Windows Forum: WMF Exploit Information

[Chris]

What Exactly Do We Have Here?

Microsoft Windows WMF "SETABORTPROC" Arbitrary Code Execution

A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error in the handling of Windows Metafile files (".wmf") containing specially crafted SETABORTPROC "Escape" records. Such records allow arbitrary user-defined function to be executed when the rendering of a WMF file fails. This can be exploited to execute arbitrary code by tricking a user into opening a malicious ".wmf" file in "Windows Picture and Fax Viewer" or previewing a malicious ".wmf" file in explorer (i.e. opening a folder containing a malicious image file).

The vulnerability can also be exploited automatically when a user visits a malicious web site using Microsoft Internet Explorer.

NOTE: Exploit code is publicly available. This is being exploited in the wild. The vulnerability can also be triggered from explorer if the malicious file has been saved to a folder and renamed to other image file extensions like ".jpg", ".gif, ".tif", and ".png" etc.

The vulnerability has been confirmed on a fully patched system running Microsoft Windows XP SP2. Microsoft Windows XP SP1 and Microsoft Windows Server 2003 SP0 / SP1 are reportedly also affected. Other platforms may also be affected.

What Do Microsoft Have To Say?

Official Fix: Download the update or visit Microsoft/Windows Update

UPDATE: It would seem Microsoft have updated their Security Advisory

Microsoft has completed development of the security update for the vulnerability. The security update is now being localized and tested to ensure quality and application compatibility. Microsoft’s goal is to release the update on Tuesday, January 10, 2006, as part of its monthly release of security bulletins. This release is predicated on successful completion of quality testing.

The update will be released worldwide simultaneously in 23 languages for all affected versions of Windows once it passes a series of rigorous testing procedures. It will be available on Microsoft’s Download Center, as well as through Microsoft Update and Windows Update. Customers who use Windows’ Automatic Updates feature will be delivered the fix automatically.

Microsoft Security Advisory (912840) Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution.

Microsoft is investigating new public reports of a vulnerability in Windows. Microsoft is also aware of the public release of detailed exploit code that could be used to exploit this vulnerability. Based on our investigation, this exploit code could allow an attacker to execute arbitrary code on the user's system by hosting a specially crafted Windows Metafile (WMF) image on a malicious Web site. Microsoft is aware that this vulnerability is being actively exploited.

Microsoft has determined that an attacker using this exploit would have no way to force users to visit a malicious Web site. Instead, an attacker would have to persuade them to visit the Web site, typically by getting them to click a link that takes them to the attacker's Web site. In an e-mail based attack, customers would have to be persuaded to click on a link within a malicious e-mail or open an attachment that exploited the vulnerability. In both the web and email based attacks, the code would execute in the security context of the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Microsoft will continue to investigate these reports and provide additional guidance depending on customer needs.

More Readig...

First WMF worm found

Exploit-WMF

Microsoft Windows Graphics Rendering Engine WMF Format Unspecified Code Execution Vulnerability

New exploit blows by fully patched Windows XP systems

Vulnerabilities in Graphics Rendering Engine May Still Exist Even After Applying the MS05-053 (KB896424) Security Update

Errr, Run That By Me again...

This is a serious problem, because it affects just about every Windows Operating system there is. This is a Zero-Day exploit meaning that, there was no warning, no body knew apart from the people that knew how to make use of the exploit for malicious intent.

In simple terms when you view an image, not just by using the "Windows Picture and Fax Viewer" it can also be Internet Explorer, Firefox, Opera, Netscape and as far as I know just about any application that is capable of showing an image. The image that you are viewing may make use of the exploit and then go onto install some nasty, malicious software in the form of toolbars, Trojans etc.

What this means is, forget your Windows Updates because as of now [02.01.06] Microsoft does not have an update to fix this problem. But please keep checking Microsoft/Windows Update as often as you can to see if an update has been issued. More than likely AV vendors, etc will be updating their applications [probably the definition files] to detect known .WMF exploits, so please make sure you are fully updated.

There Is Light...

Whilst there is no official fix from Microsoft there are workarounds to this exploit...

Security Now! Notes for Episode #20

To immediately disable the vulnerable Windows component:

Logon as a user with full administrative rights.

Click the Windows "Start" button and select "Run..."

Enter the following string into the "Open" field:

regsvr32 -u shimgvw.dll

(You can copy/paste from this page using Ctrl-C/Ctrl-V)

Click "OK" to unregister the vulnerable DLL.

If all goes well, you will receive a confirmation prompt, and your system is now safe. No need to reboot, but you might want to just to be sure that any possible currently loaded instance is flushed out.

To eventually re-enable the "SHIMGVW.DLL" component:

Logon as a user with full administrative rights.

Click the Windows "Start" button and select "Run..."

Enter the following string into the "Open" field:

regsvr32 shimgvw.dll

(You can copy/paste from this page using Ctrl-C/Ctrl-V)

Same as the one above, but no "-u" for "uninstall".

Click "OK" to re-register the (hopefully) non-vulnerable DLL.

