WMF exploit through indexing software



One of the vectors that has been mentioned early on is the infection of a system through the WMF exploit even when the exploited file was downloaded through a dos command shell. At first this seemed absurd, but it appeared that Google Desktop search was indexing files dynamically and once the file was downloaded it indexed the file and triggered the vulnerability. There is word that Microsoft’s indexing service does likewise – although Microsoft has only said that they’re “looking into reports”. Incidents.org is saying that they think this may be the giant white elephant no one is talking about. I certainly would shudder to think if machines on a network are indexing a network share and manage to subvert every machine running an indexing share….


Along the same lines… in the Kaspersky labs viruslist blog, they note that they suspect the vulnerability isn’t actually within shimgvw.dll even though unregistering it works around the problem in some cases. They note that given that other apps can be exploited EVEN WITH THE unregister workaround, that the flaw is likely in gdi32.dll

This makes sense in light of the third party patch that I reported on earlier. That patch works around the problem by disabling the SETABORT escape functionality in gdi32.dll (Who knows this could be the foundation of an official Microsoft patch, although there may be other breakage from this disabling.)

Related Posts

Blog Traffic Exchange Related Posts
  • Exploits in the wild and other news After perusing the Sans.org handlers diary, there are a few things brewing that should be known. Exploits are in the wild for some of the vulnerabilities addressed by this weeks Microsoft patchfest. There is a Veritas Backup Exec vulnerability and it appears that the Beta of Vista has a network......
  • Update on the Internet Explorer VML vulnerability Just catching up on the days VML vulnerability news from today.... It looks as though... the exploit is now MUCH more widespread this blog has some video of an infection, what's notable is that the first take was VERY UNEVENTFUL, it was used to stealthily install a keylogger. (So that......
  • How Microsoft could patch VML vulnerability before October's patch day SO, there's the second big vulnerability exploit for Internet Explorer making the rounds in about a week and Microsoft's advisory says that the most recent flaw will likely be patched on October's patch day ("unless the need arises...") So, what would trigger that need? Lot's of browsers being subjected to......
Blog Traffic Exchange Related Websites
  • 4 Things to Look For in a Coin Collector Shop There are hundreds of different coin collector shops in every state, with each coin collector shop claiming to be the best shop for finding your coins. There are positives and negatives to working with each shop – pros and cons that you would not figure out if you do not......
  • New Options for Investing in Inflation Protected Securities If you have been a regular reader, you know that I am a fan of  I-Bonds and Treasury Inflation Protected Securities (TIPS) as a secure retirement investment that is also an inflation hedge. If you can put them in a tax-deferred account, TIPS may work better, if only because you......
  • Free Success Ebook: "How to Attract Success" by F. W. Sears – RARE Classic Ebook Download // < ![CDATA[ var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www."); document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E")); // ]]> // < ![CDATA[ try { var pageTracker = _gat._getTracker("UA-11989331-1"); pageTracker._trackPageview(); } catch(err) {} // ]]> When we first attempt to train our minds to displace these old negative,......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site