Nearly live shoutbox
Last Message 1 day, 21 hours ago2 guests are online.- Rossco.eu : Theres nothing wrong with .NET =P And your just jealous you aint got a Mac ( I have 3 XD )
- Tarun : 394: AVG's bloated, has had recent resource leeching issues and the recent removal of user32.dll
- Guest_2905 : with the abundance of portable apps out, is there any reason to still install the full versions?
- Guest_394 : dont install AVG? Why?
- Tarun : 4473: You don't want to install Yahoo or AVG.
- Tarun : 580: Use Dial-a-fix to repair WU or reinstall it through Tools.
- Guest_4473 : i cannot install yahoo messenger and avg
- Guest_2088 : someone in SA suggest me to see you
- Guest_580 : how can I repair windows update engine
- DjLizard : Guest_2079: I have no idea what you're saying. Post a complete report at «link» in general tech support (NOT the Dial-a-fix forum)
- Guest_2079 : Software Distribution 3.0 how do you remove it?
- DjLizard : @Titotinton: The way this economy is going, I could definitely use any donation and it would be most appreciated. I have begun working on Dial-a-fix again and hope to be able to release a new version in the distant future.
- Tarun : @Titotinton: Any amount you can spare DjLizard is always helpful. People who show appreciation by donating help keep developers interested and motivated. It shows an active interest in their product.
- Tarun : @biff: 7 is going to be a lot like Vista, so DAF should be able to work with it without any major issues. But that's speculation right now.
- Titotinton : tell us how much do u want us to contribute i will my best to help ya out
- biff steelchin : But seriously, if Windows 7 is going to be significantly different (again), why bother woroking on a DAF release for Visturd rather than just moving forward to a W7 version?
- biff steelchin : dammit i just lost =(
- biff steelchin : Why am i still manually breathing?
- Tarun : News on Dial-a-fix: DjLizard : If people donate I might work on Dial-a-fix .... !
- luke : any word on Vista Dialafx yet gents?
- Brad : How you doing mike? long time no see.
- Guest_1839 : (oops) ...k on it.
- Guest_1839 : Hello there, now that i found this site, i just need to say, this is one of the most useful tools i have it works EVERY time, you did GREAT wor
- Digital404 : Hello there DjLizard i wanted to say nice work on the dial a fix program
- Ness : hehehe... the phone girl. I wonder who that is???
- The Phone Girl : We miss you Mr. Lizard!
- DjLizard : If people donate I might work on Dial-a-fix .... !
- DjLizard : Hello Ness! <3
- Guest_1784 : why is memory so expensive at Best Buy compared to those links?
- Guest_1784 : hi! Thanx for memory info
- Ness : Hello
Dec
28
This has hit the wild, and although everyone's reported it already, there is a workaround and something to note about Dial-a-fix, so I figure I should let the users of my site know about it.
Basically, it is an exploit that affects WMF (Windows meta file — clipart) files via a bug in shimgvw.dll. This is kind of similar to the JPEG exploit from a while back.
More info: http://www.securityfocus.com/brief/89
To sort-of work around this, you can go to Start > Run > and type regsvr32 /u shimgvw.dll. Dial-a-fix *does* register this DLL via the Shell checkmark on the More... dialog, so if you use that section of Dial-a-fix and want to stay protected from WMF files until Microsoft issues a patch, you must regsvr32 /u shimgvw.dll again after using that section of Dial-a-fix. Note that there will be a loss in functionality in various sections of Windows, as shimgvw.dll does a lot of things for XP, not just thumbnails and Picture and Fax Viewer. Firefox is not directly affected, but if you open or save the WMF file when prompted, you will then be attacked (when shimgvw.dll creates a thumbnail of the WMF, or if you open it from Firefox).
BugTraq update:
Tags: Operating systemsIf the exploit file is named with another graphics extension (i.e. .gif, .jpg, .png, .tif), the GDI library will still read it correctly as a WMF file and execute the exploit. As a result, all common graphics files can carry the exploit.
Comments
2 Responses to “WMF exploit”
Leave a Reply
Microsoft issued a patch for the WMF exploit.
One week after issuing an emergency patch for a vulnerability in Windows Meta File image processing that opened the door for arbitrary code execution, a new problem has been discovered in the format. But Microsoft has downplayed the concerns, saying the bug only causes "performance issues."
According to a posting to the Bugtraq mailing list, "Windows WMF graphics rendering engine is affected by multiple memory corruption vulnerabilities." The problems involve the ExtCreateRegion and ExtEscape functions.
See here: