnerabilities:
*http://www.symantec.com/avcenter/security/Content/10120.html
*http://securityresponse.symantec.com/avcenter/security/Content/15352.html
violet/riga (t) 23:58, 2 January 2006 (UTC)
thread_title: Previous exploits

message: There's been editors changing back and forth the word Utilize / Utilise. To stop this from becoming a WP:LAME entry, I've reworded the sentence to avoid using the word altogether. -- KTC 04:37, 3 January 2006 (UTC)
replies: text: If I edited that, I apologize, I think I may have without thinking; I try to keep spelling variations the same ever the since the whole Iranian plane crash thing. Eightball 05:04, 3 January 2006 (UTC)
replies: text: I'm an Aussie who uses English spelling. I think that as MS are primarily a U.S. corporation we should use American spelling. - Ta bu shi da yu 06:38, 3 January 2006 (UTC)
replies: text: You could interpret the Manual of Style to support that, however, since the scope of the vulnerability goes far beyond just America that point would be rather moot; from there it's up to the spelling of the first major edit, which I do not know about. Of course you could just use what KTC has done, and what I find to be the best solution, and just rephrase the sentence or use a synonym that is the same across all variations. Eightball 06:42, 3 January 2006 (UTC)

text: Nearly all sentences utilizing utilise or utilising utilize need to be taken out and shot dead anyway. Ugh. We should ban the word(s) from wikipedia. Plain old use is much nicer. (and don't get be started on passed away, flatulated...) 24.110.60.225 07:38, 4 January 2006 (UTC)
thread_title:  Revert war on spelling 

message: The last sentence of the intro is factually incorrect.  libwmf merely converts the image contents of the WMF file.  How is it going to run the Escape record on a system without a shred of MS's API?  libwmf doesn't use Wine, AFAIK.  I instead recommend "It remains unclear which Windows emulators are vulnerable, but those emplying full copies of Microsoft Windows are probably at risk."  JeffBurdges 06:08, 3 January 2006 (UTC)
replies: text: Good edit. Ian 2k3k 02:34, 4 January 2006 (UTC)
thread_title:  libwmf 

message: As noted on <http://www.microsoft.com/technet/security/advisory/912840.mspx> a patch has been developed and slated for release by Jan 10th. I blockquoted the technet article on the wiki article. Kether83 15:16, 3 January 2006 (UTC)
replies: text: That's a long bloody time, what the hell are they playing at? - Ferret 16:20, 3 January 2006 (UTC)
replies: text: They're releasing it on their monthly patch release date. In the mean time, giving themselves a week to test & localised it for all their language versions. -- KTC 16:24, 3 January 2006 (UTC)
thread_title:  MS Patch Scheduled for Release 

message: If we explain exactly how to take advantage of this problem people are more likely to take advantage of it. Wouldn't it be smarter to just allude to how the problem is taken advantage of? Tev 17:59, 3 January 2006 (UTC)
replies: text: I don't think any "hacker" who has to learn how to exploit this from Wikipedia is much of a threat to the world.--81.179.192.191 18:12, 3 January 2006 (UTC)
replies: text: WP:BEANS! Always wanted an excuse to say that. --Sam Pointon 18:25, 3 January 2006 (UTC)
replies: text: Wikipedia contains spoilers and content you may find objectionable. Security through obscurity doesn't work. We don't actually have details of how to expolit it anyway (the technical details of actual coding), mearly what general method malware have already been employing. -- KTC 18:53, 3 January 2006 (UTC)
replies: text: I'm thinking the only real problem is the group that published code for the 2nd-gen exploit. Eightball 19:29, 3 January 2006 (UTC)
thread_title:  Is it a good idea to explain how this problem is exploited? 

