Lotus Notes WMF File Handling Code Execution Vulnerability

2005-12-3000:00:00

vulners.com

Information about new vulnerability affecting to Lotus Notes has been
released recently at
http://www.nist.org/nist_plugins/content/content.php?content.25

This issue is due to Shimgvw.dll graphics rendering engine being used
when rendering picture files sent as a file attachment.

Reportedly person who Views or Opens (i.e. Runs) the attachment the
Shimgvw.dll will be used to render the image and the malicious file can
compromise the computer.
Mr. Herron has demonstrated this issue with .JPG picture sent as an
attachment.
Additionally, it is reported that Regsvr32 /u workaround provided in the
Microsoft Security Advisory 912840 doesn't prevent the exploitation of
this vulnerability.

Credit:
John Herron, NIST.org

According to the screenshot picture in advisory Lotus Notes version
6.5.x was in use.

Solution:
No updated version available from the vendor at the time of reporting.

Workarounds provided by me:

Filter all common picture file extensions at the network perimeter.
The following file extensions are recommended:
BMP, DIB, EMF, GIF, ICO, JFIF, JPE, JPEG, JPG, PNG, RLE, TIF, TIFF and
WMF, because
Microsoft Windows handles picture files by information of the file
header information, not by file extension used.
Do not open or View picture files from untrusted sources.

Information about vulnerability disclosure and workarounds provided was
sent to vendor on 30th December.

Best regards,
Juha-Matti Laurio, Networksecurity.fi
Finland