NEW exploit for the WMF vulnerability



Just when you thought we had a good understanding of the recent zero-day WMF (Windows metafile exploit) it’s worse. Sans is reporting on a new variation on the exploit released today. They have gone to yellow (again) to warn people. Here are some details. This exploit was “made by the folks at metasploit and xfocus, together with a anonymous source.”


From SANS

The exploit generates files:

with a random size;
no .wmf extension, (.jpg), but could be any other image extension actually;
a random piece of junk in front of the bad call; carefully crafted to be larger than the MTU on an ethernet network;
a number of possible calls to run the exploit are listed in the source;
a random trailer

What makes it worse is that current IDS rules will likely not stop this new variation. Nor will current antivirus signatures. Also….

Judging from the source code, it will likely be difficult to develop very effective signatures due to the structures of the WMF files.

They suggested re-evaluating any defences against the bug and also mention the unofficial patch at http://www.hexblog.com/2005/12/wmf_vuln.html that I mentioned earlier today.

So in other words batten down the hatches it’s going to be a rocky start to the year in Computer security. Good luck.

–update 7PM EST–
The Security Fix has some coverage as well.

Related Posts

Blog Traffic Exchange Related Posts
  • Network security - how safe is your network? Looking at ARP A while back I did a network security series and one of the points that I mentioned was that it's important to know what is normal for your network. In other words, what machines are NORMALLY connected, what services are normally running, etc. Well, I'm about to start a serious......
  • Disinfecting a PC... part 1 This is the first in a several part series documenting the cleaning of an infected PC. The only real noteworthy item is that it was a dial-up only connection and was rather infested for that. (On par with some of the broadband connected pc's I've seen. It's also an interesting......
  • More testing on the second WMF exploit After my Windows 98 tests which failed to exploit the system with either the first or the second vulnerability, I started wondering how well the antivirus companies were doing in detecting this second exploit variation. I had setup and updated metasploit so I could test my Windows 98 SE install......
Blog Traffic Exchange Related Websites
  • Kaspersky Internet Security 2010 Features: Keeps your money and identity safe. Protects against bank account fraud. Safeguards against online shopping threats. Safer Wi-Fi connections. Two way personal firewall. Unique Safe Run Mode for questionable applications and websites. Security Application Monitor to give you full picture on programs installed on your PC. Identity Information......
  • Comodo Internet Security Get the highest level of security with the advanced features available through Internet Security Pro 2011. Firewall - Slam the door on viruses with Comodo's unique Default Deny Protection™. Explore Comodo Firewall Antivirus - Scan for and destroy known threats to your PC’s health. Explore Comodo Antivirus Live Security......
  • Dolphin Secure document.write(''); Dolphin Secure is the best way for kids to connect, learn, and explore safely online. With this program parents can breathe easier knowing that they control who their children talk to and what websites they are going to. Using one of a kind fingerprint reading technology, kids can......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site