Microsoft recently issued a warning regarding a zero-day flaw in its Windows Graphics Rendering Engine. Would you...
recommend restricting the Windows Picture and Fax Viewer in this case to prevent possible infection? Are malicious thumbnails/images enough of a threat to warrant special attention?
This most recent exploit is just another of a lengthening list of exploits in image files on Windows. Multiple zero-day exploits have taken advantage of vulnerabilities in the Microsoft Graphics Rendering Engine software components, going back to at least January 2006. The most recent exploit was patched in the normal February 2011 Microsoft monthly patch cycle. Microsoft released a patch for Windows XP and Windows 2003 two months after the zero-day exploit was announced.
There are many places other than Windows Picture and Fax Viewer where thumbnails are displayed, so disabling that one piece of software would only block one vector for exploiting a system. If you have a high-security environment, you could follow the workarounds suggested in Microsoft Security Advisory 2490606, and restrict the permissions on shimgvw.dll, or use the Microsoft Fix It program.
In any case, for increased zero-day attack protection, the threat of malicious images or thumbnails should be evaluated carefully, depending on the protections already on your systems, because there will most likely be future zero-day attacks against this code base. Only the organization can determine if the (generally small) risk of being exploited by such a zero day is high enough to warrant disabling this functionality.
Dig Deeper on Emerging Information Security Threats
Related Q&A from Nick Lewis
The new Trochilus RAT can avoid detection in cyberespionage attacks. Expert Nick Lewis explains how it works, and if enterprises need to adapt their ...continue reading
The Asacub Trojan has new banking malware features. Expert Nick Lewis explains how it made this transition and what enterprises should be watching ...continue reading
BlackEnergy malware may have been part of the attacks on Ukrainian utility and media companies. Expert Nick Lewis explains how this malware works and...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.