Security threats Toolkit

Story: Firms urged to use unauthorised Windows patch

• 
• 

John L.

>After installing it and following all instructions
>regarding unregistering a dll. etc I found that I could
>no longer access ANY of my jpegs.

This is by design, this is what the Microsoft part of the workaround is actually supposed to do.

I draw your attention to the penultimate paragraph of the article you are replying to:

>Security experts say the WMF exploit is potentially
>very dangerous as conventional antivirus
>software and IDS signatures do not recognise the
>malicious code in email spam, as the exploit is
>sent in seemingly normal JPEG, GIF, or Bitmap
>files.

This means that untill either Microsoft release a patch, or the exploit is foiled, any graphical image format supported by the dll you just unregistered is potentially a virus risk.

Any image file, any you view with a web browser, or recieve through the mail. Including those spam images you didn't ask for, are all potential plague rats.

That's how big this problem has the potential of being.

This page:
http://isc.sans.org/diary.php

Is advising Organisations to think about disconnecting from the internet. Switching off all web and email traffic. This has the potential to be a lot more serious that not being able to view a few jpegs.

• 
• 

• 
• 
• 

Full Talkback thread