GoogleIt Mail IT Print IT PermaLinkLotus Notes Vulnerable to WMF Exploit On Windows
09:30:16 AM
Written By : Richard SchwartzCategory : Spam And Security
Location : Nashua, NH

Via SANS and NIST:


Lotus Notes uses the same vulnerable shimgvw.dll graphics rendering engine file implicated in the Microsoft Security Advisory (912840) to view image file attachments. Because of this all Lotus Notes users are vulnerable to the WMF zero-day exploit. At this point there is little that be done but block all incoming images at the perimeter.


Someone (or an email worm) simply needs to email a person a message with a graphics file attachment. It doesn't matter if the person Views or Opens (Runs) the attachment the shimgvw.dll will be used to render the image and the malicious file can compromise the computer.


Remind users to avoid opening or viewing file attachments from unknown users. Better yet, block image file attachment extensions (listed in the SANS posting) altogether using a rule similar to the one Chris describes.


Some general info about the vulnerability is availbable in eWeek and InfoWorld.

This page has been accessed 1414 times. .
Comments :v

1. Ken Yee12/30/2005 10:05:37 AM
Homepage: http://www.keysolutions.com/blogs/kenyee.nsf


Just unregister the shimgvw.dll like so:
regsvr32 /u shimgvw.dll
I've done it on all my machines. This is actually a WMF design flaw so I doubt they'll be able to patch this...




2. Richard Schwartz12/30/2005 10:22:40 AM
Homepage: http://www.rhs.com/poweroftheschwartz


From SANS: "John Herron at NIST.org discovered today that Lotus Notes versions 6.x and higher is vulnerable to the WMF 0-day exploit. In the advisory, located on the NIST website here, John reports that Lotus Notes remained vulerable even after running the regsvr32 workaround in the Microsoft security advisory."




3. Chris Whisonant12/30/2005 11:24:42 AM
Homepage: http://cwhisonant.blogspot.com


I'm wondering if the "Show inline MIME images as attachments" setting under User Preferences would work to prevent it from executing the code? I guess it all depends on what the definition of an inline MIME image is...




4. Ken Yee12/30/2005 01:12:15 PM
Homepage: http://www.keysolutions.com/blogs/kenyee.nsf


Dohhh. That's horrible. I'll bet the shimgvw.dll is only for Windows Explorer and Notes uses another API to display WMF files :-P
The inline MIME image question is a good one for Lotus. I suspect that'll work until someone double clicks one of the image files...




5. Chris Whisonant12/30/2005 02:40:14 PM
Homepage: http://cwhisonant.blogspot.com


Ken, yeah, I was thinking that too. But if people use the preview pane and delete one document with that infected file being the next document it may prevent the infection from that. And hopefully even if they open a message from someone they don't know maybe they wouldn't open the attachment too!!! lol




6. Gerco Wolfswinkel12/30/2005 03:42:33 PM
Homepage: http://www.domino-weblog.nl


Perhaps a combination?

-use a policy to enable "Show inline MIME images as attachments" for all Notes users
-create the mailrule to strip attachments with .jpg, .bmp etcetera from incoming email

Wouldn't that solve most of the problems?




7. Gerco Wolfswinkel12/30/2005 03:59:27 PM
Homepage: http://www.domino-weblog.nl


on second thought.. the 'show inline MIME.. ' stuff gets done at the workstation level, so the mailrule wouldn't filter those out. No catchall solution there




8. Ken Yee01/03/2006 11:22:40 AM
Homepage: http://www.keysolutions.com/blogs/kenyee.nsf


Looks like there is a workaround. Linked to Ilfak's blog from mine as well:
http://www.theinquirer.net/?article=28685




9. Julian Robichaux01/03/2006 03:23:05 PM
Homepage: http://www.nsftools.com


Here's a way to keep the Notes client from displaying WMF files:

http://www-10.lotus.com/ldd/nd6forum.nsf/DateAllThreadedweb/51b26b08690493ad852570eb006e4930?OpenDocument

doesn't really help with the other Windows apps, though...




10. J Herron01/03/2006 11:51:34 PM
Homepage: http://www.NIST.org


I've posted an update to the Lotus Notes issue at http://www.nist.org/nist_plugins/content/content.php?content.25

J Herron
http://www.NIST.org




11. Richard Schwartz01/05/2006 10:10:48 PM
Homepage: http://www.rhs.com/poweroftheschwartz


The microsoft patch is available:

http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx




12. vesoftware11/05/2013 11:09:49 PM
Homepage: http://vesoftware.blogspot.com/2013/10/itupokercom-agen-poker-online-indonesia.html


Agen Bola Promo 100% SBOBET IBCBET Casino Poker Tangkas Online
http://vesoftware.blogspot.com/2013/10/agen-bola-promo-100-sbobet-ibcbet.html
ITUPOKER.COM AGEN POKER ONLINE INDONESIA TERPERCAYA
http://vesoftware.blogspot.com/2013/10/itupokercom-agen-poker-online-indonesia.html
alfaonline.com : Toko belanja online murah, Promo heboh jual barang hanya Rp 1,-
http://vesoftware.blogspot.com/2013/10/alfaonlinecom-toko-belanja-online-murah.html
BELAJAR SEO
http://balapseo.blogspot.com/




