<<< Date Index >>>     <<< Thread Index >>>

RE: WMF Exploit



All,
I think I was able to get the SAFER mechanism to block this for IE, and
any program covered under it.  I know that there are other workarounds,
but I have found the SAFER approach has stopped every one of these sorts
of attacks.  I have a vbscript that activates SAFER for IE, and various
other client apps.  Email me at this address if you want me to send it
out to anyone.

Thanks!

> -----Original Message-----
> From: Bill Busby [mailto:williambusby2001@xxxxxxxxx] 
> Sent: Thursday, December 29, 2005 1:35 PM
> To: Hayes, Bill; davidribyrne@xxxxxxxxx
> Cc: bugtraq@xxxxxxxxxxxxxxxxx
> Subject: RE: WMF Exploit
> 
> 
> It is not only *.wmf extensions it is all files that
> have windows metafile headers that will open with the
> Windows Picture and Fax Viewer.  Any file that has the
> header of a windows metafile can trigger this exploit.
> 
> --- "Hayes, Bill" <Bill.Hayes@xxxxxxx> wrote:
> 
> > CERT now has posted Vulnerability Note VU#181038,
> > "Microsoft Windows may
> > be vulnerable to buffer overflow via specially
> > crafted WMF file"
> > (http://www.kb.cert.org/vuls/id/181038). The note
> > provides additional
> > details about the exploit and its effects. Very few workarounds have
> > been proposed other than blocking at the perimeter
> > and possibly
> > remapping the .wmf extension to some application
> > other than the
> > vulnerable Windows Picture and Fax Viewer
> > (SHIMGVU.DLL).
> > 
> > Bill...
> > 
> > -----Original Message-----
> > From: davidribyrne@xxxxxxxxx
> > [mailto:davidribyrne@xxxxxxxxx]
> > Sent: Wednesday, December 28, 2005 4:18 PM
> > To: bugtraq@xxxxxxxxxxxxxxxxx
> > Subject: WMF Exploit
> > 
> > 
> > Another quick observation, again, I apologize if
> > this information has
> > already been posted; I haven't been able to read all
> > the posts today.
> > The thumbnail view in Windows Explorer will parse
> > the graphics files in
> > a folder, even if the file is never explicitly
> > opened. This is enough to
> > trigger the exploit. Even more frightening is that
> > you don't have to use
> > the thumbnail view for a thumbnail to be generated.
> > Under some
> > circumstances, just single-clicking on the file will
> > cause it to be
> > parsed.
> > 
> > David Byrne
> > 
> 
> 
> 
>       
>               
> __________________________________ 
> Yahoo! for Good - Make a difference this year. 
> http://brand.yahoo.com/cybergivingweek2005/
>