THE FIX

Go download this fix an install it! NOW!

Any IMAGE file on the ENTIRE INTERNET COULD CONTAIN A VIRUS. YOUR SYSTEM IF YOU ARE RUNNING ANY WINDOWS VERSION FROM 3.0 UPWARD IS VULNERABLE (until you install said patch).

Here is the story courtesty of http://www.hexblog.com/ - thank god for independant coders *gets on his Knee's and says a prayer thanking Ilfak Guilfanov for his quick reaction.


Windows WMF Metafile Vulnerability HotFix

This week a new vulnerability was found in Windows:

http://www.microsoft.com/technet/security/advisory/912840.mspx

Browsing the web was not safe anymore, regardless of the browser. Microsoft will certainly come up with a thouroughly tested fix for it in the future, but meanwhile I developed a temporary fix - I badly needed it.

The fix does not remove any functionality from the system, all pictures will continue to be visible. You can download it here:

http://www.hexblog.com/security/files/wmffix_hexblog14.exe

It should work for Windows 2000, XP 32-bit, XP 64-bit, and Windows Server 2003.

Technical details: this is a DLL which gets injected to all processes loading user32.dll.
It patches the Escape() function in gdi32.dll. The result of the patch is that the SETABORT escape sequence is not accepted anymore.

I can imagine situations when this sequence is useful. My patch completely disables this escape sequence, so please be careful. However, with the fix installed, I can browse files, print them and do other things.

If for some reason the patch does not work for you, please uninstall it. It will be in the list of installed programs as "Windows WMF Metafile Vulnerability HotFix". I'd like to know what programs are crippled by the fix, please tell me.

I recommend you to uninstall this fix and use the official patch from Microsoft as soon as it is available.

The fix can be applied in the automatic mode using the following command line:

wmffix_hexblog14.exe /VERYSILENT /SUPPRESSMSGBOXES

These switches do not suppress dialog boxes about installation errors.
The /LOG="file" switch can be added to the command line to create a log file.

The usual software disclaimer applies...

File: wmffix_hexblog14.exe (the source code is included)

UPD: more error checking
UPD: Version 1.1 with Win2000 support
UPD: Version 1.2: if the hotfix has already been applied to the system, inform the user at the second installation attempt.
UPD: Version 1.3: added support for Windows 2000 SP4
UPD: added information about silent mode
UPD: comments are turned off to save the bandwidth. if you know how to organize discussion, please contact me.
UPD: Version 1.4: completely silent mode, suitable for use in the scripts (see this entry for more details)

There is no need to reinstall anything!
Old hotfixes are perfectly ok.

Posted by Ilfak Guilfanov on December 31, 2005 06:53 AM