Microsoft Windows WMF Exploit

January 5th, 2006 at 10:59 pm

Those burdened with using Microsoft Windows as their primary operating system should immediately update their installations in order to fix a recently unveiled flaw wherein Windows metafiles can be used by nefarious nogoodniks to install and execute malicious code/software such as adware and key-loggers.

The flaw is such that simply viewing a web page or email with images in it can cause your system to be exploited without any further action necessary on your part. As you can imagine, the security implications associated with this are enormous.

As an aside, it’s worth noting that the increasingly popular alternative web browser Firefox is not vulnerable to this exploit, so if you are still using Internet Explorer I highly recommend that you make the switch and avoid using IE when at all possible. Firefox is free. If you use Outlook for email, switching to Thunderbird - which is also free - can also help protect you. I do recommend turning off HTML email display, though, no matter what email client you use as there are security and privacy issues inherent to inline display of remote images in email.

If you’re at risk - and pretty much anyone using Windows is at risk of something at some point - I highly suggest that you download a fix recently released by Microsoft and apply it to your system.

While you’re doing so, it probably wouldn’t hurt to take a moment to consider a more long term solution to protect yourself from these types of exploits.

Zoso

Firefox isn’t affected? Thank god. I’d heard differntly (over at Something Awful). I patched my system anyway, though I don’t touch IE except for window’s updates.


> Firefox isn’t affected? Thank god.

Well, kinda-sorta. I probably should have explained that better.

Firefox can be used as a vector, but apparently it prompts you before opening the image. Internet Explorer will just open the file and trigger the exploit without warning.

The exploit is a Windows-specific one - not specific to any given piece of software running under the OS (it can even be triggered by viewing thumbnails while browsing files stored on your computer!). It’s just that it’s a bit more likely to bite you without you knowing it in IE.

Either way, you should always keep your Windows system up-to-date at all times and avoid IE like the plague it is. These are simply good measures to follow as a general rule…


Zoso

Ah, I see. That’s kinda what I got over at Something Awful. I’m all patched up, so it should be ok. But this kinda worries me, it’s only a matter of time before they ‘evolve’ this into something more, right?


> But this kinda worries me, it’s only a matter of
> time before they ‘evolve’ this into something
> more, right?

Hard to say - I guess it depends on how well Microsoft patched the hole. My understanding is that this isn’t the first remote execution bug associated with WMF files, so take that for whatever it’s worth.

The question we should be asking ourselves is this: How, exactly, does an _image file format_ end up having the ability to execute random things and cause problems? This sort of thing has bitten Microsoft plenty of times in the past (ie. Word macro viruses).