WMF exploit vs. Windows 98 again…



If you’ve visited here in the last few days, you’ll have noticed that I’ve been trying to test the WMF exploit against a Windows 98 Virtual machine since January 1st. I initially started out with a default install, which didn’t work, (for the exploit), then added irfanview (didn’t work), tried the exploit as a jpg, gif, htm, doc file extension, (didn’t work) and then this morning saw that I’m not the only one that’s been testing this….


Several sites are reporting that iDefense has studied how easy it is for earlier Windows versions to be affected and it seems that we have all come to similar conclusions – that it is not as easy for earlier versions of windows to be affected by this exploit.

I saw a comment in one of Larry Seltzer’s posts that IF Windows 98 had Microsoft Office 97 or newer installed AND had folder “enable thumbnail view” enabled AND in View, folder options had Web view” under Windows Desktop Update, THEN it would be affected. I still can’t seem to verify this. I even pulled Microsoft Photo Editor from the Office CD and added that to my install. I haven’t added any service packs from the original Office 97 Professional CD.

True, earlier versions of Windows contain the code that this bug is in, but it takes another dll call to exploit it (the bug itself is in gdi32.dll) (shimgv.dll apparently makes the call to exploit it, but there may be other calls to it = for instance Lotus Notes was shown as vulnerable EVEN with the dll unregistered.)

Oh – one other thing I’ve tested from a comment on one of the earlier posts is using Internet Explorer to view the wmf by including it as an image in a web page… img=bad.wmf… still didn’t seem to do anything.

Related Posts

Blog Traffic Exchange Related Posts
  • WMF Exploit -- it's worse... This is going to be a rough start to the new year for IT staff and computer users.... There's coverage at Incidents.org, the sunbeltblog and f-secure of the latest twist in what will likely be a BIG mess to clean up. It looks like there's a someone spamming emails to......
  • Sony still dragging heels on DRM recall New York's Attorney General is trying to hold Sony's feet to the fire. Over a week after the recall of the Sony discs carrying the controversial DRM Rootkit XCP, affected discs were still available for purchase at several retail outlets. From the betanews article... Spitzer sent investigators to a number......
  • Update on the Internet Explorer VML vulnerability Just catching up on the days VML vulnerability news from today.... It looks as though... the exploit is now MUCH more widespread this blog has some video of an infection, what's notable is that the first take was VERY UNEVENTFUL, it was used to stealthily install a keylogger. (So that......
Blog Traffic Exchange Related Websites
  • WordPress in Depth Need a Manual for WordPress? WordPress has grown into the number 1 blogging tool in its category: several million bloggers have downloaded this powerful open source software, and millions more are using WordPress.com’s hosted services. Thirty-two of Technorati’s Top 100 blogs now use WordPress. WordPress InDepth, 2nd edition is a......
  • How to Replace Window Screens Windows screens may look tough, but many times they are all too fragile. One small tear can mean a house filled with bugs, but thankfully, it’s easy enough to fix them if you have the right tools. Here’s a quick guide to replacing and repairing window screens that anyone can......
  • New Main Window Options The latest version has a new viewing option, which includes a header window showing the keyword prompt and, for new kanji, the kanji itself in a large font. This may suit users who found that the kanji in the title bar was too small, or who are not used to......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Leave a Reply

You must be logged in to post a comment.


Switch to our mobile site