Microsoft Windows Graphics Rendering Engine WMF SetAbortProc Code Execution Vulnerability

A remote code-execution exploit that triggers this issue is currently circulating in the wild.

An exploit (ie_xp_pfv_metafile.pm revision 1.6) has been released for the Metasploit Framework.

A new exploit (ie_xp_pfv_metafile-19.pm revision 1.9) has been released for the Metasploit Framework. Reports indicate that this exploit can bypass current antivirus and snort signatures.

UPDATE: There are a reports of a worm that is exploiting this vulnerability over MSN. The worm is allegedly enticing users to download a file entitled "xmas-2006 FUNNY.jpg" through links distributed in instant messages. Symantec is currently investigating this. This BID will be updated as more information emerges.

Exploit code wmf_exp.c has been supplied by Unl0ck Research Team. Symantec has not verified the integrity of this exploit.

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.


 

Privacy Statement
Copyright 2010, SecurityFocus