Text 95, 85 rader
Skriven 2006-01-04 05:56:40 av Daryl Stout (23.virusinf)
Ärende: Severe Windows Vulnerability
====================================
  The following information is from the Frisk Software (www.f-prot.com)
website...among others...about a severe security vulnerability that
affects potentially ALL Windows systems...from Windows 3.x to Windows
XP...called the Zero Day Vulnerabilty.

  Other virus protection web sites such as Sophos (www.sophos.com) and
F-Secure (www.f-secure.com) have similar postings. According to Sophos,
already over 100 attacks using this vulnerability, have been reported.
Over the weekend, hackers published the code used to exploit this flaw.

  These sites note that while the Internet Explorer browser is
particularly vulnerable to this, the Mozilla Firefox browser
(www.mozilla.com/firefox), and the Opera browser (www.opera.com) will
ASK if you wish to open such a file, if one is encountered (Internet
Explorer apparently opens it automatically). If you answer yes, you most
likely will get "hit".

  Since Microsoft apparently only supports the current and the previous
version of Windows...users of earlier Windows versions will likely NOT
receive a patch from Microsoft for this vulnerability. This includes
Windows 3.x, 95, 98, and ME...and they're strongly urged to upgrade.

***

  Microsoft has released a security advisory warning of a vulnerability
in a Windows graphics rendering engine that could allow for remote code
execution by an attacker on an affected system. Over the past few days
a number of Trojans and other malware have appeared that take advantage
of this vulnerability via doctored image files sent as attachments to
e-mails or embedded in webpages.

  The vulnerability lies in the way Windows handles the Windows Metafile
(.wmf) image file format. Since the vulnerability was first discovered,
numerous websites and mass-delivered e-mail messages have taken advantage
of this vulnerability to install spyware as well as viruses and other
malware on vulnerable machines. Among other things, affected computers
are used to send out thousands of spam e-mails without the knowledge or
consent of their owners.

  Although the behaviour creating this vulnerability is currently causing
serious problems, it was originally a important feature of the Windows
operating system and appears to have been part of Windows since version
3.0 was first released 15 years ago. This vulnerability therefore affects
a very large number of computer users.

  F-Prot Antivirus currently detects all know exploits of this
vulnerability and tags them as "Security risk". We are also working on
pre-emptive protection against any and all future threats attempting to
take advantage of this vulnerability. Microsoft has not yet released a
patch against this vulnerability (it has announced that it won't release
one until Jan. 10 "after extensive testing")...but has described a
workaround for the problem for users of Windows XP: These users can avoid
exploit attacks by unregistering the Windows Picture and Fax Viewer, as 
noted below.

***

Un-registering the Windows Picture and Fax Viewer (Shimgvw.dll) on Windows
XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and
Windows Server 2003 Service Pack 1

  Microsoft has tested the following workaround. While this workaround will
not correct the underlying vulnerability, it helps block known attack
vectors. When a workaround reduces functionality, it is identified in the
following section.

  Note: The following steps require Administrative privileges. It is
recommended that the machine be restarted after applying this workaround.
It is also possible to log out and log back in after applying the
workaround. However, the recommendation is to restart the machine.

  To un-register Shimgvw.dll, follow these steps:

1. Click Start, click Run, type "regsvr32 -u %windir%\system32\shimgvw.dll"
(without the quotation marks), and then click OK.

2. A dialog box appears to confirm that the un-registration process has
succeeded. Click OK to close the dialog box.

  Impact of Workaround: The Windows Picture and Fax Viewer will no longer
be started when users click on a link to an image type that is associated
with the Windows Picture and Fax Viewer.

--- SBBSecho 2.11-Win32
 * Origin: The Thunderbolt BBS 501-223-2541 tbolt.synchro.net (1:382/33)