For all of you corporate folk out there, we now have a .msi installer file available for version 1.4 of Ilfak Guilfanov’s unofficial patch for the Windows .WMF exploit. A very big “thank you” goes out to Evan Anderson of Wellbury Information Services, L.L.C. for his diligent efforts to get this put together. Note: Like Mr. Guilfanov’s original patch, this will dump out not only Guilfanov’s source code, but also the code that Evan wrote to do the install from within the .msi.
Note : Sans have reverse engineered and verified that the installation/uninstallation code in the .msi does what it says it does and nothing more. The wmfhotfix.dll installed is the binary equivalent of the previously vetted version 1.4.
WMFHotfix-1.4.msi has an MD5 of 0dd56dac6b932ee7abf2d65ec34c5bec
To uninstall old version patch, use the “Add / Remove Program” button in your control panel.
Thanks to Sans blog
