Microsoft recently issued a warning regarding a zero-day flaw in its Windows Graphics Rendering Engine. Would you...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
recommend restricting the Windows Picture and Fax Viewer in this case to prevent possible infection? Are malicious thumbnails/images enough of a threat to warrant special attention?
This most recent exploit is just another of a lengthening list of exploits in image files on Windows. Multiple zero-day exploits have taken advantage of vulnerabilities in the Microsoft Graphics Rendering Engine software components, going back to at least January 2006. The most recent exploit was patched in the normal February 2011 Microsoft monthly patch cycle. Microsoft released a patch for Windows XP and Windows 2003 two months after the zero-day exploit was announced.
There are many places other than Windows Picture and Fax Viewer where thumbnails are displayed, so disabling that one piece of software would only block one vector for exploiting a system. If you have a high-security environment, you could follow the workarounds suggested in Microsoft Security Advisory 2490606, and restrict the permissions on shimgvw.dll, or use the Microsoft Fix It program.
In any case, for increased zero-day attack protection, the threat of malicious images or thumbnails should be evaluated carefully, depending on the protections already on your systems, because there will most likely be future zero-day attacks against this code base. Only the organization can determine if the (generally small) risk of being exploited by such a zero day is high enough to warrant disabling this functionality.
Dig Deeper on Emerging Information Security Threats
Related Q&A from Nick Lewis
USB storage devices can be turned into covert channels with a software tool called USBee. Expert Nick Lewis explains how to protect your enterprise ...continue reading
Passive man-in-the-middle attacks on PIN pads can lead to attackers stealing credit card details. Expert Nick Lewis explains how companies can ...continue reading
The SFG malware dropper can bypass antimalware programs and exploit two patched vulnerabilities. Expert Nick Lewis explains how to these attacks work...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.