message: Check out this article: http://www DOT irongeek DOT com/i.php?page=security/counterwmf (Counter WMF Exploit with the WMF Exploit) 140.168.69.166 23:36, 3 January 2006 (UTC)
replies: text: Fixed the link in the comment above. --cesarb 23:55, 3 January 2006 (UTC)

text: Warning: the link above contains code which exploits this vulnerability for the stated purpose of running the regsrv32.exe -u command. --cesarb 00:44, 4 January 2006 (UTC)
thread_title:  Interesting 'workaround' 

message: Before anyone say "it doesn't work!". I've already rewrote the article and provided a link to ISC's site where they have a copy of the patch for download (along with md5 & pgp signature so you're sure it's unmodified). -- KTC 00:21, 4 January 2006 (UTC)
thread_title:  Ilfak Guilfanov's site down 

message: Would an alternate viewer, like Nero Photosnap be a safer image viewer, or does this still hand off critical functions to windows?JeffStickney 01:17, 4 January 2006 (UTC)
replies: text: No, because even if you use a viewer that's safe (even if there is one, I have no idea), it would not protect you against exploits that deliever its payload by just having the directory containing the files open, nevermind previewing the image using Windows Image Viewer, nevermind just selecting the image in Explorer, nevermind file being index by OS, nevermind ..... -- KTC 02:27, 4 January 2006 (UTC)

text: Further to the above, the vulnerability is in gdi32.dll, along with the fact WMF is proprietary MS image format. This means if the viewer understand WMF, it's cause it's calling gdi32.dll. So an alternate viewer would still be vulnerable. This is really a Windows OS vulnerability. -- KTC 02:44, 4 January 2006 (UTC)
thread_title:  Alternate picture-viewing software? 

message: The Ilfak 3rd party hotfix you mention is reported to have a side-effect: you will not be able to print to certain GDI-based laser printers after you install the patch. The Samsung ML-1210 is mentioned. GDI-based printers are cheaper but brainless monchrome or colour laser printers, where your Windows machine does all the print rendering job, instead of on-board electronics. 195.70.32.136 11:36, 4 January 2006 (UTC)
replies: text: Source, please? With a source for that information, it can be put on the article. --cesarb 15:31, 4 January 2006 (UTC)
replies: text: Don't know a source, but from memory some GDI printers replay metafiles. Could be correct. Anyway, I agree: it needs a source. - Ta bu shi da yu 12:53, 5 January 2006 (UTC)
replies: text: Good source: http://isc.sans.org/diary.php?storyid=1018. --cesarb 23:42, 5 January 2006 (UTC)
thread_title:  Paperless office 

message: There seems to be some sort of patch available through Microsoft Update at least. Haven't got time to edit the article properly, I'm afraid; anyone?
* http://www.microsoft.com/athome/security/update/bulletins/200601_WMF.mspx
* http://www.microsoft.com/technet/security/bulletin/ms06-jan.mspx
* info from Microsoft Update (for Win2K): "Security Update for Windows 2000 (KB912919)" / "A remote code execution security issue has been identified in the Graphics Rendering Engine [...]"
-- 84.66.156.169 20:57, 5 January 2006 (UTC)
replies: text: Yep, the auto update just popped up on my PC saying something about "An exploit in the graphics rendering system that allowed a user to execute malicious code blah blah". So that's the end of that fiasco. - Ferret 06:34, 6 January 2006 (UTC)

text: Pretty much exactly the same thing as the unofficial patch did. Disable the relevent function in gdi32.dll from taking the function call. Difference is MS just replaced with a newer version of gdi32.dll, whereas the unofficial patch had to jump through hoops to inject into the (old) dll to block the call. (Ref: see ISC article) -- KTC 03:16, 7 January 2006 (UTC)
replies: text: and iirc the ms patch targetted the problem better (and therefore didn't break as much stuff) than the unofficial patch which was forced to use a dirty trick. Plugwash 03:26, 7 January 2006 (UTC)
replies: text: It's always easier to fix a problem when you have the source and can recompile. ;-) -- KTC 03:32, 7 January 2006 (UTC)
thread_title:  Patch from MS appears to have been released 

message: Hi there. I'm wondering if it would be sensible for Firefox users to use the adblock plugin to prevent the downloading and opening of WMF files in browsers. 217.205.250.130 13:52, 6 January 2006 (UTC)
replies: text: The real problem is that the files don't need the WMF extension. Windows identifies image files by content rather than by extension. That means ANY image file extension (JPG, BMP, GIF, and so on) can really be a WMF file in disguise. All the bad guy would have to do is rename whatever.wmf to whatever.jpg, and your filter would fail. Firefox itself may serve as a slight buffer as it uses a non-WMF-capable graphics engine to display, but as soon as it downloads the file and hands it off to Windows- watch out.  You would have to filter out ALL image files, not just the WMF's. Your best bet is to get the patch.JeffStickney 22:39, 6 January 2006 (UTC)
thread_title:  Usage of adblock to prevent downloading and opening of WMF files 

