Microsoft recently issued a warning regarding a zero-day flaw in its Windows Graphics Rendering Engine. Would you...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
recommend restricting the Windows Picture and Fax Viewer in this case to prevent possible infection? Are malicious thumbnails/images enough of a threat to warrant special attention?
This most recent exploit is just another of a lengthening list of exploits in image files on Windows. Multiple zero-day exploits have taken advantage of vulnerabilities in the Microsoft Graphics Rendering Engine software components, going back to at least January 2006. The most recent exploit was patched in the normal February 2011 Microsoft monthly patch cycle. Microsoft released a patch for Windows XP and Windows 2003 two months after the zero-day exploit was announced.
There are many places other than Windows Picture and Fax Viewer where thumbnails are displayed, so disabling that one piece of software would only block one vector for exploiting a system. If you have a high-security environment, you could follow the workarounds suggested in Microsoft Security Advisory 2490606, and restrict the permissions on shimgvw.dll, or use the Microsoft Fix It program.
In any case, for increased zero-day attack protection, the threat of malicious images or thumbnails should be evaluated carefully, depending on the protections already on your systems, because there will most likely be future zero-day attacks against this code base. Only the organization can determine if the (generally small) risk of being exploited by such a zero day is high enough to warrant disabling this functionality.
Dig Deeper on Emerging cyberattacks and threats
Related Q&A from Nick Lewis
The Fruitfly Mac malware has decades-old code, but has been conducting surveillance attacks for over two years without detection. Expert Nick Lewis ...continue reading
A Gmail phishing attack brought users to fake login pages designed to look like Google's. Expert Nick Lewis explains how users can prevent similar ...continue reading
A HummingBad malware variant, HummingWhale, was discovered being spread through 20 apps on the Google Play Store. Expert Nick Lewis explains the ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.