Windows Security Exploit - A Baddie

There's a new Windows security loophole out there, and MicroSoft has not released a security patch for it yet. This could be very dangerous. It can infect your system merely by you viewing a .wmv file, or having the file and simply opening its directory. Read the link. Take precautions. Be careful.

"From a number of scans we did through virustotal, we can safely conclude there is currently no anti-virus signature working for it. Similarly it is very unlikely any of the IDS signatures for the previous versions of the WMF exploits work for this next generation.

Judging from the source code, it will likely be difficult to develop very effective signatures due to the structure of the WMF files.

McAfee announced on the radio yesterday they saw 6% of their customer having been infected with the previous generation of the WMF exploits. 6% of their customer base is a huge number."

http://isc.sans.org/diary.php?storyid=992

LMU

welcome to the new year, same as the old year

Yep, this is loking to be a bad one...

This was copied from SANS (internet storm center) website:
The folks at Websense Labs have a nice movie on how it looks like if a system gets exploited by this WMF 0-day, see http://www.websensesecuritylabs.com/images/alerts/wmf-movie.wmv . Don't go to any of the URLs visible in the movie unless you know what you are doing (or feel like spending the next hours reinstalling your PC).

And then from the US-CERT (US computer emergency readiness team):
Vulnerability Note VU#181038
Microsoft Windows Metafile handler SETABORTPROC GDI vulnerability
Overview
Microsoft Windows is vulnerable to remote code execution via an error in handling files using the Windows Metafile image format. Exploit code has been publicly posted and used to successfully attack fully-patched Windows XP SP2 systems. However, other versions of the the Windows operating system may be at risk as well.
I. Description
Windows Graphic Display Interface (GDI)

Windows GDI is an interface that "... enables applications to use graphics and formatted text on both the video display and the printer." GDI functions can be used to draw lines, text, curves and other graphical elements.

GDI Escape function

The GDI Escape function allows an application to access capabilities of a device that are not directly available through GDI. For example, a print job can be cancelled via a GDI Escape call.

Windows Metafile (WMF)

Microsoft Windows Metafile (WMF) format images are graphical files that can contain both vector and bitmap-based picture information. WMF files contain a sequence of GDI function calls. The image is created by executing the GDI functions.

The problem

Certain GDI functions can have unexpected security implications. According to the MSDN document Security Considerations: GDI:

Bitmaps, metafiles, and fonts are complex structures that could become corrupted. It is good practice to try to ensure that these items are uncorrupted and from a trustworthy source.

Current public exploits use the SETABORTPROC GDI Escape function to execute arbitrary code when viewed. The SETABORTPROC GDI Escape is obsolete, and is provided only for compatibility with 16-bit versions of Windows. Other GDI functions may also be exploitable.

The public exploits currently use the Windows Picture and Fax Viewer (SHIMGVW.DLL) as an attack vector affecting users of any Windows-based application that can handle Windows Metafiles. However, disabling the Windows Picture and Fax Viewer will not eliminate this vulnerability as it is currently thought to exist in the Windows Graphical Device Interface library (GDI32.DLL).

Google Desktop Search (GDS) can trigger the buffer overflow vulnerability if a malicious WMF file is placed in a location that is indexed. Other content indexing software may also be vulnerable. It is reported that various anti-virus software products cannot detect all known variants of exploits for this vulnerability.
II. Impact
A remote, unauthenticated attacker may be able to execute arbitrary code if the user is persuaded to view a specially crafted Windows Metafile.
III. Solution
We are currently unaware of a practical solution to this problem.

Disable or reset the file association for Windows Metafiles

Disabling or remapping Windows Metafile files to open a program other than the default Windows Picture and Fax Viewer may prevent exploitation via some attack vectors. Microsoft has suggested taking the following steps to disable shimgvw.dll in Microsoft Security Advisory (912840):

Microsoft has tested the following workaround. While this workaround will not correct the underlying vulnerability, it will help block known attack vectors. When a workaround reduces functionality, it is identified in the following section.

