EXP/MS06-001.WMF - Exploit

See also

Summary

Full description

Statistics

Virus:	EXP/MS06-001.WMF
Type:	Exploit
In the wild:	Yes
Reported Infections:	Medium
Distribution Potential:	Low
Damage Potential:	Medium
Static file:	No
Engine version:	6.33.00.74

General Aliases:

Non working variants may be identified as:
• EXP/MS06-001.WMF.Intended

It was previously detected as:
• EXP/IMG.WMF

Special detection MS06-001 (Vulnerability in Graphics Rendering Engine)

Description:
EXP/IMG.WMF is a generic detection for exploits using a vulnerability in the Microsoft Windows Graphics Rendering Engine.

Modified WMF files that make use of this vulnerability can activate payload code without execution of the file itself. This may happen while marking a file in Windows Explorer or surfing to a malicious website using Microsoft Internet Explorer.

Note that we received many files that make use of this vulnerability. Some of them were available even before the official patch was available which gained it the "0-day exploit" name.

Please make sure that you download and install the patch in order to be protected against this threat. The patch itself among further technical information can be found here: MS06-001

Version history:
The following engine updates were released in order to enhance detection:

   • 6.33.0.74   ( 03/01/2006 )
   • 6.33.0.75   ( 05/01/2006 )
   • 6.33.0.77   ( 10/01/2006 )
   • 7.06.00.78   ( 28/03/2008 )

See a brief description here.

Description inserted by Oliver Auerbach on Sun, 08 Jan 2006 16:29 (GMT+1)
Description updated by Andrei Ivanes on Fri, 28 Mar 2008 14:32 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back