# Windows Exploit - WMF



## horseUSA (Dec 30, 2005)

There is a new exploit out which affects all windows versions, and only requires viewing of an image to become infected. Please read up on this exploit and be very careful in vewing images. The F-Secure blog has some good info ( http://www.f-secure.com/weblog/ ), and windows currently has no patch released but they do have a workaround available at http://www.microsoft.com/technet/security/advisory/912840.mspx located in General Info > Suggested Actions.



> A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.
> 
> The vulnerability is caused due to an error in the handling of Windows Metafile files (".wmf") containing specially crafted SETABORTPROC "Escape" records. Such records allow arbitrary user-defined function to be executed when the rendering of a WMF file fails. This can be exploited to execute arbitrary code by tricking a user into opening a malicious ".wmf" file in "Windows Picture and Fax Viewer" or previewing a malicious ".wmf" file in explorer (i.e. opening a folder containing a malicious image file).
> 
> ...


Description From http://secunia.com/advisories/18255/



Info Sites:
http://www.f-secure.com/weblog/
http://www.securityfocus.com/bid/16074
http://secunia.com/advisories/18255/


----------



## syscom3 (Dec 30, 2005)

Funny you posted this message as I was just reading about it on yahoo.

http://news.yahoo.com/s/nf/20051229/tc_nf/40530


----------



## the lancaster kicks ass (Dec 30, 2005)

thanks for the heads up............


----------



## Pisis (Dec 30, 2005)

thanks for the warning horse.


----------



## the lancaster kicks ass (Jan 7, 2006)

just checked out that site again, a patch has been released by microsoft..........

http://www.f-secure.com/weblog/archives/archive-012006.html

go down one entry to jan. 5th...........


----------



## Aaron Brooks Wolters (Nov 7, 2011)

Does it affect Firefox Mozilla users as well? I noticed it just talked about Window Explorer.


----------



## evangilder (Nov 7, 2011)

Aaron, this is a 5 year old post that only got brought up because a spammer posted here. I am sure it has been patched by now.


----------



## GrauGeist (Nov 7, 2011)

NO worries, Aaron...look at the thread's date...a spammer drug the thread up out of it's deep sleep...lmao


----------



## Aaron Brooks Wolters (Nov 7, 2011)

Ooooooooooooook. I just saw it come up and ASSUMED.


----------



## GrauGeist (Nov 7, 2011)

Woa...Eric beat me to the draw! :0

lmao @ "assumed"...no comment!


----------



## vikingBerserker (Nov 7, 2011)




----------



## evangilder (Nov 7, 2011)

You pointed out one of the things we mods and admins need to do, archive some of these older threads.


----------



## smackers (Jan 30, 2012)

Lol, i recall someone bringing up an old thread from the introduction and it confused people enough to start saying welcome to the forum again


----------