* Un-register the Windows Picture and Fax Viewer (Shimgvw.dll) on Windows XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows Server 2003 Service Pack 1

To un-register Shimgvw.dll, follow these steps:

1. Click Start, click Run, type "regsvr32 -u %windir%\system32\shimgvw.dll" (without the quotation marks), and then click OK.
2. A dialog box appears to confirm that the un-registration process has succeeded. Click OK to close the dialog box.

Impact of Workaround: The Windows Picture and Fax Viewer will no longer be started when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer.

To undo this change, re-register Shimgvw.dll by following the above steps. Replace the text in Step 1 with "regsvr32 %windir%\system32\shimgvw.dll" (without the quotation marks).

Do not access Windows Metafiles from untrusted sources

Exploitation occurs by accessing a specially crafted Windows Metafile. By only accessing Windows Metafiles from trusted or known sources, the chances of exploitation are reduced.

Attackers may host malicious Windows Metafiles on web sites. In order to convince users to visit their sites, those attackers often use a variety of techniques to create misleading links including URL encoding, IP address variations, long URLs, and intentional misspellings. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.

Block access to Windows Metafiles at network perimeters

By blocking access to Windows Metafiles using HTTP proxies, mail gateways, and other network filter technologies, system administrators may also limit potential attack vectors.

Please be aware we have confirmed that filtering based just on the WMF file extensions or MIME type application/x-msMetafile will not block all known attack vectors for this vulnerability. Filter mechanisms should be looking for any file that Microsoft Windows recognizes as a Windows Metafile by virtue of its file header. Please check with your network vendor for updated signatures. WMF files can begin with various byte sequences such as:

01 00 09 00 ...

02 00 09 00 ...

D7 CD C6 9A ...

Enable Data Execution Prevention (DEP)

Enable DEP for all applications, as described in the Microsoft TechNet article How to Configure Memory Protection in Windows XP SP2. It has been reported that hardware-enforced DEP may help mitigate this vulnerability. Software-enforced DEP is not effective in mitigating this vulnerability.
Systems Affected
Vendor Status Date Updated
Google Vulnerable 30-Dec-2005
Lotus Software Unknown 30-Dec-2005
Microsoft Corporation Vulnerable 29-Dec-2005
Mozilla, Inc. Unknown 28-Dec-2005
References

http://www.us-cert.gov/cas/techalerts/TA05-362A.html
http://www.microsoft.com/technet/security/advisory/912840.mspx
http://isc.sans.org/diary.php?rss&storyid=972
http://isc.sans.org/diary.php?storyid=975
http://secunia.com/advisories/18255/
http://www.securityfocus.com/bid/16074
http://vil.mcafeesecurity.com/vil/content/v_137760.htm
http://www.f-secure.com/weblog/archives/archive-122005.html#00000753
http://www.symantec.com/avcenter/venc/data/bloodhound.exploit.56.html
http://www.ciac.org/ciac/bulletins/q-085.shtml
http://www.juniper.net/security/auto/vulnerabilities/vuln2830.html

A Temporary Fix!!!

originally I posted a batch file, this seems to be a better solution:

http://www.hexblog.com/2005/12/wmf_vuln.html



.

Re: A Temporary Fix!!!

As a point of information, removal of links to some websites, and particularly any links to files that execute will be seriously considered for deletion for the safety of our members.

When an effective patch has been released, and there's been sufficient time for members to update, then we'll reevaluate the need.

This one is a very serious and dangerous exploit.

A Temporary Fix!!!

From CastleCops Website:
Ilfak Guilfanov who is being billed as one of the foremost experts in Windows low level technology has released a temporary/interim patch for Windows wrote a patch for his own system and released it.

http://www.hexblog.com/2005/12/wmf_vuln.html

Technical details: "this is a DLL which gets injected to all processes loading user32.dll. It patches the Escape() function in gdi32.dll. The result of the patch is that the SETABORT escape sequence is not accepted anymore."

