WMF 0-day: Exploit spreads, defenses few

WMF 0-day: Exploit spreads, defenses few
Robert Lemos, 2005-12-30

WMF 0-day: Exploit spreads, defenses few 2005-12-30
Anonymous (3 replies)

Re: WMF 0-day: Exploit spreads, defenses few 2005-12-31
TJ

Re: UPDATE WMF 0-day: Exploit spreads, defenses few 2006-01-01
dz

Better:

1) Deregister the dll

2) Eliminate the vulnerable code:

copy /Y %windir%\system32\notepad.exe %windir%\system32\shimgvw.dll

AND

copy /Y %windir%\system32\notepad.exe %windir%\system32\DLLCACHE\shimgvw.dll

AND

3) Don't install Irfanview as Alternative!

Although shimgvw.dll is still not functionable , the System will be vulnerable again !

Uses Irfanview the same Code ???

Are other Pictureviewer also vulnerable ????

Tested: After the workaround, Off2003 Picture Manager is not vulnerable.

What a nice new Year !!

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/91/395#395

Re: WMF 0-day: Exploit spreads, defenses few 2006-01-03
Anonymous

SpyWall from Trlokom blocks WMF 0-day Exploit 2006-01-03
JS

WMF 0-day: Exploit spreads, defenses few 2006-01-05
Anonymous