More on the Windows WMF zero-day exploit



There seems to be quite a bit developing on the Windows Meta File (WMF) zero-day (0-day) exploit which was first reported yesterday. Sans has raised their alert level to yellow in an effort to get attention to this problem. It looks like the original site serving the exploit is down, but now it’s being served MANY places. Here are more details from f-secure…


Here are a list of sites to be blocked (from f-secure):

Crackz [dot] ws
unionseek [dot] com
www.tfcco [dot] com
Iframeurl [dot] biz
beehappyy [dot] biz

The bugs are currently detected as W32/PFV-Exploit.A, .B and .C Here’s another note on how nasty it is…

You can get burned even while working in a DOS box! This happened on one of our test machines where we simply used the WGET command-line tool to download a malicious WMF file. That’s it, it was enough to download the file. So how on earth did it have a chance to execute?

(Who would have thought?)

Further they suggest to disable Google Desktop indexing of image files as that seemed to be what zapped the above system….

The test machine had Google Desktop installed. It seems that Google Desktop creates an index of the metadata of all images too, and it issues an API call to the vulnerable Windows component SHIMGVW.DLL to extract this info. This is enough to invoke the exploit and infect the machine. This all happens in realtime as Google Desktop contains a file system filter and will index new files in realtime.
So, be careful out there. And disable indexing of media files (or get rid of Google Desktop) if you’re handling infected files under Windows.

Related Posts

Blog Traffic Exchange Related Posts
  • WMF exploit virus detection revisited Yesterday, when I was testing the WMF exploit against a Windows 98 virtual machine, I sent samples through virus total and the only antivirus product to detect each of them was "TheHacker" from hacksoft. This evening I was revisiting the exploit (with the new rule for metasploit) and saved 20......
  • How festive - the dasher worm... The securityfix is reporting on a new worm that exploits an older Windows vulnerability. The worm is called dasher and is in at least it's second iteration. Sans noticed an odd increase in port 1025 scans on the tenth of the month which was early activity of this worm. It......
  • More testing on the second WMF exploit After my Windows 98 tests which failed to exploit the system with either the first or the second vulnerability, I started wondering how well the antivirus companies were doing in detecting this second exploit variation. I had setup and updated metasploit so I could test my Windows 98 SE install......
Blog Traffic Exchange Related Websites
  • Google Chrome Socks Proxy Workaround If you would like to use Google Chrome at work, but are unable because you have a SOCKS proxy, you're not alone.  It is a known issue that Chrome does not work with socks.  Initially I couldn't even install Chrome because of my firewall at work.  I did install......
  • REG file parser using the Boost Spirit Parser Framework I would like to thank the people who developed the following projects - they made the implementation of this project easier: I want to say a personal thank you to Silviu Simen for his article "INI file reader using the Spirit library". There was a project in which I took......
  • Prosper Files S1 With SEC Here is a link to the Prosper S1 SEC Filing S1 From Wikipedia (here): Form S-1 is an SEC filing used by public companies to register their securities with the U.S. Securities and Exchange Commission (SEC). The S-1 contains the basic business and financial information on an issuer with respect......
en.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site