   Virus Warning, new windows zero day exploit.
  There is a new windows explot out, and it takes advantage of the GDI and how it handles WMF files.Slashdot link.Quote: woodchuck writes "Washington Post reports that another Windows hole has been found and exploit code is now running lose that makes swiss cheese of current patches and security measures. From the article: "Security researchers have released instructions for exploiting a previously unknown security hole in Windows XP and Windows 2003 Web Server with all of the latest patches applied. Anti-virus company Symantec warned of the new exploit, which it said uses a vulnerability in the way Windows computers process certain image files (Windows Meta Files, or those ending in .wmf). Symantec said the exploit is designed to download and run a program from the Web that downloads several malicious files, including tools that attackers could use to control vulnerable computers via IRC.""  Microsoft AdvisoryPeople on other forums have been embedding these in their sigs. Unlike other image formats, WMF needs the GDI in order to render. This works under IE and Firefox under all versions of windows.By Zero Day, it means that the exploit can be used within the the first day of being exploited. The scary thing is that it effects anybody who uses windows, and anybody who goes online. Most antivirus programs have new definitions for it, but stay on trusted sites for a while.[Edited by - KaptainKomunist on December 29, 2005 11:39:42 AM]
  Thanks for the proliferation, I mean heads-up.   ;  I've never even heard of WMF files.Luckily, MSFT is finally removing GDI from the kernel in Vista.   ;  I just added a new adblock filter: '*.wmf'Thanks.   ;Quote:Original post by nagromoI just added a new adblock filter: '*.wmf'Thanks.That won't do any good.http://img526.imageshack.us/img526/1348/bruceleestomp6ue.jpgInfact, there are uses for WMF files. If you have ever used clip art in a word document, it was a WMF file.   ;  I never used them, and are not going to use them. If somebody uses it on his site it's his own fault that i won't see it because i use opera. Also i don't download word files from web because i prefer pdf s Face it, nobody needs this format in the browser.by the way,https://europe.f-secure.com/weblog/those who are using browsers other than internet explorer are secure, if they don't download and save wmf files or any files that might contain wmf.[Edited by - Dmytry on December 29, 2005 2:21:48 AM];new windows zero day exploit.now your just being redundant   ;Quote:Original post by evil_republicannew windows zero day exploit.now your just being redundantYour username is redundant.Linux isn't safe from this either. Just google for apache exploits, and you will see what I mean.   ;Quote:Original post by Dmytrythose who are using browsers other than internet explorer are secure, if they don't download and save wmf files or any files that might contain wmf.This is not necessarly true.  While Mozilla and Opera don't automatically run wmf, they will display a dialog asking if you'd like to run it, cryptically.  If you run an infected wmf, it'll infect you regardless of brower.   ;Quote:Original post by BinomineQuote:Original post by Dmytrythose who are using browsers other than internet explorer are secure, if they don't download and save wmf files or any files that might contain wmf.This is not necessarly true.  While Mozilla and Opera don't automatically run wmf, they will display a dialog asking if you'd like to run it, cryptically.  If you run an infected wmf, it'll infect you regardless of brower.It's dialog asking if you want to just download it, or download and run... those who answer "run" can aswell download and run random executable files like .pif , so they already have problem . As i have said, if you don't download it you're safe.edit: i just thought: there could be problem with google desktop. If file gets downloaded while there is dialog asking you (just to speed things up it start downloaded before you confirm), google desktop will execute exploit when trying to get indexing information from file. Crazy.   