WMF Vulnerability Avast! Official Confirmation

[hlecter]

Does Avast include signature for this exploit?

I thing Avast is taking a very low profile in this matter.

I know there is a thread in Virus-forum with different suggestions, but I think Avast should give an official confirmation that Avast users are safe! or not?

Regards
Hannibal Lecter

[TAP]

As far as I know avast! is one of the first AVs that release a signature of this exploit.

http://forum.avast.com/index.php?topic=18295.0

[hlecter]

TAP:

Could you please quote the official answer to my question in that Thread?

Regards
Hannibal L

[hlecter]

TAP:

Your suggestion to include *.wmf in the URL block list is good but according to MS Security Advisory 912840 it is possible for the files to disguise as eg gif or another picture format.

Hannibal L

[TAP]

TAP:

Your suggestion to include *.wmf in the URL block list is good but according to MS Security Advisory 912840 it is possible for the files to disguise as eg gif or another picture format.

Hannibal L

See my post here (but I can't confirm if it's safe or not)
http://forum.avast.com/index.php?topic=18295.msg155892#msg155892

I can answer your question (first question) about the signature of this exploit, But I can't give an official confirmation that avast users are safe. vlk or other Alwil staff are the right person to do so.

[hlecter]

Vlk said in the thread I mentioned that Avast were working on it but that it would take some time to produce the signature.

What is the name Avast uses, then I can check in viruslist on Avast site.
The last defs you can read there are from 28.12.

The defs from 29.12 are not specified.

We really need some official clarification.

Hannibal Lecter

[Sgt.Schumann]

AFAIK, Avast! uses "Win32:Exdown [Trj]" for the exploit.
It has been added 28.12.

[TAP]

Vlk said in the thread I mentioned that Avast were working on it but that it would take some time to produce the signature.

What is the name Avast uses, then I can check in viruslist on Avast site.
The last defs you can read there are from 28.12.

The defs from 29.12 are not specified.

We really need some official clarification.

Hannibal Lecter

As Sgt.Schumann said and I have the sample of this exploit.

[hlecter]

Thank you all for convincing me! 

Hannibal Lecter
"Looking forward to my new year meal"

[Sgt.Schumann]

The quote from Vlk was *before* the update containing the signature for the exploit was deployed.

[Zagor]

Hi Hlecter  ,

If I remember corectly, You and I recently had a nice chat at the aSquared Support Forum. You offered help about signature backup and while waiting for moderators to return we talked about casual stuff, remember?

I'm so glad that you're a happy avast user! Well, if you need a chat again, please don't hesitate to return to one of the best forums on this matter 

I'll say once more: "Have a pleasant meal" 

[TAP]

I just go to some website that contains this exploit but avast! Web Shield protects me very well.

[hlecter]

Hi Zagor 

Yes, we meet again. The world isn`t that big, is it.

I have been a happy Avast user for a very long time, but not very active on this forum as you can see from my number of counts. Never needed help, I guess   .

But one thing I will say for sure: we will meet again. 

Have a nice day (and a happy new year) if we don`t meet again THIS YEAR!

TAP:
Could you please PM me the address of said website? Thank you! 

Edit: I suppose you have removed *.wmf from URL blocking now, should not be necessary?

[Zagor]

Have a nice day (and a happy new year)

You too! 

[Chuck58]

Is AVAST's signature for the current version of WMF that was found a couple of days ago as reported here? Apparently this is the second incarnation of WMF and is pretty bad.

http://sunbeltblog.blogspot.com/2005/12/new-exploit-blows-by-fully-patched.html