13. generic_cialis09/08/2016 10:10:44 AM
Homepage: http://c4tadalafil.com/


Hello!
http://c4tadalafil.com/ , ,




14. chenyingying10/17/2016 12:03:45 AM


http://www.seattleseahawksjerseys.us.com
http://www.canadagooseoutlet.eu.com
http://www.louisvuittonoutletdeals.us.com
http://www.uggbootsuk.com.co
http://www.raybansunglasses.me.uk
http://www.cheap--nfljerseys.us.com
http://www.bostoncelticsjerseys.com
http://www.giuseppe-zanotti.us
http://www.louisvuittonoutlet.net.co
http://www.jordan4.net
http://www.coachfactoryoutletclearances.us.com
http://www.tomsshoesuk.org.uk
http://www.louisvuittonparis.fr
http://www.pradahandbags.net
http://www.ralphlaurenoutletuk.in.net
http://www.cartierwatches.in.net
http://www.nike-rosherun.in.net
http://www.raybanoutlet.net.co
http://www.cincinnatibengalsjerseys.us.com
http://www.michaelkorsoutlet-onlinestore.us.com
http://www.adidasshoes.net
http://www.outlet-celine.com
http://www.uggsoutlet.de.com
http://www.jordan13.org
http://www.adidasoutletshoes.com
http://www.uggsbootsstore.com
http://www.canadagoosejackets.com.co
http://www.miamiheatjerseys.us.com
http://www.michaelkors--outlet.us.org
http://www.coachfactoryoutletonline.com.co
http://www.coachfactory-outlet.in.net
http://www.cheapoakleysunglasses.net.co
http://www.montblanc-pens.name
http://www.uggsoutlet.gr.com
http://www.michael-kors-handbags.us.org
http://www.clevelandcavaliersjerseys.us.com
http://www.ralphlauren-outlet.net.co
http://www.uggbootssale.de.com
http://www.pradaoutlet.net.co
http://timberland.officialfree.net
http://www.airmaxssale.com
http://www.canada-gooseoutlet.name
http://www.uggssale.com.co
http://www.louisvuitton.nom.co
http://www.nfljerseyswholesales.us
http://www.toryburch-outlet.in.net
http://www.louboutinshoessale.com
http://www.ugg-store.co.uk
http://www.nikeoutletstore.us.com
http://www.coachoutletstoreonlineclearances.com.co
http://www.gucci-outlet.name
http://www.ralphlaurenclearance.in.net
http://www.monclerjackets.com.co
http://www.raybanssunglasses.com.co
http://www.louisvuitton-discount.com
http://www.oakleyvaultoutlet.in.net
http://www.aididasyeezy.org.uk
http://www.cheapburberryoutlet.name
http://www.hermesbagusa.com
http://www.nike-airmaxpascher.fr
http://www.oklahomacitythunderjerseys.us.com
http://www.katespade-handbags.eu.com
http://www.adidas-yeezy.us.com
http://www.get-louisvuittonoutlet.com
http://www.uggcanada.in.net
http://www.newenglandpatriotsjerseys.us.com
http://www.christianlouboutinoutlet.com.co
http://www.coachoutletstoreonlineclearances.us.org
http://www.louisvuittonoutlet.de.com
http://www.burberry-outlet.com.co
http://www.coachfactoryoutletonlinesale.us.com
http://www.supra-shoes.net
http://www.raybansunglassess.com.co
http://www.ralphlaurenoutletonline.com.co
http://www.louis-vuittonoutlet.com.co
http://www.niketrainers.uk
http://www.authenticlouisvuittonhandbags.us.com
http://www.rayban-sunglasses.com.co
http://www.louis-vuittonoutlet.us.com
http://www.abercrombiekidsoutlet.name
http://www.true-religionoutlet.net.co
http://www.cheaprolexforsale.com
http://www.ralphlaurenuk.com.co
http://www.michaelhandbagsoutlet.us.com
http://www.michael-korsoutlets.eu.com
http://www.louisvuitton.me
http://www.kevindurantshoes.name
http://www.abercrombieoutletonline.cc
http://www.michaelkorsoutletforsale.com
http://www.jordansforsale.in.net
http://www.sunglassesoakley.com.co
http://www.coachcanadaoutlet.com.co
http://www.oakley-sunglasses.net.co
http://www.pittsburghsteelersjerseys.us.com
http://www.christianlouboutinsale.me.uk
http://www.adidassuperstar.name
http://ugg.uggsstore.eu
http://www.ralph-lauren.me.uk
http://www.lebronjames-shoes.net
http://www.canadagoose.de.com
chenyingying20161017




