*IMPORTANT* Windows Metafile Exploit Info

[Kevin P]

A recently-discovered vulnerability in Windows allows WMF (Windows Metacode) files, a type of graphics image, to contain embedded code which can cause malicious activity, including unwanted code execution (in other words, you can get infected by viewing WMF files, even downloading them off the web or viewing an embedded one in an email).

Microsoft has released a patch for this vulnerability. You can download it from here: MS06-001

If for whatever reason, you don't want to, or can't install the hotfix, unregister Shimgvw.dll as a workaround:

Un-register the Windows Picture and Fax Viewer (Shimgvw.dll)

1. Click Start, click Run, type "regsvr32 -u %windir%\system32\shimgvw.dll"
(without the quotation marks), and then click OK.

2. A dialog box appears to confirm that the un-registration process has succeeded.
Click OK to close the dialog box.

Impact of Workaround: The Windows Picture and Fax Viewer will no longer be started
when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer.

To undo this change, re-register Shimgvw.dll by following the above steps.
Replace the text in Step 1 with “regsvr32 %windir%\system32\shimgvw.dll” (without the quotation marks).

As exploits now exist in the wild, it is highly important that you protect yourself from this vulnerability. It's probable that a future worm or virus could be released, taking advantage of this security hole.

Also, avoid opening any unknown .wmf file in any application.

[Azeke]

Thanks for the update Kevin, I have notified my company of this possible vulnerability.

Peace and blessings,

Azeke

[George Bellefontaine]

Any way of telling if a given graphic is a WMF file ? Unregistering the Shimgvw.dll sounds like the easiest route to go, but does that mean you won't see graphics ?

[Kevin P]

WMF files normally have a .wmf suffix, but filtering on the suffix isn't sufficient since someone could rename it to a number of different suffixes such as .bmp or .gif and still trigger the exploit.

In Windows XP and 2003, the Windows Picture and Fax Viewer is used to view certain image types by default, when you click on them in Explorer, etc. Unregistering Shimgvw.dll disables this. You could associate another viewer with wmf files, but if it uses the same vulnerable code you could still get infected.

The best bet, beyond unregistering the dll, is to apply Ilfak Guilfanov's patch, until MS releases an official fix. This patch will allow images to still be viewed, while disabling the feature that allows the vulnerability to be exploited.

[Clive]

Thanks Kevin,. We were already notified of the .WMF infection on our conputer a couple of days ago. I was successful in unregistering shimgvw today but I'm getting an DNS Error Msg cannot open the page.......... can you help?

[Kevin P]

The site appears to be down right now. It was working earlier today when I posted the link. Try again in a little while.

[Chris D]

This was on the radio news tonight here in the Seattle/Tacoma area. (home of MS) They said it could take a week to release a patch.

[Kevin P]

I posted a new URL to read about and download the hotfix: http://castlecops.com/f212-Hexblog.html

Also: http://www.grc.com/sn/notes-020.htm

Apparently the original account got suspended due to bandwidth usage.

[Kevin P]

Official Microsoft patch is now available: MS06-001

This site has a good summary of the exploit:

http://www.pauldotcom.com/2006/01/wmf_vulnerability_exploits_jus.html

[Chris D]

Just installed and restarted both of my computers...

[George Bellefontaine]

Thanks for the Microsoft link, Kevin.