About Notes and the WMF exploit
January 3 2006
I've been pinged a bunch about the Windows
WMF graphics rendering engine file vulnerability that cropped up last week.
IBM's official technote is posted, #1227004
-- Is Lotus Notes affected by the Windows Meta File vulnerability reported
in Microsoft Security Advisory # 912840?
It also references NIST.ORG's
specific bulletin about Lotus Notes and this exploit
(which has been updated to clearly indicate that Notes is "not to
blame").
Other useful sources of information:
Post a Comment
- 2
Chris Whisonant http://cwhisonant.blogspot.com | 1/4/2006 7:36:02 AM
My initial concern was that this exploit could be taken advantage of by simply viewing the message with the WMF file embedded? From the Technote, it appears that Notes users would have to choose to "Open" the attachment.
- 3
Bill Brown | 1/5/2006 2:48:54 PM
Why does Symantec { Link } list Notes and Avaya as the only products vulnerable to this "Trustworty" software?
Symantec used to be a Notes shop too.
- 4
MarvinK | 1/5/2006 5:07:14 PM
Does anyone actually use the "view" option instead of "open"? Most people here dont--mostly because of the inaccuracy with Office documents.
- 5
Ed Brill www.edbrill.com | 1/5/2006 9:00:19 PM
I use "view" all the time -- it's "good enough" without having to launch alternate programs. I especially use it with images -- even before this issue.
I like Paul's analysis of Microsoft's *current* response.
{ Link }