WMF exploit vs. Windows 98 again…



If you’ve visited here in the last few days, you’ll have noticed that I’ve been trying to test the WMF exploit against a Windows 98 Virtual machine since January 1st. I initially started out with a default install, which didn’t work, (for the exploit), then added irfanview (didn’t work), tried the exploit as a jpg, gif, htm, doc file extension, (didn’t work) and then this morning saw that I’m not the only one that’s been testing this….


Several sites are reporting that iDefense has studied how easy it is for earlier Windows versions to be affected and it seems that we have all come to similar conclusions – that it is not as easy for earlier versions of windows to be affected by this exploit.

I saw a comment in one of Larry Seltzer’s posts that IF Windows 98 had Microsoft Office 97 or newer installed AND had folder “enable thumbnail view” enabled AND in View, folder options had Web view” under Windows Desktop Update, THEN it would be affected. I still can’t seem to verify this. I even pulled Microsoft Photo Editor from the Office CD and added that to my install. I haven’t added any service packs from the original Office 97 Professional CD.

True, earlier versions of Windows contain the code that this bug is in, but it takes another dll call to exploit it (the bug itself is in gdi32.dll) (shimgv.dll apparently makes the call to exploit it, but there may be other calls to it = for instance Lotus Notes was shown as vulnerable EVEN with the dll unregistered.)

Oh – one other thing I’ve tested from a comment on one of the earlier posts is using Internet Explorer to view the wmf by including it as an image in a web page… img=bad.wmf… still didn’t seem to do anything.

Related Posts

Blog Traffic Exchange Related Posts
  • Two new Windows exploits in the Wild | Wordpad Text Converter | Internet Explorer 7 XML Parser In the wake of a huge patch Tuesday, Microsoft has two new fires to be fighting. There are apparently "limited and targeted" attacks against a flaw with the Text converter component of Wordpad. Affected systems include Windows 2000 SP4, XP up to SP2, Server 2003 SP1 and 2. Vista is......
  • Update on Internet Explorer Zero Day exploit Yesterday I mentioned a SANS report on a possible zero day exploit against Internet Explorer. Today they have more details in the handlers diary. Among other things SANS has issued a patch for it. Essentially the zero day (or previously unknown) vulnerability deals with a .Net framework file, msdds.dll .......
  • Update on the Internet Explorer VML vulnerability Just catching up on the days VML vulnerability news from today.... It looks as though... the exploit is now MUCH more widespread this blog has some video of an infection, what's notable is that the first take was VERY UNEVENTFUL, it was used to stealthily install a keylogger. (So that......
Blog Traffic Exchange Related Websites
  • New Main Window Options The latest version has a new viewing option, which includes a header window showing the keyword prompt and, for new kanji, the kanji itself in a large font. This may suit users who found that the kanji in the title bar was too small, or who are not used to......
  • Obama and the Government-Media Complex Cover for Malik Nadal Hasan Sunday Paper - November 8th, 2009 We know now that Major Malik Nadal Hasan was a Muslim domestic terrorist who wreaked havok on Fort Hood, Texas. Discuss your feelings on this topic, and more broadly our President’s attention to domestic terrorism as we view a video report of the carnage.......
  • Microsoft Security Advisory (2286198): Vulnerability in Windows Shell Could Allow Remote Code Execution Vulnerability in Windows Shell Could Allow Remote Code Execution Published: July 16, 2010 Version: 1.0 General Information Executive Summary Microsoft is investigating reports of limited, targeted attacks exploiting a vulnerability in Windows Shell, a component of Microsoft Windows. This advisory contains information about which versions of Windows are vulnerable as......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Leave a Reply

You must be logged in to post a comment.


Switch to our mobile site