[41854] in bugtraq
WMF Exploit
daemon@ATHENA.MIT.EDU (davidribyrne@yahoo.com)
Wed Dec 28 17:57:59 2005
Date: 28 Dec 2005 22:18:04 -0000
Message-ID: <20051228221804.21263.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: davidribyrne@yahoo.com
To: bugtraq@securityfocus.com
Another quick observation, again, I apologize if this information has already been posted; I haven’t been able to read all the posts today. The thumbnail view in Windows Explorer will parse the graphics files in a folder, even if the file is never explicitly opened. This is enough to trigger the exploit. Even more frightening is that you don’t have to use the thumbnail view for a thumbnail to be generated. Under some circumstances, just single-clicking on the file will cause it to be parsed.
David Byrne
