Haha, jeg trodde jeg var safe siden jeg kjørte OS X, men jaggu hadde jeg ikke en versjon av WMP liggende også! Bah, humbug. "kill" fikser jo opp uansett.

WHAT IS IT?
There is a new exploit out that uses WMF (windows metafile format) files to infect a computer. All you have to do to get infected is view a webpage that has the image on it, or access an infected image that is on your computer. That means the forums can be a vector for infection too. (In fact, user Blue Reptile has already been permabanned for putting the exploit in his signature.)


WHO IS VULNERABLE?
The exploit affects Firefox, Internet Explorer, and any other browser that displayes or downloads the file into the cache on the local machine. The file could also be a WMF renamed to any other image type, or possible other filetypes. Anything that puts the image exploit onto your computer or opens it up in windows fax viewer or the part of windows that generates thumbnails of WMF files is a vulnerability. This means any vector that puts the image onto your computer (wget, browser, email, IM, etc) can potentially cause the problem.

This affects anyone on Windows (98, 98SE, ME, 2000, XP, 2003). USING FIREFOX DOES NOT ELIMINATE THE RISK as the file is still downloaded to your cache in most cases, but it does reduce your chances somewhat since the image is often not displayed in the browser. But if you then interact with the file in any way (thumbnail it, Google Desktop, hover over with the mouse) that causes it to be handled by the windows subsystem responsible for WMF then you will have problems. Once again, YOU CAN BE CAUGHT BY THIS EXPLOIT EVEN IF THE IMAGE DOES NOT SHOW IN THE BROWSER. If you use Windows, your system is vulnerable.




WHAT DOES IT DO?
The exploit can be used to drop viruses, trojans, installers etc onto your computer when the exploit is activated (when the file is parsed by the part of windows with the problem). It does not do anything by itself until it is activated. There have been several reports of trojans being downloaded, which then download other things, other spyware, etc. Some of these are "SpyAxe", "AYL" trojan downloader, "ASC" trojan, and other stuff.

Ok, så det er en kjent xpl0it da? Vil da den innebygde \/\/i|/|d0z3 |_|pd4t3 funksjonen, som mange bruker, kunne nedlaste automatisk en sikkerhets-patch som løser akkurat dette problemet? Eller kommer det en slik p4t(h til windoze?

Uansett hvis det er tilfellet, kan jo (_ra(_kerne, dersom dem er skikkelig 1337, lage et program som disasembler windows update på brukerens maskin og legger inn ny kode i patche-funksjonen som gjør at windows update laster ned en masse infisert dritt i stedet for sikkerhets-patchene. Siden windows update baserer seg på klient-server prinsippet der klienten søker i register evt. kjernen, så danner en status, og så laster ned patch fra en server, som installeres og deretter kjøres etter restart av maskinen, da kan klient-delen vel modifiseres til å gjøre akkurat som koderen vil tenker jeg... ;-)

NB: Alstå jeg mistenker det for å basere seg på klient-server program prinsippet.
Jeg er ikke sikker på hvordan windows update fungerer, om det er noe særlig avansert eller integrert i kjernesystemt vet jo ikke jeg.

AntivirusVersion Update Result
AntiVir 6.33.0.7012.31.2005EXP/IMG.WMF
Avast 4.6.695.012.30.2005Win32:Exdown
AVG 718 12.30.2005no virus found
Avira 6.33.0.7012.31.2005EXP/IMG.WMF
BitDefender7.2 12.31.2005Exploit.Win32.WMF-PFV
CAT-QuickHeal8.00 12.31.2005no virus found
ClamAV devel-2005112312.29.2005Exploit.WMF.A
DrWeb 4.33 12.31.2005no virus found
eTrust-Iris7.1.194.012.30.2005no virus found
eTrust-Vet12.4.1.012.31.2005Win32/Worfo
Ewido 3.5 12.31.2005no virus found
Fortinet2.54.0.012.31.2005W32/WMF-exploit
F-Prot 3.16c 12.30.2005no virus found
Ikarus 0.2.59.012.31.2005Exploit.Win32.IMG-WMF
Kaspersky4.0.2.2412.31.2005Exploit.Win32.IMG-WMF
McAfee 4663 12.30.2005Exploit-WMF
NOD32v2 1.1347 12.30.2005Win32/TrojanDownloader.Wmfex
Norman 5.70.10 12.31.2005W32/Exploit.Gen
Panda 9.0.0.4 12.31.2005Exploit/Metafile
Sophos 4.01.0 12.30.2005Exp/WMF-A
Symantec8.0 12.31.2005Bloodhound.Exploit.56
TheHacker5.9.1.06512.31.2005Exploit/WMF
UNA 1.83 12.30.2005no virus found
VBA32 3.10.5 12.30.2005no virus found

AntivirusVersion Update Result
AntiVir 6.33.0.7012.31.2005no virus found
Avast 4.6.695.012.30.2005no virus found
AVG 718 12.30.2005no virus found
Avira 6.33.0.7012.31.2005no virus found
BitDefender7.2 12.31.2005no virus found
CAT-QuickHeal8.00 12.31.2005no virus found
ClamAV devel-2005112312.29.2005no virus found
DrWeb 4.33 12.31.2005no virus found
eTrust-Iris7.1.194.012.30.2005no virus found
eTrust-Vet12.4.1.012.31.2005no virus found
Ewido 3.5 12.31.2005no virus found
Fortinet2.54.0.012.31.2005no virus found
F-Prot 3.16c 12.30.2005no virus found
Ikarus 0.2.59.012.31.2005no virus found
Kaspersky4.0.2.2412.31.2005no virus found
McAfee 4663 12.30.2005no virus found
NOD32v2 1.1347 12.30.2005no virus found
Norman 5.70.10 12.31.2005no virus found
Panda 9.0.0.4 12.31.2005no virus found
Sophos 4.01.0 12.30.2005no virus found
Symantec8.0 12.31.2005no virus found
TheHacker5.9.1.06512.31.2005no virus found
UNA 1.83 12.30.2005no virus found
VBA32 3.10.5 12.30.2005no virus found