Interestingly, I presume shortly after receiving information on how to
identify it, ClamAV tagged a bunch of sample WMFs that come with an
older version of Broderbund's PrintMaster Gold in a backup folder from a
user's machine. It wasn't clear to me if the files actually contained
threats, or if simply having anything in that code block would trigger
the scanner to report it. Needless to say, those files and folders have
been summarily toasted regardless.
This fix also got /. coverage today.
And yes, this is an across-the-board vulnerability; it is not tied
directly to IE at all, in fact -- it's tied to legacy standards in
effect since Windows 3.0 which provided for the executable block of
WMFs, and Explorer's tendency to open and read portions of every file in
a folder when you browse its parent folder, in order to create thumbnails.
Or so I've read.
~B
David A. Cafaro wrote:
Actually if a user isn't careful, they could get infected using firefox.
It will pop up as a windows media file and ask if you want to play it,
if the user clicks yes, click, they are infected. Unfortunetly users do
these kinds of things...
(PS, this is from experience, luckily Norton AV actually caught it as it
was downloaded after the users clicked yes, user:"I thought it was the
video I was looking for...")
On Wed, 2006-01-04 at 09:10 -0500, jonc wrote:
--
TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug
TriLUG Organizational FAQ : http://trilug.org/faq/
TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
