Microsoft recently issued a warning regarding a zero-day flaw in its Windows Graphics Rendering Engine. Would you...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
recommend restricting the Windows Picture and Fax Viewer in this case to prevent possible infection? Are malicious thumbnails/images enough of a threat to warrant special attention?
This most recent exploit is just another of a lengthening list of exploits in image files on Windows. Multiple zero-day exploits have taken advantage of vulnerabilities in the Microsoft Graphics Rendering Engine software components, going back to at least January 2006. The most recent exploit was patched in the normal February 2011 Microsoft monthly patch cycle. Microsoft released a patch for Windows XP and Windows 2003 two months after the zero-day exploit was announced.
There are many places other than Windows Picture and Fax Viewer where thumbnails are displayed, so disabling that one piece of software would only block one vector for exploiting a system. If you have a high-security environment, you could follow the workarounds suggested in Microsoft Security Advisory 2490606, and restrict the permissions on shimgvw.dll, or use the Microsoft Fix It program.
In any case, for increased zero-day attack protection, the threat of malicious images or thumbnails should be evaluated carefully, depending on the protections already on your systems, because there will most likely be future zero-day attacks against this code base. Only the organization can determine if the (generally small) risk of being exploited by such a zero day is high enough to warrant disabling this functionality.
Dig Deeper on Emerging cyberattacks and threats
Related Q&A from Nick Lewis
USB Killer devices, with the ability to destroy systems via a USB input, are available and inexpensive. Expert Nick Lewis explains how they work and ...continue reading
Exaspy spyware, which can access messages, video chats and more, was found on Android devices owned by executives. Expert Nick Lewis explains how ...continue reading
The Nemucod downloader malware is being spread through Facebook Messenger disguised as an image file. Expert Nick Lewis explains the available ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.