More...

Workaround, Protections Emerge for WMF Exploit

[Full-disclosure] Someone wasted a nice bug on spyware...

80. Disable or Restore Picture and Fax Viewer

These workarounds will disable thumbnails and the "Windows Picture and Fax Viewer". THESE METHODS ARE NOT A FIX AND THE DRAWBACK IS YOU LOSE SOME FUNCTIONALLITY IN WINDOWS.

The Unoffical HotFix...

Windows WMF Metafile Vulnerability HotFix

This week a new vulnerability was found in Windows:

http://www.microsoft.com/technet/security/...ory/912840.mspx

Browsing the web was not safe anymore, regardless of the browser. Microsoft will certainly come up with a thouroughly tested fix for it in the future, but meanwhile I developed a temporary fix - I badly needed it.

The fix does not remove any functionality from the system, all pictures will continue to be visible. You can download it here:

http://www.hexblog.com/security/files/wmffix_hexblog13.exe

It should work for Windows 2000, XP 32-bit, XP 64-bit, and Windows Server 2003.

THIS IS AN UNOFFICAL FIX AND WILL ALLOW YOU TO VIEW THUMBNAILS AND "WINDOWS PICTURE AND FAX VIEWER".

IE-SPYAD Interim Update - 28 Dec. 2005

Sites related to the WMF exploit [in a bad way] can be blocked by an application called IE-SPYAD and it can do alot more as well.

Enough of me just click here to find out more about this.

Plain And Simple...

If you are not bothered about losing some functionality then you can unregister the SHIMGVW.DLL as described in the above articles.

If you want your thumbnails and the "Windows Picture and Fax Viewer" then you are best installing the unofficial fix. But please make any backups before doing so...

To prevent you from going to sites that are know to be related to this exploit then use IE-SPYAD.

Keep checking Microsoft/Windows updates for an official fix and this topic for further updates.

Thank Yous...

This post was constructed using many different articles on the web. Hopefully you know now what this WMF exploit is all about and what is happening with it. Don't thank me, thank the above articles and the people who made them...

....

If you think any of the topic is incorrect then please say so...

Feel free to post this on other forums but link back to us @ http://www.simplyguides.net

[deuces wild]

Thanks Chris!

[ɹəuəllıʍ ʇɐb]

Thanks, Chris - great research!

[Topband]

Chris,

One part I'm confused about

To immediately disable the vulnerable Windows component:

Logon as a user with full administrative rights.

Is that correct? Forgive me if that is correct because I don't use Windows, only Linux, so I was under the impression that it is best to run as a user with no admin rights, or is Windows different?

[Thos]

Thank you for bringing this to our attention. I intend to follow Microsoft's advice and not delve into the "work around". And of course keep my eye on the updates (which I am sure you will publicise anyway)

Thos.

[mark2]

Is that correct? Forgive me if that is correct because I don't use Windows, only Linux, so I was under the impression that it is best to run as a user with no admin rights, or is Windows different?

It is safer that way whatever the OS, however to be able to make the recommended changes you do need admin rights, but, once changed you should return to your normal (restricted) account.

For ease of use Windows usually defaults with the main user as admin, hence the ease that spyware etc manages to install :(

In that respect Linux has the edge in security, but many windows users are unfamiliar with the command line and logging in as root.

[Topband]

mark2,

It was the way I was reading it :rolleyes: , what was confusing you can run in Windows with full admin rights as a user, whereas in Linux you have to enter a specific command for admin if you are a user.

[djohn]

Yes, A big thank you to Chris. I was talking to him early this morning as he was spending a lot of time and hard work putting the above info together for us. :)

[-pops-]

The way I read this is that M$ are being somewhat complacent about yet another threat to their operating systems.

Surely they ought to be working as fast as they can to plug yet another gap in the security of their software, not recite non sequiturs like: "The vulnerability has been confirmed on a fully patched system running Microsoft Windows XP SP2. Microsoft Windows XP SP1 and Microsoft Windows Server 2003 SP0 / SP1 are reportedly also affected" and then not to disabuse methods on how to shut off parts of the operating system - which a lot of users find to be a key part of their enjoyment of using it.

I know it's the holiday season but Gates and his crew have a responsibility to millions and millions of people who have bought, and rely on, his software.

[CurlyWhirly]

The way I read this is that M$ are being somewhat complacent about yet another threat to their operating systems.

I agree.

In some cases it takes months before security updates are released and in cases like this with a zero day exploit Windows users are particularly at risk :(

[Topband]

Its called "dumbing it down"

[AndyAtHull]

I've made a post about this too on my blog. Just the same as what you have posted. Not a direct link to here but another forum with the same details. Spreading the word. :D

[Chris]

I've made a post about this too on my blog. Just the same as what you have posted. Not a direct link to here but another forum with the same details. Spreading the word. :D

That's all also me aka powerless ;)

UPDATE: It would seem Microsoft have updated their Security Advisory

Microsoft has completed development of the security update for the vulnerability. The security update is now being localized and tested to ensure quality and application compatibility. Microsoft’s goal is to release the update on Tuesday, January 10, 2006, as part of its monthly release of security bulletins. This release is predicated on successful completion of quality testing.

