Workarounds include disabling the Windows Picture and Fax Viewer, the application that Internet Explorer automatically launches to display WMF image files.
On Wednesday, several security companies recommended that users and companies also block access to the sites known to be using the exploit. Sunbelt Software posted a list of some of the sites -- which included the most prominent, iFrameurl [dot] biz -- but with the exploit being used by an ever-increasing number of malicious and/or spyware sites, the technique will soon be impossible to implement manually.
"Yesterday only a few of the sites we monitor used this exploit," wrote Eric Sites, vice president of research at Sunbelt, "but now that number is exploding." (Another security vendor, San Diego-based Websense, said Thursday that "thousands of sites" were distributing exploit code from iFramecash [dot] biz.)
Users can also ditch Internet Explorer for Firefox or Opera. The vulnerability isn't within IE itself, but that browser does open WMF files automatically without asking permission from the user. Firefox and Opera at least put up a dialog box asking the user if he or she wants to open the file with Windows Picture and Fax Viewer. Using Firefox or Opera, however, doesn't guarantee that a PC is immune, since a malicious WMF file could still be introduced via e-mail.
Finally, said Microsoft, users should keep their anti-virus defenses up to date, since most are or soon will provide signatures for the exploits taking advantage of the vulnerability. As of mid-day Thursday, for example, all the major anti-virus vendors had released some signatures.
But that, too, may not completely defend against the threat. By late Wednesday, Sunbelt Software had detected more than 50 exploit variants.
5 Top Federal Initiatives For 2015As InformationWeek Government readers were busy firming up their fiscal year 2015 budgets, we asked them to rate more than 30 IT initiatives in terms of importance and current leadership focus. No surprise, among more than 30 options, security is No. 1. After that, things get less predictable.
Join us for a roundup of the top stories on InformationWeek.com for the week of April 24, 2016. We'll be talking with the InformationWeek.com editors and correspondents who brought you the top stories of the week!