Author Topic: WMF Vulnerability Avast! Official Confirmation  (Read 20177 times)

0 Members and 1 Guest are viewing this topic.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #15 on: December 30, 2005, 06:47:35 PM »
Never needed help, I guess   ;).
Welcome anyway... If you could, just come here to help the others  8)
The best things in life are free.

Offline curious!

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 531
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #16 on: December 30, 2005, 07:56:35 PM »
Tech:

"Never needed help" was of course a joke.  :)

But to be serious:
Thanks for welcome. We all need help sometimes.

For me Avast has been pretty much "set and forget" for a couple of years.

I am a bit disappointed about Avast not informing more about the serious threat
mentioned in this thread.    :'(

As you see from the thread it was much digging to find  out if this exploit was covered by Avast. I found the answer important, especially before I got the workaround from MS.

Offline EverlastingGaze

  • Full Member
  • ***
  • Posts: 161
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #17 on: December 30, 2005, 08:52:55 PM »
I have read bout this virus a few days ago and i instantly set the "webshield" with a block on wmf files.
So I guess it should be OK for now,...thank god for the webshield function!

Funny but I hardly use these kinds of files (as a graphical designer).  Some wmf files can be vectorized art,..so at work we sometimes have them when we download logo's/images from a CD-ROM.

As you see, virus/malware/spyware writers become more and more clever!
The video that Vlk set on the forum was a very good illustrator what to expect!

greetings

John

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #18 on: December 30, 2005, 09:06:22 PM »
I am a bit disappointed about Avast not informing more about the serious threat mentioned in this thread.    :'(
Why if VPS was updated and avast is protecting you...
On contrary, as you can see, with WebShield you're more protected that other antivirus that does not offer this shield of protection.
The best things in life are free.

Offline curious!

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 531
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #19 on: December 30, 2005, 10:58:22 PM »
I have read bout this virus a few days ago and i instantly set the "webshield" with a block on wmf files.



On contrary, as you can see, with WebShield you're more protected that other antivirus that does not offer this shield of protection.


That`s fine, but then it would be natural for Avast as my antivirusprovider to INFORM about this.   :-[

Webshield is ok, but URL BLOCKLIST is EMPTY by default....   >:(

Microsoft informed about wmf-files, not Avast.   :(

It is a question of information. Look at F-SECURES START PAGE ;D

I like Avast, but good things can also get better.  ;)

Hannibal Lecter

Offline Zagor

  • Sr. Member
  • ****
  • Posts: 300
  • Well, this should be good!
    • Maybe ? Design
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #20 on: December 30, 2005, 11:03:37 PM »
but good things can also get better

Agree!

Ok, block the *.wmf & unionseek.com
Been there, done it!

My question is about wildcards in the matter of unionseek.com (and for the future reference). When you put the following:
*unionseek.com*
in the WebShield URL Blocking page, does it mean that first wildcard represent just http:// or any ancestor domain, sibling domain & even ftp protocol of the unionseek.com

In other words will the WebShield block URLs that contain any text prior to name -> unionseek.com

P.S. It's obvious for the willcard after the unionseek.com though.
Zone Alarm Free         Bit Defender Free      Ad Aware Se Personal
avast!Professional      Ewido S Suite Plus      Microsoft AntiSpyware
Sys Safety Monitor       aSquared Free         Spybot Search&Destroy
Rootkit Revealer                                       Spyware Blaster

Tbird+Firefox2.0 (NoScript+AdBlockPlus+Dr.WebPreLinkScan)+ Win

Offline Sgt.Schumann

  • Jr. Member
  • **
  • Posts: 72
  • Men of the '303'
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #21 on: December 30, 2005, 11:25:42 PM »
AFAIK there are currently hundreds of servers with malicous WMF-Files out there, so a simple blocking of unionseek[dot]com would be not really effective.

Also wmf-files can be "hidden" with other image-extensions (like .jpg).

Offline Zagor

  • Sr. Member
  • ****
  • Posts: 300
  • Well, this should be good!
    • Maybe ? Design
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #22 on: December 30, 2005, 11:28:09 PM »
Yes of course,

but my interest was about the logic of Web Shield Provider, in case of future reference.

Maybe, someone from Alwil?
« Last Edit: December 30, 2005, 11:47:23 PM by Zagor »
Zone Alarm Free         Bit Defender Free      Ad Aware Se Personal
avast!Professional      Ewido S Suite Plus      Microsoft AntiSpyware
Sys Safety Monitor       aSquared Free         Spybot Search&Destroy
Rootkit Revealer                                       Spyware Blaster

Tbird+Firefox2.0 (NoScript+AdBlockPlus+Dr.WebPreLinkScan)+ Win

Offline Dwarden

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1787
  • Ideas, that's ocean without borders!
    • Bohemia Interactive
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #23 on: December 31, 2005, 12:39:09 AM »
if there is signature and detection in webshield then it should work at any type of file passing thru it ...
https://twitter.com/FoltynD , Tech. Community, Online Services & Distribution manager of Bohemia Interactive

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #24 on: December 31, 2005, 12:53:38 AM »
But my interest was about the logic of Web Shield Provider, in case of future reference.
From avast help file:
Quote
URLs to exclude: Use the Add button to enter the URL address that should be ignored. If you want to block a single page only, it is necessary to enter the full path. For example, if you add http://www.yahoo.com/index.html, only the page index.html will be excluded from scanning. If you enter http://www.yahoo.com/*, however, no pages starting with http://www.yahoo.com will be scanned. Similarly, if you do not want to scan a particular file type, e.g. files with txt extension, simply enter *.txt.


