bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Linux also vulnerable to the WMF security hole through Wine

Summary

In January 2006 the WMF hole, through which manipulated image files executed code under Windows, also affected Wine, Cedega and CrossOver Office. According to HD Moore, author of the proof of concept, the complete metafile API had been recreated in Wine, including the bug. Not only Windows code but also native shellcode could be executed, and Marcus Meissner of SUSE supplied a patch.

Ideas

  • A faithful recreation of an API also takes over its design flaws.
  • An image embedded in a Word document could trigger malicious code.
  • Compatibility layers make Linux vulnerable to Windows holes.

Insights

  • Compatibility sometimes means copying bugs, deliberately or not.
  • The platform offers no protection if the application layer has the same hole.

Facts

  • Wine, Cedega and CrossOver Office were affected.
  • The patch came from Marcus Meissner (SUSE).
  • According to F-Secure, the WMF format from the 1980s explicitly provided for executable code in images.

References

Critique

  • The report is based on a forwarded email and names no affected Wine versions.

Recommendations

  • Keep Wine and environments built on it, such as Proton, as up to date as Windows.
  • Do not open documents of unknown origin with Windows programs in Wine on Linux either.

Read the original article

Search the Web Archive

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.

g · 2004

Security hole in the Linux kernel

In January 2004 Paul Starzetz reported a critical hole in the memory management of Linux kernels 2.2, 2.4 and 2.6. An insufficient check in do_mremap() made it possible to create a virtual memory area with a length of zero bytes and thus confuse memory management. Since mremap(2) requires no special privileges, any process could exploit the hole; an unpublished exploit delivered a root shell.

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.