This is topic Big security hole in .WMF file format in forum Film-Yak at Film-Tech Forum ARCHIVE.


To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=8;t=004418

---

Posted by Bobby Henderson (Member # 840) on 12-30-2005, 11:54 AM:
 
Apparently some really big security hole has been uncovered in the Windows Metafile format, a graphics format able to hold both vector-based and bitmap-based artwork.

Microsoft products like Word and Publisher are the main movers of images in this file format, although professional level graphics programs like Adobe Illustrator and CorelDRAW can open and export in .WMF as well. Lots of other applications can index and preview .WMF files, including Internet Explorer, Outlook Express and Google Desktop.

Simply previewing the image can launch malicious code deliberately hidden within a .WMF file. Some applications apparently bring up a dialog box asking the user to hit OK to allow the malware to install. In the case of Internet Explorer and Outlook Express, the malware is immediately installed with no dialog box displayed.

Professional level graphics file management programs like Adobe Bridge can preview and index .WMF images as well. I'm trying to get some word from Adobe's tech support on how vulnerable Bridge is to allowing malware to install.

This exploit apparently works on fully patched Windows systems. In addition to working on XP Home and XP Pro, it also can affect variants of Windows2003 Server Edition.

The problem allowing this exploit: when Microsoft created the .WMF format they wrote in the capability for the file to make a "callback" to the system. I guess that's for file indexing purposes or some other technical stuff like that. But that feature is also the hole malware writers are exploiting with glee. More than 50 adware and spyware variants have been spotted. Viruses may be soon to follow.

E-Week calls the .WMF hole a "zero day exploit," meaning it is about as bad as any alert can get. One opinion writer on the site said the .WMF format is now officially ruined.

Most computer users are only going to get hit by this bug from viewing malicious web pages or clicking on links that take them to harmful web pages.

People who deal with graphics files on a constant basis (such as me) can be vulnerable. I handle lots of customer submitted art files all the time. Very often customers have the .WMF format as their only vector-based option for sending logos from applications like MS Pubisher. I can just see some virus writer being able to make a worm that infects every .WMF on a user's system. Then when I get their logo to use on a sign my system could potentially get infected.

I've already banned .ZIP files from being used for customer submitted artwork. Now it looks like I have to refuse any .WMF files that come my way as well.

 

---

Posted by David Stambaugh (Member # 1102) on 12-30-2005, 02:01 PM:
 

quote: Bobby Henderson

---

This exploit apparently works on fully patched Windows systems.

---

quote:

---

Code for what Secunia is deeming an "extremely critical flaw" in Windows Metafile Format files is being exploited on fully patched systems. Researchers are currently tracking thousands of sites distributing the exploit code.

---