full-disclosure - WMF Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Jan  4 23:28:09 2006
From: cristjc at comcast.net (Crist J. Clark)
Subject: WMF Exploit

On Wed, Jan 04, 2006 at 09:58:37AM -0600, Todd Towles wrote:
> Ad wrote:
> > I don't think because here win98 doesn't recognize the .wmf extension.
> 
> Without installling a third-party image viewer, it is my understanding
> that pre-Windows 2000 OS are less vulnerable. But most people do have
> third-party image viewers installed and it is possible that these apps
> make the OS attackable.

IE 6 displayed WMF files on a test Win98 system just fine for
me.

Remember, just because when you double-click on a WMF file
Windows Explorer doesn't know what to do with it does NOT mean
that when presented to IE in an <img> tag, it won't. Even trying
to open the file with IE doesn't mean anything. You need to
try it in a webpage.

For example, take your sample WMF, sample.wmf, and create
a test page, wmf.htm,

	<html>
	<head>
	<title>WMF Rendering Test</title>
	<head>
	<body>
	The WMF image should appear below.
	<p>
	<img src="sample.wmf" alt="Not processed!">
	</body>
	</html>

And load that into IE. Works for me on Win98.
-- 
Crist J. Clark                     |     cjclark@...m.mit.edu