Anti-virus vendor Trend Micro Inc. has spotted a Trojan in the wild attacking Windows users via the image rendering flaws patched by Microsoft Corp. two days ago.
The Trojan, identified as TROJ_EMFSPLOIT.A, causes the “explorer.exe” file to crash, causing the taskbar on unpatched Windows machines to disappear.
The “explorer.exe” process is a required file used to manage the Windows Graphical Shell including the Start menu, taskbar, desktop and File Manager. A malicious attack that disrupts those essential services is considered very disruptive.
Trend Micro described the exploit as a “proof-of-concept Trojan” that exploits the Graphics Rendering Engine vulnerability patched by Microsoft earlier this week.
Microsoft rated the flaw as “critical” and warned that a successful exploit could let an attack take “complete control” of unpatched Windows 2000, Windows XP (including SP2) and Windows Server 2003, but the Trojan identified by Trend Micro simply causes a denial-of-service condition.
Prior to Microsofts Patch Day release, company spokesman Stephen Toulouse confirmed to Ziff Davis Internet News that exploit code that could cause a denial-of-service attack was publicly available.
It is not yet known if the public code was used in the TROJ_EMFSPLOIT.A attack.
A Microsoft spokeswoman said the company is investigating the Trend Micro discovery. “Microsoft is not currently aware of active attacks that use this Trojan or of customer impact at this time however, are actively monitoring the situation to keep customers informed and to provide customer guidance as necessary,” she said.
“Microsoft continues to urge all customers to deploy MS05-053 and all recent security updates released by Microsoft to help ensure that their systems are protected from any attempted exploitation,” the spokeswoman added.
Incident handlers at the SANS ISC (Internet Storm Center) said in a diary entry that the appearance of a Trojan just days after Microsoft released a patch underlines the urgency of applying the updates.
Microsofts patches, contained in the MS05-053 bulletin, addresses three separate image rendering flaws in the Windows operating system.
The flaws could be exploited via any software that displays images, including the widely used Microsoft Outlook, Microsoft Word and Internet Explorer programs.
The bugs are considered particularly dangerous because users could be at risk by merely browsing to a malicious rigged site with rigged image files or by displaying images in the preview pane of an e-mail program.
The most serious of the three vulnerabilities is a remote code execution bug in the rendering of WMF (Windows Metafile) and EMF (Enhanced Metafile) image formats.
“Any program that renders WMF or EMF images on the affected systems could be vulnerable to this attack. An attacker who successfully exploited this vulnerability could take complete control of an affected system,” the company warned.
The bulletin also addresses two separate unchecked buffers in the way the operating system renders EMF and WMF images.
Image rendering vulnerabilities are deemed particularly serious because malicious hackers can simply place a rigged photograph on a Web site and trick users into visiting it. By merely browsing to the malicious site, the attacker can execute harmful code that will take complete control of an unpatched machine.
In the past, image rendering bugs have been used in widespread attacks. In one case, hackers broke into an ad server and successfully loaded exploit code on banner advertising served on hundreds of Web sites. European tech publisher The Register was among those affected.
The latest flaw was discovered by at least three private research teams and reported to Microsoft more than seven months ago.
Editors Note: This story was updated to include comments from Microsoft.
