[41853] in bugtraq
WMF Exploit
daemon@ATHENA.MIT.EDU (davidribyrne@yahoo.com)
Wed Dec 28 17:47:12 2005
Date: 28 Dec 2005 21:52:17 -0000
Message-ID: <20051228215217.19530.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: davidribyrne@yahoo.com
To: bugtraq@securityfocus.com
I apologize if this information has already been posted; I haven’t been able to read all the posts today. Many of the exploit descriptions that I’ve seen reference .WMF files. Like prior GDI exploits, this isn’t strictly true. If the exploit file is named with another graphics extension (i.e. .gif, .jpg, .png, .tif), the GDI library will still read it correctly as a WMF file and execute the exploit. As a result, all common graphics files can carry the exploit.
David Byrne
