ENSRT Incident Note ETS-i-2006-12599

The Enterasys Security Response Team (ENSRT) publishes incident notes to provide information for our constituents to raise awareness of issues deemed threatening to the security and integrity of our customers.

US-CERT Vulnerability Note VU#181038

Release Date: 12/29/2005
Last Updated: 01/04/2006

Print this alert

Overview

Because of an error in handling files using the Windows Metafile image format, it has been determined that Microsoft Windows is vulnerable to remote code execution via publicly posted exploit code. This code has been utilized to successfully attack fully-patched Windows XP SP2 systems.

Systems affected

Windows operating systems

Systems not affected

Linux and MAC/OSX

Description

Microsoft Windows Metafile format images contain both vector and bitmap-based picture information. Within Microsoft Windows routines for displaying Windows Metafiles exist. However, a lack of input validation in one of these routines may allow a buffer overflow to occur, and can allow remote arbitrary code execution.

The previously mentioned public exploits use the Windows Picture and Fax Viewer (SHIMGVW.DLL) as an attack vector affecting users of any Windows-based application that can handle Windows Metafiles. Disabling the Windows Picture and Fax Viewer will not eliminate this vulnerability as it is currently thought to exist in the Windows Graphical Device Interface library (GDI32.DLL).

Threat Assessment

If a user is persuaded to view a specially crafted Windows Metafile, a remote, unauthenticated attacker may be able to execute arbitrary code on the user's end system. Currently there is no Microsoft patch available for this vulnerability.

Remediation

Matrix N-Series	X
Matrix E7	X
Matrix E6	X
Matrix E5	X
Matrix E1	X
VH	X
C-Series	X
B-Series	X

Detection

Several Internet sites have hosted a malicous .wmf file that is used to install a backdoor on compromised hosts. A Metasploit module has been made available as a public exploit. The Dragon MS:METAFILE-OVERFLOW2 signature has been created to detect this public exploit. This signature functions by analyzing Web traffic, however, this attack may be used on other ports such as e-mail or Windows File Share.

Additionally, numerous Trojans in the "NASCENE" family exploit the WMF vulnerability in an attempt to take control of vulnerable PCs. ENSRT has created the following family of Dragon signatures to detect the "NASCENE" Trojans during infection. These ENSRT signatures all have the prefix "ENSRT:WMF-VU181038". As additional worms and viruses exploiting the WMF vulnerability are detected in the wild, new ENSRT signatures will be added to "ENSRT:WMF-VU181038". These signatures should be utilized on a temporary basis until the forthcoming Microsoft patch has been deployed and successfully corrected the WMF vulnerability.

Prevention

Enterasys offers two forms of prevention:

1) The Enterasys Sentinel ™ solution is capable of monitoring various end system activities. Enterasys Sentinel ™ is able to take immediate action such as traffic filtering for IP addresses and TCP/UDP ports or placing the user into a Quarantine policy or VLAN until end system threat is mitigated.

2) In-line attack disruption can be achieved via the Dragon Intrusion Prevention System (IPS) to drop detected events before vulnerabilities can be exploited.

Containment

The Enterasys Secure Networks ™ solution can remove infected end-users from the enterprise network by detecting the infection with a Dragon NIDS signature (see "Detection" section of this report), locating the user's connection point using Automated Security Manager's location services module, and either placing the user in a quarantine VLAN or disabling the associated switch port for the user.

Repair

Monitor Dragon RealTime Console for alerts that end-user PCs have been exploited. If utilizing the DIR solution, users can either be expunged from the network or provided a quarantine policy.

References

http://www.kb.cert.org/vuls/id/181038
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FNASCENE%2EH

This document and the information contained herein are intended solely for informational use. Enterasys Networks, Inc. makes no representations or warranties of any kind, whether expressed or implied, with respect to this information and assumes no responsibility for its accuracy or completeness. Enterasys Networks, Inc. hereby disclaims all liability and warranty for any information contained herein and all the material and information herein exists to be used only on an "as is" basis. More specific information may be available on request. By your review and/or use of the information contained herein, you expressly release Enterasys from any and all liability related in any way to this information.

A copy of the text of this section is an uncontrolled copy, and may lack important information or contain factual errors. All information herein is Copyright ©Enterasys Networks, Inc. All rights reserved. All information above is subject to change without notice.

Revision History:

Version: 1.0

Date: 12/29/2005

Author: ENSRT STAFF

Change

Enterasys - Secure Networks