So, the * before will make all pages with the string unionseek[dot]com in the address name.
The http:// is automatically added if you start it by www but not with the *
The best things in life are free.

Offline Zagor

  • Sr. Member
  • ****
  • Posts: 300
  • Well, this should be good!
    • Maybe ? Design
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #25 on: December 31, 2005, 01:19:57 AM »
if there is signature and detection in webshield then it should work at any type of file passing thru it ...

Yes Dwarden, but what if I am the first one to experience the "pleasure" of a new variant of some wild creature from the outer-net :) due to not having the latest definition of it?

My opinion: better safe than sorry!
Zone Alarm Free         Bit Defender Free      Ad Aware Se Personal
avast!Professional      Ewido S Suite Plus      Microsoft AntiSpyware
Sys Safety Monitor       aSquared Free         Spybot Search&Destroy
Rootkit Revealer                                       Spyware Blaster

Tbird+Firefox2.0 (NoScript+AdBlockPlus+Dr.WebPreLinkScan)+ Win

Offline Zagor

  • Sr. Member
  • ****
  • Posts: 300
  • Well, this should be good!
    • Maybe ? Design
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #26 on: December 31, 2005, 01:39:15 AM »
So, the * before will make all pages with the string unionseek[dot]com in the address name.
The http:// is automatically added if you start it by www but not with the *

If I'm reading you wright,

If set to block:   <*site.com*>

It will block:    <addons.site.com>, <products.site.com>, <http://www.site.com>, ...

And what about FTP protocol? ftp://site.com, ...


Cool pic, btw ;)
Zone Alarm Free         Bit Defender Free      Ad Aware Se Personal
avast!Professional      Ewido S Suite Plus      Microsoft AntiSpyware
Sys Safety Monitor       aSquared Free         Spybot Search&Destroy
Rootkit Revealer                                       Spyware Blaster

Tbird+Firefox2.0 (NoScript+AdBlockPlus+Dr.WebPreLinkScan)+ Win

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #27 on: December 31, 2005, 02:02:05 AM »
If I'm reading you wright,
If set to block:   <*site.com*>
It will block:    <addons.site.com>, <products.site.com>, <http://www.site.com>, ...
As far I could understand, this is the behavior... Hope that someone from Alwil correct me if I'm wrong.

And what about FTP protocol? ftp://site.com, ...
No... WebShield works only with HTTP protocol (not HTTPS, POP, SMTP, UDP, TCP, FTP...).
The best things in life are free.

Offline curious!

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 531
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #28 on: December 31, 2005, 02:11:28 AM »
if there is signature and detection in webshield then it should work at any type of file passing thru it ...


if there is signature and detection in webshield then it should work at any type of file passing thru it ...

Yes Dwarden, but what if I am the first one to experience the "pleasure" of a new variant of some wild creature from the outer-net :) due to not having the latest definition of it?

My opinion: better safe than sorry!


My whole point is that url-blocking can be VERY useful in a case like this exploit.
BUT my disappoinment concerning Avast is that they not came forward with information on this, particularly in the period from the exploit was widely known till the sigs were ready.

I guess the average user is not very well oriented on this option in Avast.

Hannibal

Offline TAP

  • Sr. Member
  • ****
  • Posts: 201
  • I'm a llama!
Re: WMF Vulnerability Avast! Official Confirmation
« Reply #29 on: December 31, 2005, 02:50:59 AM »
As far as I know this .WMF exploit can be renamed to any other extensions (such as BMP, GIF, PNG, JPG, JPEG, JPE, JFIF, DIB, RLE, EMF, TIF, TIFF or ICO) and it still works so you have to make sure that Web Shield scans *every* graphic file extensions by removing the following from the exception lists

image/gif
image/png

According to Andreas Marx of AV-Test, avast! offers 100% detection for this exploit.

It's in german: http://www.heise.de/newsticker/meldung/67848

Babel Fish Translation can help you get it in english.

http://babelfish.altavista.com/


.................................................................................

Andreas's Marx von AV AV-Test a short test with 73 different copies durchgef?t, which are common in the InterNet already.

The virus scanners of Avast!, BitDefender, ClamAV, f-Secure, Fortinet, McAfee, Nod32, Panda, Sophos, Symantec, trend Micro and VirusBuster recognized thereby all 73 as safety risk and k?ten

thus an infection prevent eTrust (VET), QuickHeal, AntiVir, Dr. Web, Kaspersky and AVG nevertheless already scarcely 80% identified.

With less than 20 recognized copies the recognition achievement of COMMANDS, f-Prot, Ewido, eSafe, Ikarus and VBA32 is at present still unsatisfactory. Standard to virus scanner malfunctioned not one file in this test v?ig and criticises.
« Last Edit: December 31, 2005, 03:00:21 AM by TAP »