message: It seems to me we should also include the steps to re-register the DLL after applying the patch, and I can't remember the command off-hand, having had to look it up myself a few days ago. Sherurcij (talk) (Terrorist Wikiproject) 19:52, 6 January 2006 (UTC)
replies: text: It's the same command you use to unregister, only that you remove the -u or /u (which means "unregister"). The default action is to register. --cesarb 20:43, 6 January 2006 (UTC)
replies: text: Further, when you unregistered it, the line you typed into the "run" box was likely saved. You don't have to look it up and retype the whole thing.  Find it and edit out the "/u". JeffStickney 22:31, 6 January 2006 (UTC)
replies: text: There's a silent mode - use /s if you need to use it in a script. - Ta bu shi da yu 12:04, 15 February 2006 (UTC)
thread_title: Unregistering the DLL

message: Does anybody know if they would patch the vunerability in internet explorer 7 that is going to be released soon?69.22.224.249 22:16, 6 January 2006 (UTC)
replies: text: The vulnerability is not a browser one, but a feature (from 15 yrs ago) of the WMF format itself. It's an issue with the format which is handled by certain operating system dll's, so once you apply the patch MS has now issued, you can go back to IE4 (or before) and you wouldn't be affected (by this vulnerability). -- KTC 03:30, 7 January 2006 (UTC)
thread_title:  internet explorer 7? 

message: "The official patch supposedly works" -- This bit of the text (under Official patch) bothers me.  Has the patch not been tested?  Has it been tested and found lacking?  Is this statement just wildly NPOV, and the patch works just fine?  I don't want to correct it because I don't know that the patch actually works... -- stillnotelf has a talk page 04:13, 8 January 2006 (UTC)
replies: text: It works fine. I've changed it. -- KTC 10:53, 8 January 2006 (UTC)

text: Source please? Unless it did something else as well, the patch only disabled something that's been decaprated since Win95. If it's not a legacy system, then it deserves to malfunction! -- KTC 00:45, 10 January 2006 (UTC)
thread_title:  "The official patch supposedly works..." 

message: Another WMF attack vector?. --cesarb 22:49, 9 January 2006 (UTC)
replies: text: Can only wait and see. -- KTC 00:47, 10 January 2006 (UTC)
thread_title:  Another one? 

message: Found on Slashdot: Steve Gibson alleges that the WMF vulnerability in Windows was neither a bug, nor a feature designed without security in mind, but was actually an intentionally placed backdoor.''
* Slashdot article.
* The Windows MetaFile Backdoor? -- Security Now! episode #22 transcript.
* Discussion on grc.news.feedback relating to Security Now!, #22.
--Jakub Narebski 20:30, 13 January 2006 (UTC)
replies: text: Oh please. Get real! Is this the same Steve Gibson that was up in arms about raw sockets in Windows and how terrible they will be for the Internet? Sheesh. - Ta bu shi da yu 12:03, 15 February 2006 (UTC)
replies: text: Steve Gibson appears to have legitimate concerns about raw sockets. See raw sockets article for why the now disabled raw socket support in Windows XP was considered controversial. --Cab88 16:33, 8 December 2006 (UTC)
thread_title:  WMF Vulnerability is an Intentional Backdoor? 

