WMF exploit vs. Windows 98 again…
If you’ve visited here in the last few days, you’ll have noticed that I’ve been trying to test the WMF exploit against a Windows 98 Virtual machine since January 1st. I initially started out with a default install, which didn’t work, (for the exploit), then added irfanview (didn’t work), tried the exploit as a jpg, gif, htm, doc file extension, (didn’t work) and then this morning saw that I’m not the only one that’s been testing this….
Several sites are reporting that iDefense has studied how easy it is for earlier Windows versions to be affected and it seems that we have all come to similar conclusions – that it is not as easy for earlier versions of windows to be affected by this exploit.
I saw a comment in one of Larry Seltzer’s posts that IF Windows 98 had Microsoft Office 97 or newer installed AND had folder “enable thumbnail view” enabled AND in View, folder options had Web view” under Windows Desktop Update, THEN it would be affected. I still can’t seem to verify this. I even pulled Microsoft Photo Editor from the Office CD and added that to my install. I haven’t added any service packs from the original Office 97 Professional CD.
True, earlier versions of Windows contain the code that this bug is in, but it takes another dll call to exploit it (the bug itself is in gdi32.dll) (shimgv.dll apparently makes the call to exploit it, but there may be other calls to it = for instance Lotus Notes was shown as vulnerable EVEN with the dll unregistered.)
Oh – one other thing I’ve tested from a comment on one of the earlier posts is using Internet Explorer to view the wmf by including it as an image in a web page… img=bad.wmf… still didn’t seem to do anything.