OT: New Security Hole in MS Windows

dand9959 wrote on 1/2/2006, 9:46 AM
Just received this e-mail from a colleague, who received it from a reliable source within MS.

I cannot vouch for that source since I don't know him, but I believe it to be legit:

-----------------------

A new vulnerability has surfaced which at this moment in time has no fix for. It relates to how Windows renders WMF (Windows Meta Files) and it is a new threat in that for the first time you don't have to click anything to be hit, simply viewing an image that takes advantage of the vulnerability can execute commands on your PC, such as installing spyware/virus code.

The vulnerability is in a core Windows rendering component, shimgvw.dll which is called to render WMF images from any application so you can be hit whether viewing a web page, previewing an email etc.

More information can be found at

- http://www.microsoft.com/technet/security/advisory/912840.mspx

- http://www.kb.cert.org/vuls/id/181038

At this time the only workaround is to disable the problem component:

Un-register the Windows Picture and Fax Viewer ( Shimgvw.dll)

1. Click Start, click Run, type "regsvr32 -u %windir%\system32\shimgvw.dll"

(without the quotation marks), and then click OK.

2. A dialog box appears to confirm that the un-registration process has succeeded.

Click OK to close the dialog box.

Impact of Workaround: The Windows Picture and Fax Viewer will no longer be started when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer.

To undo this change, re-register Shimgvw.dll by following the above steps.

Replace the text in Step 1 with "regsvr32 %windir%\system32\shimgvw.dll" (without the quotation marks).

Just blocking WMF files will not work as a the other image types could also be used.

I will keep you informed of any updates but for now you should visit only "trusted" web sites as the number of sites now using this vulnerability is growing. Also since we use Outlook 2003 it does not download images automatically so for now ensure do not download is configured (Tools – Options – Security – Change Automatic Download Settings…)

Comments

rique wrote on 1/2/2006, 10:15 AM
Here's a patch discovered by security guru Steve Gibson.

http://www.grc.com/sn/notes-020.htm
John_Cline wrote on 1/3/2006, 7:24 AM
If Steve Gibson is on the case, then you know it's real and should be taken seriously.

John
Coursedesign wrote on 1/3/2006, 7:50 AM
since we use Outlook 2003 it does not download images automatically...

Those who don't need Outlook's calendaring, etc. can use Mozilla Thunderbird.

It's free and it works great, with better security.
mark-woollard wrote on 1/3/2006, 8:01 AM
I downloaded Ilfak's patch as directed at:

http://www.grc.com/sn/notes-020.htm

However, it won't install. I get an error message that says:

"The setup files are corrupted. Please obtain a new copy of the program."

Any advice?
John_Cline wrote on 1/3/2006, 9:14 AM
yes, download it again. I downloaded the file from the same link and it installed fine.

John
busterkeaton wrote on 1/3/2006, 10:17 AM
That patch is also working fine for me.
mark-woollard wrote on 1/3/2006, 11:31 AM
Redownloading got it to work.
Thanks
rique wrote on 1/5/2006, 6:02 PM
MS has finally come up with their official patch for this problem which you can get with Windows Update. Only 2000 and XP are supported.