Microsoft Windows metafiles are a vector for computer viruses
{{date|January  2, 2006}}

[[w:Windows Metafile|Microsoft Windows metafiles]] have been discovered to be a vector for computer viruses, as they are treated as image files, but can execute machine code.  Windows metafiles often use the extension .wmf files, but they may also execute if their extension is .jpeg, .png or any other common image extension.
{{Wikinews Today short infobox}}
This vulnerability affects any Windows software which displays images, including instant messenger software, email clients, and web browsers. Firefox reduces the vulnerability by asking a user before executing Windows metafiles, but metafiles masquerading as another format will still be executed automatically by the operating system.

Microsoft has not yet issued a patch for the vulnerability, prompting [[w:Ilfak Guilfanov|Ilfak Guilfanov]] to release an [http://www.hexblog.com/2005/12/wmf_vuln.html#more unofficial patch]. Microsoft's security advisory recommends unregistering shimgvw.dll to disable handling of Windows MetaFiles. Critics point out that shimgvw.dll could become re-registered by malicious processes or other installations.  They also suggest that malicious Windows Metafiles could merely remain "dormant" until shimgvw.dll is re-registered.

The exploit has been used to attack online forums which allow embedding of image files via &lt;img&gt; tags, prompting some gaming forums to disable &lt;img&gt; tags [http://www.ga-forum.com/announcement.php?f=2&announcementid=23].  Any site accepting image media upload, such as [[w:avatar (virtual reality)|avatars]], will also be vulnerable if this site accepts .wmf files, possibly masquerading as another media file format.  <!-- The [[w:MediaWiki|MediaWiki]] software running [[w:Wikipedia|Wikipedia]] and [[w:Wikinews|Wikinews]] attempts to verify the image file format of uploaded media. -->

The exploit has also been used by an instant messaging worm, which appears to provide a backdoor for later exploitation via an [[w:IRC bot|IRC bot]] [http://www.viruslist.com/en/weblog?discuss=176892530&return=1].

The [[w:McAfee|McAfee]] antivirus company said the WMF vulnerability is being exploited to drop over 30 variants of the [[w:Bifrose (trojan horse)|Bifrose]] [[w:backdoor|backdoor]] [[w:trojan horse (computing)|trojan horse]], and exploitation by other [[w:malware|malware]] is likely.  McAfee estimates the first generation of such exploits had infected more than 6% of their customer base by 31 December 2005.  

"The WMF vulnerability probably affects more computers than any other security vulnerability, ever," said Mikko of F-Secure. [http://www.f-secure.com/weblog/archives/archive-012006.html#00000761]

== External links ==
{{wikipediapar|Windows Metafile vulnerability}}
*[http://www.f-secure.com/weblog/archives/archive-122005.html#00000757 F-secure's coverage of the vulnerability]
*[http://www.viruslist.com/en/weblog?discuss=176892530&return=1 Viruslist.com's anaysis of the IM worm].
*[http://www.viruslist.com/en/viruses/alerts?alertid=176701669 Viruslist.com's initial report]
*[http://www.microsoft.com/technet/security/advisory/912840.mspx Microsoft Security Advisory (912840)]
*[http://www.kb.cert.org/vuls/id/181038 US-CERT Vulnerability Note VU#181038]
*[http://isc.sans.org/diary.php?storyid=994 Internet Storm Center WMF FAQ]

== News Coverage ==
*{{source|url=http://blogs.washingtonpost.com/securityfix/2005/12/exploit_release.html
|title= Exploit Released for Unpatched Windows Flaw
|author=Brian Krebs
|pub=Washington Post
|date=December 28, 2005}}

  
{{publish}}

 {{archive}}
[[Category:Science and technology]]
[[Category:Internet]]
[[Category:Microsoft]]

[[ca:Descobrixen vulnerabilitat seriosa dels arxius WMF de Microsoft Windows]]
[[es:Descubren vulnerabilidad seria de los archivos WMF de Microsoft Windows]]
Microsoft Windows metafiles have been discovered to be a vector for computer viruses, as they are treated as image files, but can execute machine code.  Windows metafiles often use the extension .wmf files, but they may also execute if their extension is .jpeg, .png or any other common image extension.

This vulnerability affects any Windows software which displays images, including instant messenger software, email clients, and web browsers. Firefox reduces the vulnerability by asking a user before executing Windows metafiles, but metafiles masquerading as another format will still be executed automatically by the operating system.

Microsoft has not yet issued a patch for the vulnerability, prompting Ilfak Guilfanov to release an  unofficial patch. Microsoft's security advisory recommends unregistering shimgvw.dll to disable handling of Windows MetaFiles. Critics point out that shimgvw.dll could become re-registered by malicious processes or other installations.  They also suggest that malicious Windows Metafiles could merely remain "dormant" until shimgvw.dll is re-registered.

The exploit has been used to attack online forums which allow embedding of image files via  tags, prompting some gaming forums to disable  tags .  Any site accepting image media upload, such as avatars, will also be vulnerable if this site accepts .wmf files, possibly masquerading as another media file format.  

The exploit has also been used by an instant messaging worm, which appears to provide a backdoor for later exploitation via an IRC bot .

The McAfee antivirus company said the WMF vulnerability is being exploited to drop over 30 variants of the Bifrose backdoor trojan horse, and exploitation by other malware is likely.  McAfee estimates the first generation of such exploits had infected more than 6% of their customer base by 31 December 2005.  

"The WMF vulnerability probably affects more computers than any other security vulnerability, ever," said Mikko of F-Secure.
Science and technology Internet Microsoft