message: Check http://go.microsoft.com/fwlink/?LinkId=57064 - Ta bu shi da yu 03:11, 15 February 2006 (UTC)
thread_title:  New MS bulletin 

message: This is very confusing!  The article uses the term WMF.  But the file it refers to is named gdi32.dll.  So I assume that WMF and GDI vulnerabilities are one and the same thing.  And therefore I assume that this statement:
Q: Is IrfanView affected by the MS JPEG vulnerability?
A: NO. There is no GDI+ usage in IrfanView.
Here:
http://www.irfanview.com/faq.htm
Are all discussing the same subject.  If these are indeed separate subjects, the article needs to clearly delineate and enumerate all Windows vulnerabilities related to viewing images.
At this point, I do not understand which vulnerabilities an image viewing program such as IrfanView MIGHT be subject to, so I cannot possibly figure out which ones it IS subject to -- if any.
—This unsigned comment was added by 69.87.204.60 (talk • contribs) .
:Parsing of the WMF format is implemented in gdi32.dll, but there are other "GDI (classic)" functionality in gdi32.dll.  "GDI+" (GDI Plus) is implemented in gdiplus.dll, and is what implements JPEG, PNG, and certain other higher-level functionality implemented on top of gdi32.dll -- Bovineone 18:21, 3 April 2006 (UTC)
thread_title:  WMF vs. GDI ? 

message: I don't really like the usage of "here is" and "according to this report" style citations in this article. I thought I'd post it here before changing it - some other people might have different opinions. I did find advice on not using these sorts of links on the W3C's website, click here to get there. (click here link intentional!) — Jeremy | Talk 12:15, 9 April 2006 (UTC)
thread_title:  This and Here links 

message: For these reasons :
* ...to the latest... should be changed as there is no time in encyclopedic articles.
* In Computers NOT susceptible..., the NOT shouldn't be capitalized.
* This is not NPOV : .but potentially susceptible to future versions or as-yet undiscovered exploits.
* All the inserted links should be added to the footnotes.
* The list that follows Infection may also result from: should be well-referenced or contain citations.
* This Other methods may also be used to propagate infection. is POV unless sources are given.
* Risk reduction techniques has a long list, it should instead be a nice prose.
Would need a bit of copyediting it was up for FA nom but for GA it is ok. Lincher 04:06, 9 June 2006 (UTC)
thread_title: GA failed

message: Hi. Over at the puny Windows Metafile page, the consensus of all two of us who cared was not to merge, but I'm no expert.  Incidentally, it looks like that article could use some help from some of you metafiliacs. There's way more info about the exploit than about how the metafile is supposed to work in the first place. Ojcit 06:50, 3 October 2006 (UTC)
replies: text: I agree that these articles should remain separate.  Moreoever, since these merge requests have been sitting around for a while, and the consensus seems to be to leave the status quo, I am removing the notice in both pages. --Stux 18:44, 16 December 2006 (UTC)
thread_title:  merge request 

message: the citation/refference thingies don't work in the 'accusations' section.
so there :-p --Dak (talk) 01:26, 20 October 2008 (UTC)
thread_title:  accusations refferences borked 

message: The article says that Microsoft released a patch in 2006, and Windows Vista was released in 2007, which would imply that Vista should not be affected, but the article says that “...versions from Windows XP onwards are more severely affected than earlier versions...” which clearly implies that Vista is  affected. Bwrs (talk) 23:07, 19 January 2010 (UTC)
thread_title:  Is Windows Vista affected? 

message: In my humble opinion, the sentence "The original purpose of this was mainly to handle the cancellation of print jobs during spooling" in the main article is correct.
I have memories of reading documentation in Windows 3.x days describing how to use this 'feature'. As noted, you were to use SETABORTPROC so that a large WMF file could be halted by user request. There may even have been example code testing keyboard input for an abort sequence.
I had no need/did not use this feature but I am sure I read about it when programming in the 90's.  —Preceding unsigned comment added by 131.107.0.81 (talk) 21:08, 15 June 2010 (UTC)
thread_title:  I have memories of this 

message: This article seems to contradict itself. (Permanent link to subject of discussion.)
The lead says:
Meanwhile the Affected systems section says:
Which is correct?
Fleet Command (talk) 12:38, 7 September 2011 (UTC)
thread_title:  Contradiction 

message: Hello fellow Wikipedians,
I have just modified one external link on Windows Metafile vulnerability. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20060317204854/http://blogs.zdnet.com/Ou/index.php?p=146 to http://blogs.zdnet.com/Ou/index.php?p=146
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 07:48, 17 January 2018 (UTC)
thread_title:  External links modified