Windows Security Exploit

Posted on December 28, 2005 No Comments

This one seems to be awfully ugly. Here’s a note I just sent to my folks at work:

There’s a very ugly new exploit out there that you can get just by hitting a web site. The issue is that .wmv files can be crafted in a way that results in your machine being boogered up.

Links:
http://www.securityfocus.com/bid/16074/discuss
http://sunbeltblog.blogspot.com/2005/12/new-exploit-blows-by-fully-patched.html

Doesn’t matter if your machine is fully patched or not. The key appears to be that most browsers automatically open .wmv (video) files.

To the best of my knowledge, there’s no patch out yet. One option I saw (at Digg) was to run a little reg file to remove the wmv default association. Check this link — scroll down a bit. Be careful folks! This sure seems ugly.

[added]

Sans has some info now too.

[added even later]

The F-Secure blog explains it all much better than I can. Give it a read. Meanwhile, I’ll be over in the corner quietly freaking out. Don’t mind me. But wow…