bugtraq - Re: Is this a new exploit?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <732397322@web.de>
Date: Wed, 28 Dec 2005 15:14:20 +0100
From: Andreas Marx <gega-it@....de>
To: bugtraq@...urityfocus.com
Subject: Re: Is this a new exploit?

Hi,

yes, it seems to be a new exploit. More details about the problem can be found here:

http://www.f-secure.com/weblog/archives/archive-122005.html#00000752
http://isc.sans.org/diary.php?storyid=972
http://www.heise.de/newsticker/meldung/67794

Some AV companies have created signatures for the latest critter already:

AntiVir	TR/Dldr.WMF.Small
Dr Web	Exploit.MS05-053
F-Secure	Exploit.Win32.Agent.r
Fortinet	W32/WMF-exploit
Kaspersky	Exploit.Win32.Agent.r
McAfee (BETA)	Exploit-WMF trojan
Symantec (BETA)	Download.Trojan

cheers,
Andreas Marx
http://www.av-test.org

Warning the following URL successfully exploited a fully patched windows xp system with a freshly updated norton anti virus.

unio[removeme]nseek.com/d[removeme]/t1/wm[removeme]f_exp.htm

The url runs a .wmf and executes the virus, f-secure will pick up the virus norton will not.

______________________________________________________________________
XXL-Speicher, PC-Virenschutz, Spartarife & mehr: Nur im WEB.DE Club!		
Jetzt gratis testen! http://freemail.web.de/home/landingpad/?mc=021130