WMF vulnerability (13)

1 Name: CyB3r h4xX0r g33k 2006-01-13 18:28 ID:JaQu2CqU

All right, pretty much everyone has probably heard of the Windows Metafile vulnerability by now.

Here's a new twist, though:
http://www.grc.com/sn/SN-022.htm
http://www.grc.com/x/news.exe?cmd=article&group=grc.news.feedback&item=60006

Steve Gibson claims it looks a whole lot more like an intentional backdoor than a bug. He makes a pretty good case for it.

Now, it occurs to me that the source of Win2k, which is affected by this, was leaked. If somebody had that, they could try to find the code in question, and look at what it actually does. Of course, that would be quite illegal, but it might reveal some interesting answers.

2 Name: CyB3r h4xX0r g33k 2006-01-13 19:22 ID:Heaven

this bug and the fact that it looks a lot like an intentional backdoor are old news to me... i've known about it since 1997, and i was in high school then...

3 Name: CyB3r h4xX0r g33k 2006-01-13 19:38 ID:Heaven

>>2
Ha, well, maybe you should have told someone about it then, and people wouldn't be making such a big fuss about it in the media today.

4 Name: 2 2006-01-13 19:47 ID:Heaven

>>3
if i would have told someone about it, it would have been fixed and i wouldn't be able to use it any more...

5 Name: CyB3r h4xX0r g33k 2006-01-14 01:44 ID:Heaven

>>1
The leaked Win2K code was incomplete, if I recall. Only part of the codebase.

I do have it, but after I searched the code for uses of "fuck", "shit", and "damn" and briefly skimmed a few files (didn't find anything interesting), I stopped looking at it. There may still be a torrent of the code somewhere; that's how I got it.

6 Name: CyB3r h4xX0r g33k 2006-01-14 14:30 ID:Heaven

> Starting Nmap 3.95 ( http://www.insecure.org/nmap/ ) at 2006-01-14 09:30 EST
> Interesting ports on www.grc.com (4.79.142.202):
> PORT STATE SERVICE VERSION
> 80/tcp open http Microsoft IIS webserver 5.0
> Service Info: OS: Windows
>
> Nmap finished: 1 IP address (1 host up) scanned in 7.415 seconds

lol

7 Name: CyB3r h4xX0r g33k 2006-01-16 21:14 ID:Heaven

Yeah, Steve Gibson seems to be one of those guys who are continually bashing Microsoft and even closed-source software in general, but use it anyway. From the moment I heard this story, I suspected he was just out for publicity.

8 Name: CyB3r h4xX0r g33k 2006-01-19 17:56 ID:RQ4Cv8bT

Is it really illegal to look at the Win2k source code?

9 Name: CyB3r h4xX0r g33k 2006-01-20 13:00 ID:Heaven

>>8

No, but getting a hold of it for looking at is another matter.

10 Name: CyB3r h4xX0r g33k 2006-01-20 15:46 ID:Heaven

You'd think it would have shown up on Freenet by now, or some other anonymous network.

11 Name: CyB3r h4xX0r g33k 2006-01-24 05:25 ID:vY8s70f3

>>1
It was only a small part of the Win2K code that was leaked, not the entire base. As massive as the leaked code was, it was only a tiny portion of the code base.

>>8,9
Without an NDA, MS claims it's illegal to look at the source code because doing so would cause you to violate trade secret laws. The merits and practicality of that claim are, ahem, "debatable."

>>6
IIS FIVE??? LOL, good heavens, he's just begging to be rooted! How on Earth can IIS 5 be hardened enough to match a hardened Apache, or better yet, an out-of-box thttpd?

12 Name: CyB3r h4xX0r g33k 2006-01-24 18:42 ID:Heaven

hay guys can u hack the gibson?

13 Name: CyB3r h4xX0r g33k 2006-01-24 20:12 ID:Heaven

I used to hack the gibsons quite beautifully back in high school music class... Oh, we did all the classics: Van Halen, Poison, Whitesnake, Tesla, and of course AC/DC.

This thread has been closed. You cannot post in this thread any longer.