1. This is not a coding mistake, but a vulnerability *by design* due to the
ability to include callback functions in the WMF file format. If there's one fundamental thing Microsoft should have learned by now, it is that data
files -- *graphics* files especially -- should not have the ability to execute code.
2. Why did it take a bunch of security bloggers to bring up the limitations
of software DEP, and over three days for this to be reflected in the
security advisory? It really looks like it took outside pressure for this
particular line item in the advisory to be modified.
A Fsecure blog entry whose url is:
http://www.f-secure.com/weblog/
notes that, Ilfak Guilfanov, a reputed world master of reverse
engineering Microsoft object code has come up with a quick fix. From
what the blog entry suggests, the fix kind of "no-op's" the miscreant
instruction sequence. Maybe Microsoft could "rebadge" it?
The language of the anti-virus industry will now have to be revised. In
addition to 0 day exploits, we will have to speak in terms of -N day
exploits where N = the number of days from the release of the exploit to
the release of the fix by the software supplier.
For these kinds of -N day exploit situations Microsoft should have an
internal reward system of, say $100,000 (I am not kidding) for the first
Microsoft engineer, admin assistant, janitor, whatever to come up with
a viable fix. It has been suggested, the loss of reputational equity of the
Microsoft brand to Microsoft AND its distribution channel partners of
each hour of delay is probably at least that much, if not more.
Hopefully, today we will see a patch of some kind from Microsoft, so we
can start off 2006 with a clean slate (in the U.S. at least, if not
Asia), of no in the wild exploits like this nasty miscreant.
I have fellow folks who have just software DEP and it did
protect...[vmware] I think what has gone on is that we have way too many
third party apps that do end runs around around programs [Irfanview for
example on a box would go around the DEP].
