KyeU
join:2003-12-31
Canada | reply to redxii
Re: Windows MetaFiles still vulnerable Beehappyy uses 4 methods to infect the user.
1. Loads free.anr through "{CURSOR: url("free.anr")}", which downloads xxx.exe to the C:\ Drive
2. Loads an IFRAME with the .WMF exploit.
3. Loads a tiny Java applet: "BlackBox.class", which modifies the Windows permissions I think.
4. Uses the Windows CHM Help File exploit. |
|
 jbobReach Out and Touch SomeonePremium
join:2004-04-26
Little Rock, AR | So I'm assuming this server tries all 4 but in sticking within thread, option 2. is the one we are concerned about now. This is the IFRAME/wmf exploit. Or is it a combination of all four?
I'm still waiting to see just what the attack vector is.
As was reported earlier, unless something has changed, the exploit attempts an ftp session to download the xxx.exe file. |
|
|
|
KyeU
join:2003-12-31
Canada | The other 3 methods are standard driveby methods that have existed for a while now.
The new one is the WMF file exploit. |
|
