Windows Exploit - WMF - Aircraft of World War II

horseUSA · 12-30-2005, 01:14 PM

There is a new exploit out which affects all windows versions, and only requires viewing of an image to become infected. Please read up on this exploit and be very careful in vewing images. The F-Secure blog has some good info ( http://www.f-secure.com/weblog/ ), and windows currently has no patch released but they do have a workaround available at http://www.microsoft.com/technet/sec...ry/912840.mspx located in General Info > Suggested Actions.

Quote:

A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error in the handling of Windows Metafile files (".wmf") containing specially crafted SETABORTPROC "Escape" records. Such records allow arbitrary user-defined function to be executed when the rendering of a WMF file fails. This can be exploited to execute arbitrary code by tricking a user into opening a malicious ".wmf" file in "Windows Picture and Fax Viewer" or previewing a malicious ".wmf" file in explorer (i.e. opening a folder containing a malicious image file).

The vulnerability can also be exploited automatically when a user visits a malicious web site using Microsoft Internet Explorer.

NOTE: Exploit code is publicly available. This is being exploited in the wild. The vulnerability can also be triggered from explorer if the malicious file has been saved to a folder and renamed to other image file extensions like ".jpg", ".gif, ".tif", and ".png" etc.

The vulnerability has been confirmed on a fully patched system running Microsoft Windows XP SP2. Microsoft Windows XP SP1 and Microsoft Windows Server 2003 SP0 / SP1 are reportedly also affected. Other platforms may also be affected.

Description From http://secunia.com/advisories/18255/

Info Sites:
http://www.f-secure.com/weblog/
http://www.securityfocus.com/bid/16074
http://secunia.com/advisories/18255/

syscom3 · 12-30-2005, 01:16 PM

Funny you posted this message as I was just reading about it on yahoo.

http://news.yahoo.com/s/nf/20051229/tc_nf/40530

the lancaster kicks ass · 12-30-2005, 01:29 PM

thanks for the heads up............

Pisis · 12-30-2005, 03:12 PM

thanks for the warning horse.

the lancaster kicks ass · 01-07-2006, 01:39 PM

just checked out that site again, a patch has been released by microsoft..........

http://www.f-secure.com/weblog/archi...ve-012006.html

go down one entry to jan. 5th...........

12-30-2005, 01:16 PM	#2
syscom3 Senior Member Join Date: Jun 2005 Location: Orange County, CA Posts: 10,277	Funny you posted this message as I was just reading about it on yahoo. http://news.yahoo.com/s/nf/20051229/tc_nf/40530 __________________ "Pilot to copilot..... what are those mountain goats doing up here in the clouds?"

12-30-2005, 01:29 PM	#3
the lancaster kicks ass Senior Member Join Date: Dec 2003 Posts: 19,945	thanks for the heads up............ __________________ "Reminds me of the time I sank the Tirpitz" comments a Spitfire pilot, "One pass of course, old boy."

12-30-2005, 03:12 PM	#4
Pisis Senior Member Join Date: Nov 2004 Location: Praga Mater Urbium Posts: 5,859	thanks for the warning horse. __________________ "He's a menace to himself and everything else in the air... yes, birds too." - Airplane! Memory of Nation Why Did Hitler Want Czechoslovakia WW2 Was A War That Had To Be Fought! What Really Happened in Israel? Children of Hamas

01-07-2006, 01:39 PM	#5
the lancaster kicks ass Senior Member Join Date: Dec 2003 Posts: 19,945	just checked out that site again, a patch has been released by microsoft.......... http://www.f-secure.com/weblog/archi...ve-012006.html go down one entry to jan. 5th........... __________________ "Reminds me of the time I sank the Tirpitz" comments a Spitfire pilot, "One pass of course, old boy."

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode