Windows Exploit - WMF

[horseUSA]

There is a new exploit out which affects all windows versions, and only requires viewing of an image to become infected. Please read up on this exploit and be very careful in vewing images. The F-Secure blog has some good info ( http://www.f-secure.com/weblog/ ), and windows currently has no patch released but they do have a workaround available at http://www.microsoft.com/technet/security/advisory/912840.mspx located in General Info > Suggested Actions.

A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error in the handling of Windows Metafile files (".wmf") containing specially crafted SETABORTPROC "Escape" records. Such records allow arbitrary user-defined function to be executed when the rendering of a WMF file fails. This can be exploited to execute arbitrary code by tricking a user into opening a malicious ".wmf" file in "Windows Picture and Fax Viewer" or previewing a malicious ".wmf" file in explorer (i.e. opening a folder containing a malicious image file).

The vulnerability can also be exploited automatically when a user visits a malicious web site using Microsoft Internet Explorer.

NOTE: Exploit code is publicly available. This is being exploited in the wild. The vulnerability can also be triggered from explorer if the malicious file has been saved to a folder and renamed to other image file extensions like ".jpg", ".gif, ".tif", and ".png" etc.

The vulnerability has been confirmed on a fully patched system running Microsoft Windows XP SP2. Microsoft Windows XP SP1 and Microsoft Windows Server 2003 SP0 / SP1 are reportedly also affected. Other platforms may also be affected.

Description From http://secunia.com/advisories/18255/



Info Sites:
http://www.f-secure.com/weblog/
http://www.securityfocus.com/bid/16074
http://secunia.com/advisories/18255/

 

[syscom3]

Funny you posted this message as I was just reading about it on yahoo.

http://news.yahoo.com/s/nf/20051229/tc_nf/40530

 

[the lancaster kicks ass]

thanks for the heads up............

 

[Pisis]

thanks for the warning horse.

 

[the lancaster kicks ass]

just checked out that site again, a patch has been released by microsoft..........

http://www.f-secure.com/weblog/archives/archive-012006.html

go down one entry to jan. 5th...........

 

[Aaron Brooks Wolters]

Does it affect Firefox Mozilla users as well? I noticed it just talked about Window Explorer.

 

[evangilder]

Aaron, this is a 5 year old post that only got brought up because a spammer posted here. I am sure it has been patched by now.

 

[GrauGeist]

NO worries, Aaron...look at the thread's date...a spammer drug the thread up out of it's deep sleep...lmao

 

[Aaron Brooks Wolters]

Ooooooooooooook. I just saw it come up and ASSUMED.

 

[GrauGeist]

Woa...Eric beat me to the draw! :0

lmao @ "assumed"...no comment!

 

[vikingBerserker]

 

[evangilder]

You pointed out one of the things we mods and admins need to do, archive some of these older threads.

 

[smackers]

Lol, i recall someone bringing up an old thread from the introduction and it confused people enough to start saying welcome to the forum again