RE: WMF and IPS products?

Hi Sam,

I am not sure what you are referring to with "protecting from
downloading malicious WMF content". The most proper way to do it would
be through signature based systems and it is known fact that all the
signature based systems were bypassed during this and other similar

You will see that Determina VPS Memory Firewall technology provides
zero-day protection for this vulnerability, preventing the end systems
from running any single instruction of the malicious code on the
affected system.

Please check out our web site at for more technical
info and product details


-----Original Message-----
From: Sam Evans [mailto:wintrmte@xxxxxxxxx]
Sent: Wednesday, January 04, 2006 2:43 PM
To: focus-ids@xxxxxxxxxxxxxxxxx
Subject: WMF and IPS products?

I am curious if any of the major IPS vendors are able to successfully
protect workstations from downloading malicious WMF content?

Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
to learn more.