Microsoft Windows metafiles are a vector for computer viruses

There are no reviewed versions of this page, so it may not have been checked for adherence to standards.

Monday, January 2, 2006

Microsoft Windows metafiles have been discovered to be a vector for computer viruses, as they are treated as image files, but can execute machine code. Windows metafiles often use the extension .wmf files, but they may also execute if their extension is .jpeg, .png or any other common image extension.

This vulnerability affects any Windows software which displays images, including instant messenger software, email clients, and web browsers. Firefox reduces the vulnerability by asking a user before executing Windows metafiles, but metafiles masquerading as another format will still be executed automatically by the operating system.

Microsoft has not yet issued a patch for the vulnerability, prompting Ilfak Guilfanov to release an unofficial patch. Microsoft's security advisory recommends unregistering shimgvw.dll to disable handling of Windows MetaFiles. Critics point out that shimgvw.dll could become re-registered by malicious processes or other installations. They also suggest that malicious Windows Metafiles could merely remain "dormant" until shimgvw.dll is re-registered.

The exploit has been used to attack online forums which allow embedding of image files via <img> tags, prompting some gaming forums to disable <img> tags [1]. Any site accepting image media upload, such as avatars, will also be vulnerable if this site accepts .wmf files, possibly masquerading as another media file format.

The exploit has also been used by an instant messaging worm, which appears to provide a backdoor for later exploitation via an IRC bot [2].

The McAfee antivirus company said the WMF vulnerability is being exploited to drop over 30 variants of the Bifrose backdoor trojan horse, and exploitation by other malware is likely. McAfee estimates the first generation of such exploits had infected more than 6% of their customer base by 31 December 2005.

"The WMF vulnerability probably affects more computers than any other security vulnerability, ever," said Mikko of F-Secure. [3]

External links

Wikipedia

Wikipedia has more about this subject:

Windows Metafile vulnerability

News Coverage

Brian Krebs. "Exploit Released for Unpatched Windows Flaw" — Washington Post, December 28, 2005

Share this:

This page is archived, and is no longer publicly editable.

Articles presented on Wikinews reflect the specific time at which they were written and published, and do not attempt to encompass events or knowledge which occur or become known after their publication.

Got a correction? Add the template {{editprotected}} to the talk page along with your corrections, and it will be brought to the attention of the administrators.

Please note that due to our archival policy, we will not alter or update the content of articles that are archived, but will only accept requests to make grammatical and formatting corrections.

Note that some listed sources or external links may no longer be available online due to age.

The text of this article is licensed under the terms of the Creative Commons Attribution 2.5 License