WMF flaw can't wait for Microsoft fix, researchers say

Security researchers advise Windows users to install an unofficial patch without waiting for Microsoft to react to the WMF threat.

Users of the Windows OS should install an unofficial security patch now, without waiting for Microsoft to make its move, security researchers at The SANS Institute's Internet Storm Center (ISC) advised on Sunday.

Their recommendation follows a new wave of attacks on a flaw in the way versions of Windows from 98 through XP handle malicious files in the WMF (Windows Metafile) format. One such attack arrives in an e-mail message entitled "happy new year," bearing a malicious file attachment called "HappyNewYear.jpg" that is really a disguised WMF file, security research companies including iDefense and F-Secure said Sunday. Even though the file is labelled as a JPEG, Windows recognizes the content as a WMF and attempts to execute the code it contains.

Microsoft advised on Dec. 28 that to exploit a WMF vulnerability by e-mail, "customers would have to be persuaded to click on a link within a malicious e-mail or open an attachment that exploited the vulnerability." Microsoft's advisory can be found at http://www.microsoft.com/technet/security/advisory/912840.mspx

However, simply viewing the folder that contains the affected file, or even allowing the file to be indexed by desktop search utilities such as the Google Desktop, can trigger its payload, F-Secure's Chief Research Officer Mikko Hypponen wrote in the company's blog on Sunday.

In addition, source code for a new exploit was widely available on the Internet by Saturday, allowing the creation of new attacks with varied payloads.The file "HappyNewYear.jpg," for example, attempts to download the Bifrose backdoor, researchers said.

These factors exacerbate the problem, according to Ken Dunham, director of the rapid response team at iDefense Inc.

"Risk has gone up significantly in the past 24 hours for any network still not protected against the WMF exploit," Dunham warned in an e-mail on Sunday.

Alarmed by the magnitude of the threat, staff at the ISC worked over the weekend to validate and improve an unofficial patch developed by Ilfak Guilfanov to fix the WMF problem, according to an entry in the Handler's Diary, a running commentary on major IT security problems on the ISC Web site at http://isc.sans.org/diary.php

"We have very carefully scrutinized this patch. It does only what is advertised, it is reversible, and, in our opinion, it is both safe and effective," Tom Liston wrote in the diary.

"You cannot wait for the official MS patch, you cannot block this one at the border, and you cannot leave your systems unprotected," Liston wrote.

In the diary, ISC provided a link to the version of the patch it has examined, including a version designed for unattended installation on corporate systems.

While ISC recognizes that corporate users will find it unacceptable to install an unofficial patch, "Acceptable or not, folks, you have to trust someone in this situation," Liston wrote.

Due to public holidays in Europe, Microsoft representatives could not immediately be reached for comment on Monday morning.

Guilfanov published his patch on his Web site on Saturday. His introduction to it can be found at http://www.hexblog.com/2005/12/wmf_vuln.html

F-Secure's Hypponen highlighted Guilfanov's patch in the F-Secure company's blog on Saturday night, and then on Sunday echoed the ISC's advice to install the patch.

Not all computers are vulnerable to the WMF threat: those running non-Windows operating systems are not affected.

According to iDefense's Dunham, Windows machines running Windows Data Execution Prevention (DEP) software are at least safe from the WMF attacks seen so far. However, Microsoft said that software DEP offered no protection from the threat, although hardware DEP may help.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Peter Sayer

IDG News Service
Show Comments


James Cook University - Master of Data Science Online Course

Learn more >


Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?