MS08-021 in-the-wild exploit attempts

FYI…

- http://isc.sans.org/diary.html?storyid=4274
Last Updated: 2008-04-10 21:20:25 UTC - "It appears that Symantec has raised the Threatcon to Level 2 this afternoon…
- http://www.symantec.com/security_response/…atcon/index.jsp
'…The DeepSight honeynet has observed in-the-wild exploit attempts targeting a GDI vulnerability patched by Microsoft on April 8, 2008. The malicious image appears to target the Microsoft Windows GDI Stack Overflow Vulnerability (BID 28570). At least three different sites are hosting the images; two different malicious binaries are associated with the attacks. Analysis of the images has shown that although they appear to be malicious, they do not contain enough data in the associated image property to sufficiently trigger the vulnerability. We are still investigating as to why this may be the case. Users are advised to apply the MS08-021* patches immediately. These attack attempts highlight the severity of this issue – it is only a matter of time before new images that successfully trigger the issue are observed in the wild… some of the associated malware that is delivered with the attack is not detected…'

* http://www.microsoft.com/technet/security/…n/MS08-021.mspx
(Microsoft Security Bulletin MS08-021 – Critical
Vulnerabilities in GDI Could Allow Remote Code Execution (948590)
Published: April 8, 2008 …)

…If you haven't already patched do so now and don't forget to remind your users not to open image files."

FYI…

Exploiting Latest GDI Vulnerability Found in the Wild
- http://preview.tinyurl.com/4nkzn8
April 10, 2008 (Symantec Security Response Weblog) - "…It is possible that these exploits either have been leaked and are "in-work" copies, or that they are functional on some platform that we have not tested. However, the exploit (named "top.jpg") does contain functional payload, which downloads a secondary file (word.gif). Word.gif is really an executable that would be run following a successful infection. Its main function would be to use iexplore.exe to contact a few hosts in China, presumably to download additional malicious code…"

.

FYI…

Elevated ATLAS Threat Index - GDI Exploits in the Wild
- http://asert.arbornetworks.com/2008/04/ele…ts-in-the-wild/
April 11, 2008 - "The ATLAS Threat Index is used to track global security issues as a barometer, and we’re raising the index (something we don’t do very often). We are doing so because see evidence that the GDI vulnerability - MS08-021 - is being exploited in the wild. We have not yet seen widespread attacks, but we anticipate that this attack vector will grow in popularity in the coming days, similar to the WMF and ANI attack vectors in the past couple of years…"

- http://www.us-cert.gov/current/#active_exp…vulnerabilities
April 11, 2008 - "US-CERT is following public reports indicating that attackers are attempting to exploit vulnerabilities in GDI. These vulnerabilities are due to buffer overflow conditions that exist in the processing of EMF and WMF image files. By convincing a user to open a specially crafted EMF or WMF file, a remote attacker may be able to execute arbitrary code. These vulnerabilities were addressed in Microsoft Security Bulletin MS08-021. Users who have not applied this patch are vulnerable…"