Microsoft released a patch for the WMF vulnerability this afternoon. KB912919 http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx http://www.microsoft.com/technet/security/bulletin/ms06-jan.mspx Has anyone looked into this, tried it, or know what it modifies? In the workarounds FAQ for the vulnerability, it mentions: (Therefore, I think this is pre-patch release info. ============================================================================ =============================================== Workarounds for Graphics Rendering Engine Vulnerability - CVE-2005-4560: Microsoft has tested the following workaround. While this workaround will not correct the underlying vulnerability, it will help block known attack vectors. * Unregister the Windows Picture and Fax Viewer (Shimgvw.dll) on Windows XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows Server 2003 Service Pack 1 Microsoft has tested the following workaround. While this workaround will not correct the underlying vulnerability, it helps block known attack vectors. When a workaround reduces functionality, it is identified in the following section. Note This workaround is intended to help protect against Web based exploit vectors and is not effective against exploits that have Windows Metafile images embedded in Word documents and other similar attack vectors. Note The following steps require Administrative privileges. We recommend that you restart the computer after you apply this workaround. Alternatively, you can log out and log back in after you apply the workaround. However, we do recommend that you restart the computer. To un-register Shimgvw.dll, follow these steps: 1. Click Start, click Run, type "regsvr32 -u %windir%\system32\shimgvw.dll" (without the quotation marks), and then click OK. 2. When a dialog box appears that confirms that the process has been successful, click OK. Impact of Workaround: The Windows Picture and Fax Viewer will no longer start when users click a link to an image type that is associated with the Windows Picture and Fax Viewer. To undo this workaround after the security update has been deployed, reregister Shimgvw.dll. To do this, use this same procedure, but replace the text in step 1 with "regsvr32 %windir%\system32\shimgvw.dll" (without the quotation marks). -----Original Message----- From: Dave Korn [mailto:davek_throwaway@xxxxxxxxxxx] Sent: Tuesday, January 03, 2006 1:10 PM To: bugtraq@xxxxxxxxxxxxxxxxx Subject: Re: WMF browser-ish exploit vectors Evans, Arian wrote in news:8654C851B1DAFA4FA18A9F150145F92502C16D7A@xxxxxxxxxxxxxxxxxxxxxxxxxx > Here, let's make the rendering issue simple: > > Due to IE being so content help-happy there are a > myriad of IE-friend file types (e.g.-.jpg) that one > can simply rename a metafile to for purpose of web exploitation, and > IE will pull out the wonderful hey; > you're-not-a-jpeg-you're-a-something-else-that-I-can- > -automatically-handle trick err /feature/ for you. Yeh, that's a real dumbass design feature that one. > http://sharepoint2003/bizdir/your_custom_folder_icon.jpg > > http://yourcorp_web_based_DMS/surprise_not_a.doc > > etc. Have you tried giving it a mpg/avi/wma/wmv extension and getting it to open in a (perhaps embedded) mediaplayer? That's liable to work as well; mediaplayer is also vulnerable to the choose-an-app-based-on-extension/app-loads-a-viewer-based-on-actual-content desynchronisation attack... cheers, DaveK -- Can't think of a witty .sigline today....