MS-ISAC ADVISORY NUMBER:
2006-001

DATE(S) ISSUED:

01/09/2006

SUBJECT:
New Unpatched WMF Vulnerability in Microsoft Windows

OVERVIEW:

A new vulnerability in multiple versions of Windows has been discovered in the portion of Windows that processes a specific type of image file called Windows Meta File (WMF). This vulnerability is separate from the recent WMF vulnerability that was patched in Microsoft Security Bulletin MS06-001 on January 5, 2006. There is currently no patch for this vulnerability.

In order to be exploited, a user must visit a malicious web site, open an email message, or access a computer directory folder that contains a specially-crafted WMF file.

SYSTEMS AFFECTED:

  • Microsoft Windows XP Tablet PC Edition SP2
  • Microsoft Windows XP Tablet PC Edition SP1
  • Microsoft Windows XP Tablet PC Edition
  • Microsoft Windows XP Professional x64 Edition
  • Microsoft Windows XP Professional SP2
  • Microsoft Windows XP Professional SP1
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Media Center Edition SP2
  • Microsoft Windows XP Media Center Edition SP1
  • Microsoft Windows XP Media Center Edition
  • Microsoft Windows XP Home SP2
  • Microsoft Windows XP Home SP1
  • Microsoft Windows XP Home
  • Microsoft Windows Server 2003 Web Edition SP1
  • Microsoft Windows Server 2003 Web Edition
  • Microsoft Windows Server 2003 Standard x64 Edition
  • Microsoft Windows Server 2003 Standard Edition SP1
  • Microsoft Windows Server 2003 Standard Edition
  • Microsoft Windows Server 2003 Enterprise x64 Edition
  • Microsoft Windows Server 2003 Enterprise Edition 64-bit SP1
  • Microsoft Windows Server 2003 Enterprise Edition 64-bit
  • Microsoft Windows Server 2003 Enterprise Edition SP1
  • Microsoft Windows Server 2003 Enterprise Edition
  • Microsoft Windows Server 2003 Datacenter x64 Edition
  • Microsoft Windows Server 2003 Datacenter Edition 64-bit SP1
  • Microsoft Windows Server 2003 Datacenter Edition 64-bit
  • Microsoft Windows Server 2003 Datacenter Edition SP1
  • Microsoft Windows Server 2003 Datacenter Edition
  • Microsoft Windows ME
  • Microsoft Windows 98SE
  • Microsoft Windows 98
  • Microsoft Windows 2000 Server SP4
  • Microsoft Windows 2000 Server SP3
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Professional SP4
  • Microsoft Windows 2000 Professional SP3
  • Microsoft Windows 2000 Professional SP2
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Datacenter Server SP4
  • Microsoft Windows 2000 Datacenter Server SP3
  • Microsoft Windows 2000 Datacenter Server SP2
  • Microsoft Windows 2000 Datacenter Server SP1
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows 2000 Advanced Server SP4
  • Microsoft Windows 2000 Advanced Server SP3
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server
  • Avaya DefinityOne Media Servers
  • Avaya IP600 Media Servers
  • Avaya S3400 Message Application Server
  • Avaya S8100 Media Servers

RISK:
Government:

  • Large and medium government entities: Medium
  • Small government entities: High

Businesses:

  • Large and medium business entities: Medium
  • Small business entities: High

Home users: High

DESCRIPTION:

A new vulnerability in multiple versions of Windows has been discovered in the portion of Windows that processes a specific type of image file called Windows Meta File (WMF). This vulnerability is separate from the WMF vulnerability that was patched in Microsoft Security Bulletin MS06-001 on January 5, 2006. There is currently no patch for this vulnerability.

These vulnerabilities exist in the 'ExtCreateRegion' and 'ExtEscape' functions of the Microsoft Windows WMF graphics rendering engine. There are currently no public exploits for this WMF vulnerability. CSCIC is still researching whether publicly-available exploit code for the previous WMF vulnerability may provide a framework for a new exploit.

In order to be exploited, a user must visit a malicious web site, open an email message, or access a computer directory folder that contains a specially-crafted WMF file. Reports indicate that successful exploitation can lead to a Denial of Service, and CSCIC is still researching whether remote code execution may be possible.

RECOMMENDATIONS:
CSCIC recommends the following actions be taken:

  • Update your anti-virus software as soon as a signature for this specific vulnerability is released. 
  • If possible, limit user access to trusted Web sites only.
  • Filter all incoming Windows format Meta File (WMF) content at email gateways and proxy servers if possible until patches have been released and applied to all vulnerable systems. Note that WMF images are not typically used on web sites or to send images via email therefore blocking them should have little business impact.

REFERENCES:

Security Focus:
 http://www.securityfocus.com/bid/16167(New Window)

SANS:
 http://isc.sans.org/diary.php?storyid=1031(New Window)


This cyber advisory was issued by the Multi-State Information Sharing and Analysis Center (MS-ISAC) and was intended for government entities. The information may or may not be applicable to the general public and accordingly, the MS-ISAC does not warrant its use for any specific purposes.