Once Microsoft releases an official patch, or if the above doesn't work, you can uninstall it from your Add/Remove Programs menu. It'll be listed as "Windows WMF Metafile Vulnerability HotFix".

The Internet Storm Center gives this patch its stamp of approval:
We have very carefully scrutinized this patch. It does only what is advertised, it is reversible, and, in our opinion, it is both safe and effective.

The word from Redmond isn't encouraging. We've heard nothing to indicate that we're going to see anything from Microsoft before January 9th.

The upshot is this: You cannot wait for the official MS patch, you cannot block this one at the border, and you cannot leave your systems unprotected.

So there you have it, don't trust the firewall filters, don't trust the antivirus vendors, don't wait for Microsoft. Install the patch immediately. If you are running a Windows operating system the patch doesn't support, time to shut it off and wait.

.

Donovan, have you verified the patch by running it yourself? Did you unregister the DLL using your batch file as well, should we do both or is the patch by itself better than disassociating the DLL which may or may not work as some programs can reassociate it.

Radio said:

Donovan, have you verified the patch by running it yourself? Did you unregister the DLL using your batch file as well, should we do both or is the patch by itself better than disassociating the DLL which may or may not work as some programs can reassociate it.

Click to expand...

Yes I have installed the patch on all my systems... I renenabled the dll file since this patch takes care of the root of the problem and the dll file only protects the windows picture and fax viewer but not the other vulnerabilities... This patch has been reviewed and approved by SANS "the Internet storm center". This is a very trustworthy recomendation in my book...

Two years ago, I was fed up with Windows maintenance and jumped ship to Linux. Couldn't be happier -- but now I maintain several Windows networks at my school and am dying to put a Linux box on the network to make some tasks easier. With the enormous security lockdowns we have, maintenance is a dream -- most user systems are impervious to any Windows exploits because we use Deep Freeze -- one reboot, and back to a clean slate.

I've always thought .asf and .wmv files were bad news, after noticing some of them can launch my browser and navigate to preset homepages.

A thought just occurred to me -- if Windows Media Player is removed or disabled, is there still a vulnerability? (Using WinAMP or something instead?)

Donovan said:

A Temporary Fix!!!

From CastleCops Website:
Ilfak Guilfanov who is being billed as one of the foremost experts in Windows low level technology has released a temporary/interim patch for Windows wrote a patch for his own system and released it.

http://www.hexblog.com/2005/12/wmf_vuln.html

Technical details: "this is a DLL which gets injected to all processes loading user32.dll. It patches the Escape() function in gdi32.dll. The result of the patch is that the SETABORT escape sequence is not accepted anymore."
. . . . .

Click to expand...

This is the same patch available at the Internet Storm Center in my first post. It has been tested and seems to work. But remember, anytime you patch Windows with something like these non-MS fixes, if they don't work or screw up your system, you're basically SOL as far as MS is concerned. And don't forget to uninstall it before you use MS's fix, when it is available.

LMU

I would check with Steve Gibson's web site - author of Spinrite and great programmer who has now taken on Internet security as his focus. He has a page on this exploit and the fix:
Old version (of the previous suggested fix) download link removed. - Empath

The best info I have found thus far on this exploit is here:

Security Now! Podcast Episode 20 Shownotes

This is the main Security Now! page.

Microsoft now has a fix for this problem. Due to the risk involved in being unprotected, I'd urge you to quickly update your system.

If you have installed the temporary fixed that was discussed in this thread, remove it. Then, run your Windows Update. You can also go to this Microsoft page and select the file for your particular system.

http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx

Windows millenium edition here on my system, (still)
Win 98, 98se and Millenium editions are not affected by this mess according to Microsoft.
"whew"

I wouldn't say Millenium, and 98 isn't affected. According to the Microsoft site, they're not affected "critically". That could simply be due to a lack of interest in hackers targeting older versions of Windows. I'd still be cautious and watch for a fix.