Windows WMF exploit - Smart defense?

[intehnet]

all,

anyone done anything to their smart defense to help detect this wmf exploit? surely adding a custom http worm catcher would do the trick, no?
anyone got any info on what the header looks like of the exploit?

i'm in R54.. not sure if there is a NG X update that already catches this sploit..

cheers,
inet

[intehnet]

ps;

http://www.checkpoint.com/defense/ad...i-2004-18.html

the above advisory only catches files with the wmf file name.. the exploit can be named anything, and is usually named .jpg to remain obscure