New Windows Metafile (WMF) 0-day exploit in the wild

[Tuttle]

There's a new exploit generator out which makes this hard to pick up by virus scanners and IDS appliances:

http://isc.sans.org/diary.php?storyid=992

The exploit generates files:

• with a random size;
• no .wmf extension, (.jpg), but could be any other image extension actually;
• a random piece of junk in front of the bad call; carefully crafted to be larger than the MTU on an ethernet network;
• a number of possible calls to run the exploit are listed in the source;
• a random trailer