The update will be released worldwide simultaneously in 23 languages for all affected versions of Windows once it passes a series of rigorous testing procedures. It will be available on Microsoft’s Download Center, as well as through Microsoft Update and Windows Update. Customers who use Windows’ Automatic Updates feature will be delivered the fix automatically.

[AndyAtHull]

According to Sunbelts Blog a user had printing problems after using the unofficial hotfix for the WMF exploit.

But now the official patch by M$ has been leaked. According to Sunbelt.

But there again no doubt there will be more patches for the patches. Just to tidy things up. LOL

[nellie2]

NICK ADSL UK has posted about the official MS patch here

[korgg]

Just installed a patch from MS today through Windows Update ...

[CurlyWhirly]

I also downloaded and installed the patch yesterday evening.

I must say that I am impressed with Microsoft's speedy response to the security flaw as there was a rumour that the patch wouldn't be released until next tuesday!

Microsoft's software engineers must have been working intensely as the vulnerability wasn't unpatched for very long, just a few days which is way better than in the past where they took weeks or in some cases months to release a fix.

[CurlyWhirly]

Microsoft must have been concerned.

http://news.bbc.co.uk/2/hi/technology/4587434.stm

Never mind all sorted now (until the next time)

[Chris]

More WMF problems for Microsoft

Just days after Microsoft rushed out a patch to fix a critical Windows flaw related to the processing of Windows Meta File images, two more problems with the component were flagged.

The newly disclosed issues could be a conduit for denial-of-service attacks, according to a description sent to the Bugtraq mailing list on Monday. A core function of the Windows operating system, explorer.exe, will crash a vulnerable Windows PC if a user views a specially crafted WMF image, according to the description. Explorer runs the Windows user interface, including the Start menu, taskbar, desktop and file manager.

More | Here

So you're saying intentionally or - Microsoft intentionally put a backdoor in Windows? Is that what you're saying?

Leo and I carefully examine the operation of the recently patched Windows MetaFile vulnerability. I describe exactly how it works in an effort to explain why it doesn't have the feeling of another Microsoft "coding error". It has the feeling of something that Microsoft deliberately designed into Windows. Given the nature of what it is, this would make it a remote code execution "backdoor". We will likely never know if this was the case, but the forensic evidence appears to be quite compelling.

More | Here and Here

Here's a snippet:

LEO: So you're saying intentionally or - Microsoft intentionally put a backdoor in Windows? Is that what you're saying?

STEVE: Yes.

LEO: Well, that's a pretty strong accusation. Could this not have been a...

STEVE: Well, it's the only conclusion...

LEO: It couldn't have been a mistake?

STEVE: I don't see how it could have been a mistake. Again, I'm going to continue to look at it. But from what I've seen now, this had to be deliberate. It was not what we were led to believe. Well, and it's funny, too, because then I thought, okay, wait a minute, Microsoft has lied to us. I reread the original vulnerability spec in, you know, their vulnerability page. And they never say this isn't the case. I mean, they describe it as a vulnerability, which it certainly is. Nowhere, you know, is even what I'm saying contradicted by their page.

LEO: So you're saying Microsoft, or people at Microsoft maybe unbeknownst to Microsoft, intentionally put code in Microsoft Windows that will allow anybody who knew about it access any Windows machine, to get into any Windows machine and run any arbitrary code on it.

STEVE: Well, it's not like a trojan, where they would be able to contact a remote machine. But, for example, if Microsoft was worried that for some reason in the future they might have cause to get visitors to their website to execute code, even if ActiveX is turned off, even if security is up full, even if firewalls are on, basically if Microsoft wanted a short circuit, a means to get code run in a Windows machine by visiting their website, they have had that ability, and this code gave it to them.

LEO: And there'd be nothing anybody could do about it or - and in most cases detect it. So it sounds like - and I really want to be careful here because this is a very serious accusation. It sounds like this was done on purpose by Microsoft or somebody at Microsoft. It sounds like it was accidentally discovered. Microsoft reacted and has pulled it out now.

STEVE: Right.

KnockKnock

From: grc.com

[deuces wild]

It showed I have Backdoor present. Do I need to run something to remove it?

[CurlyWhirly]

I am okay (I guess)?

I get the all clear though I can't see how as these 2 new vulnerabilities have only just been discovered and not yet patched unless I'm missing something :huh:

[Thos]

Like Curly, I have no "Backdoor"

Thanks, Chris.

Thos. :)

[Chris]

It showed I have Backdoor present. Do I need to run something to remove it?

Apply the patch.

[deuces wild]

It showed I have Backdoor present. Do I need to run something to remove it?

Apply the patch.

Where do I find the patch?

[CurlyWhirly]

Where do I find the patch?

From the Microsoft Update website.

You are looking for Security Update for Windows XP (KB912919)

http://www.microsoft.com/downloads/details...&displaylang=en