SecurityFocus

WMF browser-ish exploit vectors Dec 29 2005 09:10PM
Evans, Arian (Arian Evans fishnetsecurity com) (2 replies)

Re: WMF browser-ish exploit vectors Jan 03 2006 07:09PM
Dave Korn (davek_throwaway hotmail com) (1 replies)

RE: WMF browser-ish exploit vectors Jan 05 2006 10:36PM
James C Slora Jr (Jim Slora phra com)

Dave Korn wrote

> Have you tried giving it a mpg/avi/wma/wmv extension and getting
> it to open in a (perhaps embedded) mediaplayer? That's liable to
> work as well; mediaplayer is also vulnerable to the
>
choose-an-app-based-on-extension/app-loads-a-viewer-based-on-actual-cont
ent
> desynchronisation attack...

I have seen at least one cached .wmz (Windows Media Player Skin) file
trigger AV alerts for the WMF exploit (Symantec Bloodhound.Exploit.56) after
having been opened in WMP10.

[ reply ]

Re: WMF browser-ish exploit vectors Dec 31 2005 12:29AM
Nick FitzGerald (nick virus-l demon co uk)