Re: [SAGE] What are you all doing about the WMF exploit?

["Richard Johnson" <rdump@river.com>]

At 10:18 +0100 on 2006-01-03, Trey Darley wrote:
> Have any of you deployed Guilfanov's patch? What do you think?


Testing hasn't revealed any side effects.  The MSI version appears to
uninstall properly, as well.

We've mandated the unofficial patch in the face of 1) ~6 hosts per day on a
/16 falling to one or more of the hundreds of exploit versions out there,
2) anti-virus firms not keeping up with the morph rate, and 3) Microsoft
not planning on releasing their official patch in a more timely manner.

If the unofficial patch causes problems, it'll be with attention focused on
it as the possible cause.  The compromises, on the other hand, will
generally be much harder to spot, let alone clean up short of a reinstall
of every one of our MS Windows boxes [1].

The unofficial patch is thus a much smaller long-term risk, and (based on
the testing) an easily tolerable immediate risk.


Richard

-------
[1] Yes, this may be necessary anyway due to all the myriad other spyware
infestations out there, but... ;-)