Windows Animated Cursor Handling vulnerability could give problems!
Microsoft has released advisory 935423 regarding a vulnerability in Windows Animated Cursor Handling. A bug in the way Windows renders animated cursor files can allow execution of arbitrary code under the privileges of the user that downloaded the malicious file. CVE-2007-0038 (previously also CVE-2007-1765) has been assigned to this vulnerability. Affected are Win2k, XP, Server 2003 and Vista (UPDATED). While Animated cursors are usually downloaded as .ani files, blocking these files is not sufficient to mitigate the vulnerability. I have received confirmation of this vulnerability being exploited in the wild using files renamed to jpeg. McAfee has a nice blog entry up on this. They also have a second blog entry with a video showing windows explorer crashing in a loop on windows vista when dropping a malicious animated cursor on the desktop. Trend Micro is reporting here on malicious . ANI files and related links being spread over the web and through e-mail that attempt to download a trojan executable WINCF.EXE. Also F-Secure is reporting on this at their weblog.
What can you do:
Microsoft is reporting that users of Internet Explorer 7 with Protection Mode are protected from active exploitation. E-mails opened in plaintext will not show embedded ANI files. Note that HTML attachments can still be interpreted when separately clicked upon. Anti-virus detection is improving now, with F-Secure, CA, Kaspersky, Trend, Sophos, McAfee and Microsoft detecting malicious ANI files. One specific file was also discovered by a product triggering on a signature written for MS05-002, a similar vulnerability from 2005. This will not apply to most exploits in the wild.
Microsoft has also now confirmed that:
Outlook 2007 users are protected (as the tool uses Word to display HTML messages);
Users of Windows Mail on Vista are protected if they do not forward or reply to malicious e-mail; Outlook Express users remain vulnerable even when reading e-mail as plaintext.
Eeye has released an unofficial patch that you may wish to consider as well .
It was a little bit too quiet these days wasn't it ... well I'm preparing myself something new ... stay tuned! ;-)
What can you do:
Microsoft is reporting that users of Internet Explorer 7 with Protection Mode are protected from active exploitation. E-mails opened in plaintext will not show embedded ANI files. Note that HTML attachments can still be interpreted when separately clicked upon. Anti-virus detection is improving now, with F-Secure, CA, Kaspersky, Trend, Sophos, McAfee and Microsoft detecting malicious ANI files. One specific file was also discovered by a product triggering on a signature written for MS05-002, a similar vulnerability from 2005. This will not apply to most exploits in the wild.
Microsoft has also now confirmed that:
Outlook 2007 users are protected (as the tool uses Word to display HTML messages);
Users of Windows Mail on Vista are protected if they do not forward or reply to malicious e-mail; Outlook Express users remain vulnerable even when reading e-mail as plaintext.
Eeye has released an unofficial patch that you may wish to consider as well .
It was a little bit too quiet these days wasn't it ... well I'm preparing myself something new ... stay tuned! ;-)
posted by Eddy Willems at 1:01 pm
<< Home