15. 20161125caihuali11/25/2016 12:13:48 AM
Homepage: http://www.mizunorunningshoes.us/


http://www.mizunorunningshoes.us/
http://www.coachoutletcanada.com.co/
http://www.christianlouboutin-outlet.me.uk/
http://www.uggs-outlet.de.com/
http://www.ysloutletonline.com/
http://www.ferragamoshoes.org.uk/
http://www.michael-korsoutletstore.us.com/
http://www.cheapnf-ljerseys.us.com/
http://www.canadagoose-jackets.me.uk/
http://www.coach-factoryoutlets.us.com/
http://www.jordan-shoes.us.com/
http://www.christianlouboutinscheap.us/
http://www.coachoutlethandbags.us.com/
http://www.nikefree5.us/
http://www.michaelkorscanada.ca/
http://www.michaelkorshandbagsclearance.us.com/
http://www.pascherlouisvuitton.fr/
http://www.michaelkorsoutlet-clearance.us.com/
http://www.outlettruereligion.in.net/
http://www.uggoutlet-store.us.com/
http://www.canadagooseoutletcanadagoosejackets.us.com/
http://www.ugg-bootsoutlet.me.uk/
http://www.foampositeshoe.net/
http://www.handbagslongchamp.us.com/
http://www.christianlouboutinonline.us.com/
http://www.northface.org.uk/
http://www.coachoutletclearancesale.com.co/
http://www.nikestore-uk.me.uk/
http://www.toms-shoes.us.com/
http://www.rolexwatchesforsale.me.uk/
http://www.airhuarache-nike.co.uk/
http://www.ralphlaurenpas-cher.fr/
http://www.jordanshoes.us.com/
http://www.coachoutletonlinesale.com.co/
http://www.outletmulberry.org.uk/
http://www.adidasukstore.org.uk/
http://www.truereligion.org.uk/
http://www.cartierwatches.us/
http://www.rolexwatches.in.net/
http://www.longchampbag.org.uk/
http://www.ferragamooutletstore.net/
http://www.pandorajewelryoutlet.us.com/
http://www.the-northfacejacket.us.com/
http://www.coachoutletonlinestore.eu.com/
http://www.guccioutletonline.us.org/
http://www.outletchristianlouboutin.us.com/
http://www.ralphlauren-polo.in.net/
http://www.omegawatches.me.uk/
http://www.maccosmetics.in.net/
http://www.iphone-case.org.uk/
http://www.cheap-ray-bansunglasses.us.com/
http://www.rayban--sunglasses.me.uk/
http://www.michaelkorsoutlet-factory.us.com/
http://www.cartier.us.com/
http://www.coachoutletclearancesale.us.com/
http://www.uggoutlet-store.in.net/
http://www.long-champoutlet.in.net/
http://www.todsoutlet.us.org/
http://www.moncler.us.org/
http://www.canadagoose--outlet.us.com/
http://www.cheap-jordanshoes.us.com/
http://www.nba-jerseyswholesale.us.com/
http://www.hollisterclothing.co.uk/
http://www.louboutinpas-cher.fr/
http://www.nikeairmax90.me.uk/
http://www.coachoutletstores.com.co/
http://www.clearancefitflopssale.com/
http://www.louisvuittonoutletlv.us.com/
http://www.coachoutletclearance.us.com/
http://www.hollisteruksale.co.uk/
http://www.poloralph-lauren.org.uk/
http://www.pradasunglasses.us.com/
http://www.nike-airmax2015.us/
http://www.suprashoes.us.com/
http://www.toryburchoutletsonline.in.net/
http://www.truereligionjeans-canada.com/
http://www.monclerjacketsuk.co.uk/
http://www.herveleger.us.com/
http://www.coachoutletonlinestore.com.co/
http://www.basketballshoes.us.com/
http://www.louis-vuittonneverfull.us.com/
http://www.cartier-watches.us.com/
http://www.ferragamoshoes.com.co/
http://www.mulberrybags.me.uk/
http://www.abercrombiefitch-hollister.es/
http://www.pandora.eu.com/
http://www.thenorth-facejacket.us.com/
http://www.cheapuggsforsale.in.net/
http://www.longchamphandbag.co.uk/
http://www.saclong-champ.fr/
http://www.thenorth-faceoutlet.us.com/
http://www.louisvuitton--handbags.us.com/
http://www.ghdstraighteners.org.uk/
http://www.katespade.org.uk/
http://www.truereligionjeansoutlets.us.com/
http://www.louis-vuittonhandbags.me.uk/
http://www.canada-gooseoutlet.com.co/
http://www.louis-vuittonhandbags.org.uk/
http://www.cheapoakleysun-glasseswholesale.us.com/
http://www.ralph-laurenpolo.it/
20161125caihuali




Enter Comments^


Email addresses provided are not made available on this site.





You can use UUB Code in your posts.

[b]bold[/b]  [i]italic[/i]  [u]underline[/u]  [s]strikethrough[/s]

URL's will be automatically converted to Links


:-x :cry: :laugh: :-( :cool: :huh: :-) :angry: :-D ;-) :-p :grin: :rolleyes: :-\ :emb: :lips: :-o
bold italic underline Strikethrough





Remember me    

Monthly Archive
Responses Elsewhere



About The Schwartz

rss.jpg


All opinions expressed here are my own, and do not represent positions of my employer.