Workaround for zeroday WMF exploit



It’s worth repeating a few things here. There is a nasty exploit in the way that WMF images are parsed in Windows. This means that WITHOUT user intervention a system can be remotely exploited and through that exploit various software (spyware, viruses, other malware) can be installed. There is no patch at this moment, I don’t know of my AV vendors that detect it (f-prot seems to according to their blog posts.) There is a workaround TO PREVENT INFECTION. If the system is already infected, reinstallation may be the only solution.


The workaround is posted various places, including the Sunbelt blog and basically disables the Windows picture and fax viewer. To workaround

From the command prompt, type REGSVR32 /U SHIMGVW.DLL.

The above can be copied/pasted directly into Start…Run…

This will also impact your ability to preview some images natively within windows. It’s a fair tradeoff to secure the system against this exploit. You DON’T want it and all the baggage it brings. It sounds like it’s already been bundled into metasploit. (An exploit detection program that has good uses or bad uses… Security auditing/vulnerability exploiting can be a fine line.)

It sounds as though the number of sites utilizing this are multiplying quickly. Webmail junk messages (and probably html formatted emails in traditional mail clients may also be a vector of attack.)

Related Posts

Blog Traffic Exchange Related Posts
  • Third Party WMF patch The F-secure blog is reporting on a third party patch for the WMF exploit. I have not tested it, it seems to come from a knowledgable source though. As I'm writing this though, the thought strikes me that a really nasty trick would be a claimed fix that actually exploited......
  • Windows 98 and the WMF exploit I've seen breathless headlines that say "Windows PCs face 'huge' virus threat; Affects every MICROSOFT OS shipped since 1990..." and really would like to try to clarify (again) what the situation is. Yes, the bug or vulnerability that's currently being exploited exists as far back as Windows 3.0, but as......
  • Workaround for the critical WMF zero-day exploit The Windows Meta File (WMF) zero-day (0-day) exploit is apparently, VERY nasty, no user intervention required (unless running firefox or opera). Just VISITING a malicous site (viewing a malicious email with image...) would be enough to get the system owned. It sounds as though a FULL reinstall is the best......
Blog Traffic Exchange Related Websites
  • 7 Reader Friendly Corporate Blogs Tips You want your blog to be engaging, but that may not always be easy. Here are some great tips on how to keep your corporate blog reader friendly. 1. Pick your design well. One of the biggest problems for corporate blogs is design. You can need to make sure that......
  • Creating a Blog Carnival Although it may be entirely possible for a single person to handle all of the various requirements for when it comes to creating a Blog Carnival, it may be beneficial to create a joint effort with a handful of like minded individuals that can create and run the Blog Carnival......
  • Window Glazing Repairs If you're not ready to sink money into replacement windows but your windows are drafty and in poor shape, you can make simple window glazing repairs yourself. Also known as reglazing, this is simply the removal of the old glazing (the putty around the panes of glass) and application of......
en.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site