Even with a patch in general circulation, there are still many aspects to the this vulnerability that we felt deserved some special attention. We cover the full details of the vulnerability, remediation steps, the unofficial patch, and more!
I wanted to provide some updated information about IDS and WMF. The latest Snort signatures do detect the WMF vulnerability (more specifically the escape() function call) and are provided by the bleeding snort folks. The latest rules can be found here.
There are known false positives associated with these rules and they do not detect attacks that have been gzipped. (Thank you Frank Knobbe)

For more information, check out our WMF related blog postings:
The WMF Patch Has Landed
Beating Microsoft to the punch: Ilfak Guilfanov Interview
How Bad is WMF
WMF Vulnerability & Exploits: Just The Facts
Hosts: Larry Pesce, Paul Asadoorian
Email: psw@pauldotcom.com
Audio Direct Download Link

(Bandwidth provided by OSHEAN, they’re good, like early release patches)

About the author

Paul Asadoorian is the Founder & CEO of Security Weekly, where the flagship show recently re-titled "Paul's Security Weekly" has been airing for over 8 years. By day he is the Product Evangelist for Tenable Network Security. Paul produces and hosts the various shows here at Security Weekly, all dedicated to providing the latest security news, interviews with the industries finest and technical how-to segments. Paul is also the founder and host of "The Stogie Geeks Show", featuring cigar reviews for cigar enthusiasts.

Leave a Reply