The WMF 0-day

[Curio]

Can work through Firefox. Especially notable is it will trigger even if you don't view it at all (by for instance just doing a save as on the link) if you have google desktop search installed, it's trggered when GDS catalogs it - woohoo!

[Reverend]

Workarounds:

Microsoft has tested the following workaround. While this workaround will not correct the underlying vulnerability, it will help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

Un-register the Windows Picture and Fax Viewer (Shimgvw.dll) on Windows XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows Server 2003 Service Pack 1

To un-register Shimgvw.dll, follow these steps:

1. Click Start, click Run, type "regsvr32 -u %windir%\system32\shimgvw.dll" (without the quotation marks), and then click OK.

2. A dialog box appears to confirm that the un-registration process has succeeded. Click OK to close the dialog box.

Impact of Workaround: The Windows Picture and Fax Viewer will no longer be started when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer.

To undo this change, re-register Shimgvw.dll by following the above steps. Replace the text in Step 1 with “regsvr32 %windir%\system32\shimgvw.dll” (without the quotation marks).

[Curio]

The clever man that does IDA Pro has made a patch that disables the vulnerable function in the dll while retaining all the other usefulness of picture rendering in the OS shell. Basically this means unregistering the dll is not necessary.

Can be downloaded here http://www.hexblog.com/security/file..._hexblog13.exe which is nice. It works for w2k SP4 onwards I think - check the page at http://www.hexblog.com/2005/12/wmf_vuln.html

[egghead]

thanks Curio!

hated not seeing my pictures in explorer

[sydspirit]

Hello All.
Here is the latest on the WMF 0-day exploit. I have applied the previous version patch with no problems(XPpro sp2). This looks and sounds real serious.

http://isc.sans.org/diary.php
...this link will change sometime Monday, Jan 2, just use previous button on bottom of page.

Here is the updated link, but there is a lot of good info all over SANS website:
http://isc.sans.org/diary.php?date=2006-01-01