[ insider_reports_insider ]
XP Victim Of Zero-Day Exploit
John Stith
Staff Writer
2005-12-28
 Insider Reports RSS Feed
The nightmare of software companies is the zero-day vulnerability and it's hit Windows. The exploit is tied to Windows' image rendering or more specifically, Windows Metafile (WMF). The vulnerability is being actively exploited and there is no patch.
 | | Zero-day Breaks Windows |  |
Information about the download started floating around the next on Tuesday afternoon and a number of security sites have picked up on it. Security Focus posted a bulletin last night around midnight.
According to F-Secure's blog, "the Trojan downloaders, available from unionseek[DOT]com, have been actively exploiting this vulnerability. Right now, fully patched Windows XP SP2 machines are vulnerable with no known patch."
The patch a number of Windows operating systems including Server 2003 Datacenter Edition, 2003 Enterprise Edition, 2003 Standard Edition, 2003 Web Edition, XP Home Edition and XP Professional. The known threats being distributed including Trojan-Downloader.Win32.Agent.abs, Trojan-Dropper.Win32.Small.zp, Trojan.Win32.Small.ga and Trojan.Win32.Small.ev. F-Secure also said some of these install antimalware programs like Avgold.
According to Secunia's website:
The vulnerability is caused due to an error in the handling of corrupted Windows Metafile files (".wmf"). This can be exploited to execute arbitrary code by tricking a user into opening a malicious ".wmf" file in "Windows Picture and Fax Viewer" or previewing a malicious ".wmf" file in explorer (i.e. selecting the file). This can also be exploited automatically when a user visits a malicious web site using Microsoft Internet Explorer.
According Sunbelt's blog by Alex Eckelberry, this exploit goes further than IE also. It includes older versions of Firefox as well as current versions of Opera and Outlook. Eckelberry said on the blog "that any application that automatically displays a WMF image will cause the user's machines to get infected."
Keep in mind that while F-Secure mentioned the one site, there are others because this is a publicly available exploit. It's probably going to generate some nastier stuff too. As Eckelberry put it, "Folks, I've seen it with my own eyes and this is a really bad exploit. Be careful out there."
About the Author:
John is a staff writer for SecurityProNews covering cyber security.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
