Someone

The ThreatCon has been elevated to Level 2. The DeepSight Threat Analyst Team is currently investigating a new exploit that is targeting a new Windows Meta File (WMF) processing vulnerability. Analysis of this issue has revealed that this exploit is targeting a previously unpublished vulnerability. It is confirmed that the public exploit is effective against at least fully patched Windows XP SP2, and Windows 2003 Web Server Edition computers.
The DeepSight Threat Analyst Team strongly encourages system administrators to allow access to trusted Web sites only, or if this is not possible, to block all access to the unionseek.com domain. Additionally, if possible, it is advised that all WMF files are filtered at the network perimeter and that Web browsing is performed with least privileges possible.
This issue is being tracked as the Microsoft Windows Graphics Rendering Engine WMF Format Unspecified Code Execution Vulnerability. The DeepSight Threat Analyst Team has released a Threat Alert detailing this issue. This alert can be found at the following location.
Exploitation of Unpatched WMF Vulnerability in Microsoft Windows Alert https://tms.symantec.com/members/viewdocument.asp?guid=F460E6587EBE4 D0A882F9E0B05593BF3
Increasing ThreatCon
For more information, please login to your DeepSight Threat Management System account, at https://tms.symantec.com or email the DeepSight Threat Analyst team at dstat@symantec.com
ThreatCon Alert
Dec 28 2005 02:58:39
symantec copyright © 2003 Dec 28 2005 03:02 42957-4.0.19 1 Page 2 of
Glossary
Contact Information
About Symantec
If you are unfamiliar with any term this report uses, please visit the SecurityFocus glossary at www.securityfocus.com/glossary for more details on information security terminology.
World Headquarters
Symantec Corporation
20300 Stevens Creek Blvd.
Cupertino, CA 95014
U.S.A.
+1 408 517 8000
Symantec, the world leader in Internet security technology, provides a broad range of content and network security software and appliance solutions to enterprises, individuals and service providers. The company is a leading provider of client, gateway and server security solutions for virus protection, firewall and virtual private network, vulnerability management, intrusion detection, Internet content and e-mail filtering and remote management technologies as well as security services to enterprises and service providers around the world. Symantec's Norton brand of consumer security products is a leader in worldwide retail sales and industry awards. Headquartered in Cupertino, Calif., Symantec has worldwide operations in 38 countries. For more information, please visit
NO WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, SHALL APPLY TO THE DEEPSIGHT SERVICES OR THE MATERIALS PROVIDED BY SYMANTEC TO USERS OF THE DEEPSIGHT SERVICES. SYMANTEC PROVIDES THE SERVICE(S) AND MATERIALS “AS IS” AND “AS AVAILABLE.” IN NO EVENT WILL SYMANTEC BE LIABLE FOR THE TRUTH, ACCURACY, RELIABILITY OR COMPLETENESS OF THE SERVICE(S) OR MATERIALS. SYMANTEC MAKES NO WARRANTY THAT THE SERVICE(S) OR MATERIALS WILL BE UNINTERRUPTED OR TIMELY, OR THAT THEY WILL PROTECT AGAINST COMPUTER VULNERABILITIES. Please refer to your services agreement or certificate for further information on conditions of use for the Services and materials.
Copyright © 2004 Symantec Corporation. All rights reserved. Reproduction is forbidden unless authorized.
www.symantec.com.
DeepSight Conditions:
Symantec, the Symantec logo and DeepSight are US registered trademarks of Symantec Corporation or its subsidiaries. DeepSight Analyzer, DeepSight Extractor, and Bugtraq are trademarks of Symantec Corporation or its subsidiaries. Other brands and products are trademarks of their respective holders.
Trademarks:
Authorized Users of Symantec's DeepSight Services may use or quote individual sentences and paragraphs from the materials provided as part of the Services, but not large portions or the majority of such materials, solely for purposes of internal communications. Unless otherwise specifically agreed in writing by Symantec, no external publication of all or any portion of any materials provided by Symantec is permitted.
Quoting Symantec Information and Data:
ThreatCon Alert
Dec 28 2005 02:58:39
symantec copyright © 2003 Dec 28 2005 03:02 42957-4.0.19 2 Page 2 of 2