ThreatCon Level is 3 Microsoft has released a security bulletin MS06-001 in response to the WMF vulnerability which includes a patch to address the problem. Customers are advised to apply the patch as soon as possible. Threatcon Level 1 Low : Basic network posture This condition applies when there is no discernible network incident activity and no malicious code activity with a moderate or severe risk rating. Under these conditions, only a routine security posture, designed to defeat normal network threats, is warranted. Automated systems and alerting mechanisms should be used. Threatcon Level 2 Medium : Increased alertness This condition applies when knowledge or the expectation of attack activity is present, without specific events occurring or when malicious code reaches a moderate risk rating. Under this condition, a careful examination of vulnerable and exposed systems is appropriate, security applications should be updated with new signatures and/or rules as soon as they become available and careful monitoring of logs is recommended. Changes to the security infrastructure are not required. Threatcon Level 3 High : Known threat This condition applies when an isolated threat to the computing infrastructure is currently underway or when malicious code reaches a severe risk rating. Under this condition, increased monitoring is necessary, security applications should be updated with new signatures and/or rules as soon as they become available and redeployment and reconfiguration of security systems is recommended. People should be able to maintain this posture for a few weeks at a time, as threats come and go. Threatcon Level 4 Extreme : Full alert This condition applies when extreme global network incident activity is in progress. Implementation of measures in this Threat Condition for more than a short period probably will create hardship and affect the normal operations of network infrastructure. Microsoft Windows Graphics Rendering Engine WMF SetAbortProc Code Execution Vulnerability</span> Risk High Date Discovered <span style=\'color:red\'>12-28-2005 Description Microsoft Windows WMF graphics rendering engine is affected by a remote code execution vulnerability. This issue affects the 'SetAbortProc' function. The problem presents itself when a user views a malicious WMF formatted file, triggering the vulnerability when the engine attempts to parse the file. The issue may be exploited remotely or by a local attacker. Any remote code execution that occurs will be with the privileges of the user viewing a malicious image. An attacker may gain SYSTEM privileges if an administrator views the malicious file. Local code execution may facilitate a complete compromise. AntiVirus Products A heuristic detection has been released to detect possible exploits of this vulnerability. Symantec Antivirus products will detect files which contain code to exploit this vulnerability as Bloodhound.Exploit.56. Platforms Affected Avaya DefinityOne Media Servers Avaya IP600 Media Servers Avaya S3400 Message Application Server Avaya S8100 Media Servers Components Affected IBM Lotus Notes 6.5 IBM Lotus Notes 6.5.1 IBM Lotus Notes 6.5.2 Recommendations Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells. Do not allow untrusted individuals to have local access to computers. This may limit exposure to local attack vectors. Deploy network intrusion detection systems to monitor network traffic for malicious activity. Deploy network intrusion detection systems to monitor all network traffic for signs of suspicious or anomalous activity. This may aid in detecting attempts to exploit latent vulnerabilities or in detecting malicious activity that occurs as a result of successful exploitation. Do not accept or execute files from untrusted or unknown sources. Users should not accept files from untrusted or unknown sources as they may be malicious in nature. Do not follow links provided by unknown or untrusted sources. Users should avoid Web sites of questionable integrity and not follow links supplied by unknown or untrusted sources. Do not accept communications that originate from unknown or untrusted sources. Disabling client support for HTML email may limit exposure to this attack vector. Implement multiple redundant layers of security. As it may be possible that this issue will be leveraged to execute code, memory protection schemes are recommended. Memory protection schemes such as non-executable stack/heap configurations and randomly mapped memory segments may complicate exploitation of memory corruption vulnerabilities. Microsoft has released a security advisory (Microsoft Security Advisory (912840)) confirming this issue. The referenced advisory contains information about workarounds and the vendor plans to release updates in the near future. Please see the advisory for more information. Microsoft plans to release updates to address this issue on Tuesday, January 10, 2006. Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] . IBM Lotus Notes 6.5: IBM Lotus Notes 6.5.1: IBM Lotus Notes 6.5.2: References Source: Lotus Notes vulnerable to MS Windows graphics rendering engine bug URL: http://www.nist.org/nist_plugins/content/c....php?content.25 Source: Microsoft Security Advisory (912840) URL: http://www.microsoft.com/technet/security/...ory/912840.mspx Source: Technet Security URL: http://www.microsoft.com/technet/treeview/...ity/default.asp Source: Vulnerabilities in Graphics Rendering Engine May Still Exist Even After Applying URL: http://redxii.blogspot.com/2005/12/vulnera...-rendering.html Source: Vulnerability Note VU#181038 - Microsoft Windows Metafile handler buffer overflo URL: http://www.kb.cert.org/vuls/id/181038 Credits The individual responsible for discovering this issue not currently known. Copyright © 2006 by Symantec Corp. Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from [email protected]. Disclaimer The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. Symantec, Symantec products, Symantec Security Response, and SymSecurity are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners. Personal notes Back up all your importent files on your computer. As of now there is no patch to fix this problem and it will probabley happen no time soon. So I would say back up all your psd png etc. Also try not to keep anything of value or personal information on your computer. ie Visa number phone credits card numbers social insurance number etc. protect your self as much as you can.
Microsoft released the patch today earlier than expected, but that is good, get to microsoft update and update your computer as soon as possible.
[EDIT]: BTW where's the patch? i'll look for it i was too lazy to click on all those links you provided i skimmed through your post, lol OMG ONE VERY IMPORTANT NOTE: did anyone visit the link here at: http://redxii.blogspot.com/2005/12/vulnera...-rendering.html ??? i remember actually having this happen to me TWICE (the Spyware Infection wallpaper thingy). I HAD TO REFORMAT BOTH TIMES. the first time i re-formatted after spending a mere 3 hours. the second time i got it, i worked for about 6-10 hours straight. the wallpaper thing really scared the crap outta me... hehe. i finally got rid of it. it's an HTML file, btw. lol. anyway it also put a program on my system called "Spy Sherriff" or something like that. perhaps it wasn't EXACTLY this virus. it was quite close. i forgot how i did it but it was hell. the most terrible virus since the W32.Klez.H that i got once. that was before... XP SP2, when everyone still used Windows 2000. i know i was, at the time. i fortunately have ... some... protection now and SP2 i think with the info you've provided our computers should all be protected from most threats great job m8, keep it up! ~nightfire -------------------------------- ORIGINAL MESSAGE: hehe this is freaky. everyone believes they're invincible, however. i am one of those people. i had to pull my legs off to even upgrade to SP2. i'm glad i did, though - LOL okay. as everyone else said: ZOMG!!! GOTTA PATCH IT! n000www!! thanks m8 for the info, i hope this helps - i'm sure it will. again, thanks m8, my eternal thanks m8, keep it up, thanks m8. LOLOL ~nightfire
Just type in microsoft update in the adress bar ( You have to use IE) and hit express, and it will search for any important updates that your computer doesn't have.
