Irfan View WMF Vulnerability Looks You Shouldn't Use It with Unknown Images

A

ab5cvjl

I did the following.

I found a wmf file on my system, actually lots of them, in Visual Basic
6. I guessed that I could safely experiment with them.

I copied and renamed one as foo.wmf in my temp directory. I copied and
renamed it there foo.jpg.

I went into Irfanview and disassociated wmf from IV.

I tried to open foo.wmf from a Windows directory window, aka folder
window, and it asked me for a program with which to open it. That was
good.

But, then I tried to open foo.jpg from a directory window, and
Irfanview started and displayed a dialog box saying that the file was
actually a wmf file and asking me if I wanted to rename it. I had only
two choices, yes or no. Regardless of which I chose, Irfanview opened
the file. If the file had been corrupted, I might have been looking at
reinstalling Windows.

First problem, when Irfanview realizes that the file is not what the
extension says it is, the program should give you a third choice to
cancel to stop the process. The way it is now, once it tells you it is
a misnamed file, you can't do anything. You may be hosed. This looks
like a simple partial fix.

The more I think about it, the more I think this is the way it should
be. If a file is not what it says it is, do you really want to open
it? Probably not. The problem today is wmf files. Who knows what it
might be tomorrow?

Second problem, the misnamed jpg. The file gets rendered in the Open
box and in thumbnails. You could get hosed without even knowing it.
It seems like another partial solution here would be never to display a
thumbnail for a file where the extension does not match the file type.
Again, I think it ought to work that way.

That doesn't solve the problem of viewing a wmf file without realizing
it. That could happen if you save images from usenet or the web in a
directory for later viewing. Although, if you do that, you could check
the directory extensions before viewing the file.

You need to be able to tell Irfanview not to display a particular file
type, wmf. I haven't found a way to do that.

It looks to me like there is no way to avoid changing the program and
waiting for a Microsoft fix. The same problem could arise with another
file type tomorrow. Users need some sort or workaround until patch
day. Also, many people use Win 98, and who knows if Microsoft will fix
Win 98. For that matter, who knows if Microsoft will actually fix it
for XP?

It looks like, as it is now, you shouldn't use Irfanview with unknown
images, those you didn't take yourself or come from usenet binary
groups.
 
B

bigjon

I did the following.

I found a wmf file on my system, actually lots of them, in Visual Basic
6. I guessed that I could safely experiment with them.

I copied and renamed one as foo.wmf in my temp directory. I copied and
renamed it there foo.jpg.

I went into Irfanview and disassociated wmf from IV.

I tried to open foo.wmf from a Windows directory window, aka folder
window, and it asked me for a program with which to open it. That was
good.

But, then I tried to open foo.jpg from a directory window, and
Irfanview started and displayed a dialog box saying that the file was
actually a wmf file and asking me if I wanted to rename it. I had only
two choices, yes or no. Regardless of which I chose, Irfanview opened
the file. If the file had been corrupted, I might have been looking at
reinstalling Windows.

First problem, when Irfanview realizes that the file is not what the
extension says it is, the program should give you a third choice to
cancel to stop the process. The way it is now, once it tells you it is
a misnamed file, you can't do anything. You may be hosed. This looks
like a simple partial fix.

The more I think about it, the more I think this is the way it should
be. If a file is not what it says it is, do you really want to open
it? Probably not. The problem today is wmf files. Who knows what it
might be tomorrow?

Second problem, the misnamed jpg. The file gets rendered in the Open
box and in thumbnails. You could get hosed without even knowing it.
It seems like another partial solution here would be never to display a
thumbnail for a file where the extension does not match the file type.
Again, I think it ought to work that way.

That doesn't solve the problem of viewing a wmf file without realizing
it. That could happen if you save images from usenet or the web in a
directory for later viewing. Although, if you do that, you could check
the directory extensions before viewing the file.

You need to be able to tell Irfanview not to display a particular file
type, wmf. I haven't found a way to do that.

It looks to me like there is no way to avoid changing the program and
waiting for a Microsoft fix. The same problem could arise with another
file type tomorrow. Users need some sort or workaround until patch
day. Also, many people use Win 98, and who knows if Microsoft will fix
Win 98. For that matter, who knows if Microsoft will actually fix it
for XP?

It looks like, as it is now, you shouldn't use Irfanview with unknown
images, those you didn't take yourself or come from usenet binary
groups.

you will find that a good AV will deal with it quite effectively:
http://www.topqualityfreeware.com/example.JPG
(not a wmf file, just a picture of norton in action)
 
A

Art

On 5 Jan 2006 02:10:08 -0800, (e-mail address removed) wrote:

It looks like, as it is now, you shouldn't use Irfanview with unknown
images, those you didn't take yourself or come from usenet binary
groups.

Yep! I've associated WMF with a hex editor. Since other pic image file
extensions can be used to disguise WMF files, strictly speaking one
should do the same for all of them. Then ony Open image files in Irfan
that have been checked first for malware. It's a PITA, but that's
Windows, unfortunately.

Art

http://home.epix.net/~artnpeg
 
C

CharlieDontSurf

you will find that a good AV will deal with it quite effectively:
http://www.topqualityfreeware.com/example.JPG
(not a wmf file, just a picture of norton in action)

No, it won't. A signature of a *known* payload type will trigger the AV,
but that's not where the vulnerability lies. And to catch even those
payloads, the file must be scanned -- unless you scan every file
embedded in every webpage you visit before its rendered in the browser,
you'll miss them.
 
G

Gabriele Neukam

On that special day, , ([email protected]) said...
Regardless of which I chose, Irfanview opened
the file. If the file had been corrupted, I might have been looking at
reinstalling Windows.

Only, if Irfanview makes use of the shimgvw.dll, which I doubt. When
WMF is associated, it opens the *.wmf file, and says something about a
broken header. At least, it did this in the following test.

http://www.heise.de/security/dienste/browsercheck/demos/ie/wmf.shtml

It is benign, will only run if you click "test", and if your machine
isn't patched nor the shimgvw.dll unregistered, it will cause the
Windows calculator to run.


Gabriele Neukam

(e-mail address removed)
 
C

CharlieDontSurf

Only, if Irfanview makes use of the shimgvw.dll, which I doubt.

The vulnerability is in GDI32, not shimgvw. Deregistering shimgvw closes
a likely avenue of entry, but it doesn't protect you when other programs
like IrfanView access a tainted file. That's why it's important to apply
the hexblog patch as well, it intercepts external procedure calls from a
wmf file.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Encountered WMF Vulnerability 19
Converting WMF pastes in 2007 7
Irfanview conflicts with Power Point 2
WMF files not displaying 3
WMF 2
Viewing .wmf files 2
How do I change individual colors on WMF file inserts? 5
Windows XP Irfan View 0

Top