Text 14144, 89 rader
Skriven 2005-12-29 18:20:00 av George Vandervort (1:382/8)
Ärende: New Windows Warning..
=============================
Hello All!


=== Cut ===

Windows image flaw now 'extremely critical'

By Anne Saita, News Director
29 Dec 2005 | SearchSecurity.com

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1154914,
00.html?track=NL-102&ad=537902

Users are being asked not to save, open or even preview any untrusted image
files from e-mail, instant messages, folders or network shares in Internet
Explorer after an exploit targeting Windows Metafile Format files spread
yesterday on fully patched systems.

Numerous security vendors and US-CERT have issued warnings to users asking them
to avoid any application that automatically displays a .wmf image, including
older versions of Firefox and current versions of Opera, Outlook and all IE
versions running on the Windows platform. "This is a zero-day exploit, the kind
that give security researchers cold chills," according to the Sunbelt Software
blog. "You can get infected by simply viewing an infected WMF image."

Severity ratings vary, but at least one respected vulnerability assessment
company, Secunia, Inc. called this one "extremely critical."

Attackers are using the unprotected hole in machines running Windows XP
(including those with the SP 2 patch installed), ME, 2000 and Windows Server
2003 to hide malicious code on a Web page or e-mail containing .wmf files.
Vendors report that the flaw is primarily being used to sneak spyware onto
computers. In addition to installing downloads and using the PC as a spam
relay, the malicous code tries to trick its user into revealing credit card
information.

Though there are no reports of widespread traction, security alerts have been
elevated because of the high risk of rapid infection rates if enough users
click on a malicious .wmf file or URL to a malicious site. In some cases,
merely surfing and landing on an infected site will download the spyware
automatically, according to various vendors.

Microsoft issued its own warning yesterday and said it's investigating reports
to determine if a patch is required prior to the next release of security
updates next month. "Microsoft is aware of the public release of detailed
exploit code that could allow an attacker to execute arbitrary code in the
security context of the logged-on user, when such user is visiting a Web site
that contains a specially crafted Windows Metafile (WMF) image," the company
said in a prepared statement. "An attacker would have no way to force users to
visit a malicious Web site. Instead, an attacker would have to persuade them to
visit the Web site, typically by getting them to click a link that takes them
to the attacker's Web site.

"Customers are encouraged to keep their antivirus software up to date," it
continued. "The Microsoft Windows AntiSpyware (Beta) can also help protect your
system from spyware and other potentially unwanted software. We will continue
to investigate these public reports."

The company's advisory also lists mitigating factors, including the fact an
attacker must host the Web site that contains the contaminated Web page and
could not force users to visit the malicious site. Such required user
interaction can slow the exploitation rate. Also, "users whose accounts are
configured to have fewer user rights on the systems could be less impacted than
users who operate with administrative user rights."

Meantime, Danish-based security provider Secunia is advising enterprise users
to not save, open or preview untrusted image files from email or other sources,
nor open untrusted folders and network shares. It also suggests setting the
security level to "high" in IE to prevent automatic exploitation. Furthermore,
"the risks can be mitigated by unregistering 'Shimgvw.dll.' However, this will
disable certain functionalities. Secunia do not recommend the use of this
workaround on production systems until it has been thoroughly tested."


=== Cut ===


Regards,
George Vandervort
InterNet EMail: georgev@austin.rr.com
Tech Support: http://home.austin.rr.com/llr/tech.html

'Using yesterday's software to create tomorrow's problems today'

...Data Sector not found... Did you look under the sofa?
... the Beatles said it best, Obla-Dee, Obla-Daa, Life Goes On...

--- FMail/Win32 1.60
 * Origin: Bill Gates does my Windows (FidoNet 1:382/8)