RE: WMF Vunrability
- From: "Stefaan Pouseele" <stefaan.pouseele@xxxxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 4 Jan 2006 20:24:39 +0100
Hey guys,
Check out
http://blogs.technet.com/jesper_johansson/archive/2006/01/02/416762.aspx too
;-)
HTH,
Stefaan
-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx]
Sent: woensdag 4 januari 2006 20:16
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: WMF Vunrability
http://www.ISAserver.org
Hi Tim,
I agree. There seems to be than the ususal amount of FUD associated with
this problem. :(
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
> -----Original Message-----
> From: Thor (Hammer of God) [mailto:thor@xxxxxxxxxxxxxxx]
> Sent: Wednesday, January 04, 2006 1:01 PM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] RE: WMF Vunrability
>
> http://www.ISAserver.org
>
> I wouldn't call it "program like behavior." They just contain both
> metadata and rendering data in the same file (as I understand it.)
>
> Renaming the file to something like ".gif" or ".jpg" could still cause
> execution if loaded from a file, but only if the Picture and Fax
> Viewer was the default program for those file types. From a browser,
> for WP&FV to open it and parse the data, it has to be that MIME type
> (again, as I understand
> it.)
>
> While I've read here that the "way to do it" is how GFI does it, I've
> still not seen any information on why simple content filtering won't
> work. But then again, I read where Jim is working with MSRC to come
> up with a "workable" filter. It would be nice to get some
> authoritative, detailed information on why MIME and file type
> filtering *won't* work.
>
> t
>
>
> -----
> "I may disapprove of what you say,
> but I will defend to the death your
> right to say it."
>
>
> ----- Original Message -----
> From: "Thomas W Shinder" <tshinder@xxxxxxxxxxx>
> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
> Sent: Wednesday, January 04, 2006 10:31 AM
> Subject: [isalist] RE: WMF Vunrability
>
>
> http://www.ISAserver.org
>
> Hi Tim,
>
> Don't know about that, but it's a good question. But I have to wonder
> about other apps that open the WMF files. FWIU, WMF files have some
> program like behavior that allow it to call other programs if
> something doesn't work.
>
> How's that as a erudite description for a process? :)
>
> Tom
>
> Thomas W Shinder, M.D.
> Site: www.isaserver.org
> Blog: http://spaces.msn.com/members/drisa/
> Book: http://tinyurl.com/3xqb7
> MVP -- ISA Firewalls
> **Who is John Galt?**
>
>
>
> > -----Original Message-----
> > From: Thor (Hammer of God) [mailto:thor@xxxxxxxxxxxxxxx]
> > Sent: Wednesday, January 04, 2006 12:13 PM
> > To: [ISAserver.org Discussion List]
> > Subject: [isalist] RE: WMF Vunrability
> >
> > http://www.ISAserver.org
> >
> > But if he sets a differnt mime type, Fax Viewer won't open the
> > program, right?
> >
> > t
> > -----
> > "I may disapprove of what you say,
> > but I will defend to the death your
> > right to say it."
> >
> >
> > ----- Original Message -----
> > From: "Thomas W Shinder" <tshinder@xxxxxxxxxxx>
> > To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
> > Sent: Wednesday, January 04, 2006 9:32 AM
> > Subject: [isalist] RE: WMF Vunrability
> >
> >
> > http://www.ISAserver.org
> >
> > Hi Jonathon,
> >
> > That won't work, because the scumbag can use any file name he wants.
> > Same goes with the MIME type. The MIME type is set at the Web
> > server, so the scumbag can associate any MIME type he wants.
> >
> > Tom
> >
> > Thomas W Shinder, M.D.
> > Site: www.isaserver.org
> > Blog: http://spaces.msn.com/members/drisa/
> > Book: http://tinyurl.com/3xqb7
> > MVP -- ISA Firewalls
> > **Who is John Galt?**
> >
> >
> >
> > > -----Original Message-----
> > > From: Jonathon J. Howey [mailto:Jonathon@xxxxxxx]
> > > Sent: Wednesday, January 04, 2006 11:25 AM
> > > To: [ISAserver.org Discussion List]
> > > Subject: [isalist] RE: WMF Vunrability
> > >
> > > http://www.ISAserver.org
> > >
> > > What I did to block it was:
> > >
> > > Internet Access Policy -> Protocols tab -> Filtering ->
> > Configure HTTP
> > > -> Extensions tab. Should be self explanatory from there.
> > >
> > >
> > >
> > > Jonathon J. Howey
> > > KPSA Compliance Management Inc.
> > > P 780.409.5620
> > > F 780.409.5621
> > > D 780.409.5628
> > > C 780.965.8363
> > > Jonathon@xxxxxxx
> > >
> > > Guiding the Future of Transportation www.KPSA.ca
> > >
> > >
> > >
> > > -----Original Message-----
> > > From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx]
> > > Sent: January 4, 2006 10:12 AM
> > > To: [ISAserver.org Discussion List]
> > > Subject: [isalist] RE: WMF Vunrability
> > >
> > > http://www.ISAserver.org
> > >
> > > He never stated what his "block" was.
> > >
> > >
> > > -------------------------------------------------------
> > > Jim Harrison
> > > MCP(NT4, W2K), A+, Network+, PCG
> > > http://isaserver.org/Jim_Harrison/
> > > http://isatools.org
> > > Read the help / books / articles!
> > > -------------------------------------------------------
> > >
> > >
> > > -----Original Message-----
> > > From: Brian Boyes [mailto:BrianB@xxxxxxxxx]
> > > Sent: Wednesday, January 04, 2006 09:02
> > > To: [ISAserver.org Discussion List]
> > > Subject: [isalist] RE: WMF Vunrability
> > >
> > > http://www.ISAserver.org
> > >
> > > > I have installed the "wmf" block to my ISA 2004 clients but
> > > I not sure
> > >
> > > > how to set this up for ISA 2000.
> > > > Could someone provide advice of the best way to do this.
> > >
> > > Did anyone ever post an answer? I'm curious about this
> "wmf block".
> > >
> > > Brian
> > >
Other related posts:
