Microsoft Releases WMF Vulnerability Patch

[Up2Late]

(If you don't have Windows Update set to automatic, you might want to run Windows Update now. This is a serious security problem that you definitely want to fix immediately. This link is to the Windows IT Pro news site.)

(January 5, 2006)

Microsoft Releases WMF Vulnerability Patch

Mark Joseph Edwards
InstantDoc #48967
Paul Thurrott's WinInfo

Acting outside of its regularly scheduled monthly patch release cycle, Microsoft released a bulletin, "Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919) ," and an associated patch to correct vulnerabilities with Windows metafiles. The patch works on Windows 2000 with Service Pack 4, Windows XP with Service Pack 1, and Windows Server 2003 with Service Pack 1.

"Microsoft originally planned to release the update on Tuesday, January 10, 2006 as part of its regular monthly release of security bulletins, once testing for quality and application compatibility was complete. However, testing has been completed earlier than anticipated and the update is ready for release," the company wrote in its January Security Bulletin Advance Notification. "In addition, Microsoft is releasing the update early in response to strong customer sentiment that the release should be made available as soon as possible. Microsoft’s monitoring of attack data continues to indicate that the attacks are limited and are being mitigated both by Microsoft’s efforts to shut down malicious Web sites and with up-to-date signatures form anti-virus companies."

During the past week tools were released that can be used by intruders with little programming knowledge to quickly craft new exploits. Independent vulnerability testers reported that as of January 5 there were currently more than 1100 different exploits that take advantage of the Windows metafile vulnerability.

While Microsoft's patch protects supported operating systems, countless systems still use Windows NT, Windows ME, Windows 98, and Windows 95, all of which remain vulnerable. Cross-platform anti-virus maker Eset released a unofficial patch that helps protect those operating systems.

<http://www.windowsitpro.com/windowspaulthurrott/Article/ArticleID/48967/windowspaulthurrott_48967.html>

[William769]

1. Thanks did not know this was released yet.

Downloaded & now I have to restart my computer. thanks again, for the info.

[corksean]

2. Done. Thanks for the heads-up. n/m

[RC]

3. How many more patches are there till XP is completely rewritten?

Can't be too many more.

[emulatorloo]

7. dont worry:"longhorn" or "vista" or whatever the hell MS is calling it

will be out soon enough! No doubt Bill will tell us how it will make all the bad things about XP go away -- GET OUT YOUR CREDIT CARDS!!!!!

[Renew Deal]

9. Vista will be the most secure version of Windows ever.

:rofl:

[martymar64]

4. All the more reason to go with Mac OSX or Linux

I got rid of my Windows machine and have't had any virus or spyware problems since.

Thanks to Steve Jobs and all my friends at Apple!

[Born Free]

24. get a kick out of windows users

they unknownly repeat the same old lines - "oh linux is so hard to use" , most don't even realize the newest distros are said to install easier then windows and certainly most don't know we spend a lot less time working on our systems to keep them running then they do to keep their windows systems running. Windows users I know can quickly lose me with all their talk of the many things they must do to keep their systems running, it appears they are devoting more time to maintenance of the system then actually using it. Maybe the new "Google Computer" will change everything. Just as the white house convinces many Americans they must trust them, Microsoft has a following "trust" them.

[DainBramaged]

27. No all your assumptions are wrong

It Windows is so bad and Linux so easy, why don't elementary schools use Linux?

[shraby]

5. Glad it's out.

[CatholicEdHead]

6. Already updated

it is on Automatic Updates now.

[Renew Deal]

8. Do your fellow DUers a favor and rate this up

http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx

[mom cat]

10. Thanks for the fix, man.

[AuntiBush]

11. Thank You for the Major Heads-Up, Up2Late.

[StraightDope]

12. Gee, MicroSoft...

(Emphasis on the 'Soft') Thanks for telling us all that XP had a CRITICAL vulnerability BEFOREHAND! :mad:

That did me a lot of good a week ago when one of my kids stumbled upon a web site that infected my computer with SpySherriff and other assorted malware. Thanks again, MS. Lot of help, that one was.

SD

[thespiritualzebra]

13. Quick Mac-sketeers, get your last snipe in...

Tell us one more time about your holeproof Mc SOX or something.

But you'll never know how cosy it feels under our Microsofty patchwork quilts purrr :P

[RC]

14. Yeah, just wait till the Intel Mac's come out.

:evilgrin:

[Up2Late]

18. Exactly, and in defense of Windows, at least "the experts" don't say wait

Wait until OS10.1 or OS10.2 or 7.1 or don't even bother with 9.x, wait until OSX comes out.

Windows usually works well on the first day of release. Maybe that's why more than 90% of the computers in the world run Windows. But I guess you and the other 4% of the computer users out there are just special.

<http://www.insanely-great.com/news.php?id=5607>

[Born Free]

25. You're right!

Yeah! and most Americans trusted and supported the white house going to war, guess that made them right too... 'cause if "most people" do something it must be the right thing to do

[Up2Late]

32. No, that's not it at all. What I'm saying is, if most people used MacOS

and only 4% of the worlds computer users used Windows, MacOS would have the same problems that Windows has.

I don't know the exact numbers, but lets say 100 Million (100,000,000) Computers run Windows which would mean 4 million (4,000,000) Computers run MacOS, now if you, for some stupid reason, enjoyed creating Computer viruses or Computer worms, and you enjoyed releasing your virus to see the havoc your Virus causes all over the world, which operating system would you target?

You, and every other Virus writer all around the world, would choose to target the 100 million computers running Windows, not the 4 million running MacOS. It's the exact same reason Linux has so little trouble with Computer viruses too.

Then their's the problem of the millions more business software apps and MS Windows programmers writing custom software for business, and the millions of Hackers searching for their mistakes to get access to their valuable data. When you have more custom software and more Windows commercial software out these, their are more targets for the hackers to try to exploit and more people looking for the holes and back doors. Plus, with all those custom apps, you have to make a few safety trade offs so that the weaker programs will work.

Believe me, you should count yourself lucky that MacOS is such a niche segment. If MacOS ever gets as big as Windows, MacOS will have the same problem with viruses and Hackers exploiting it's weaknesses.

Viruses don't just mutate on their own in the world of computers, some sick individual out in cyberspace writes them.

[emulatorloo]

28. Yeah, McDonalds sells a lot of hamburgers! and we know how nutritious

those are.

[Moochy]

22. Oh the flame wars we will have over those!! :)n/t

[emulatorloo]

29. Sorry, Intel Macs will run OS X, not windows, and windows is the problem

not intel. Although apparently you will be able to install Windows on your intel mac if you want to.

Stop spreading FUD.

[gulfcoastliberal]

15. K&R nt

[Vidar]

16. kick

[Straight Shooter]

17. Dumb question, but how do I know if I have Service Pack 1 installed?

I have XP, but I don't know which Service Pack is installed. If I download this patch and don't have Service Pack 1, will it cause any problems?

Anyone who can answer this, I sure would appreciate it.

[Up2Late]

19. Right click (right mouse button) on the "My Computer" desktop Icon...

...then go to the bottom of the menu that pops up top where it says "Properties," Left click properties. That should cause the "System Properties" window to pop-up, with the "General" tab in front.

There it should say "Microsoft Windows XP", then under that it will say something like "Home Edition" "Version 2002" and then right below that it should say "Service Pack 1" or "Service Pack 2."

BTW, If you don't have Service Pack 2 already, download it NOW first. It will fix a lot of stuff, but you'll probably have to download about a dozen more of the monthly updates.

Here are the links you will need:

<http://support.microsoft.com/gp/windowsxpsp2>

<http://support.microsoft.com/kb/322389#XSLTH3120121122120121120120>

<http://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us>

[Straight Shooter]

30. Thank you so much.

I use my computer a lot but rarely get into its guts because a little knowledge is a dangerous thing, for me anyway. :)

I'll finish my DU perusal this morning and then follow your instructions.

Thanks again! :yourock:

[Stephanie]

20. Automatic Update didn't do it -

I had to go back to DU and find the link and download it myself. Anybody know why? If I didn't read DU I wouldn't even know I needed it.

[Robeson]

21. Thanks!....

....:thumbsup:

[In_The_Wind]

23. My computer updated itself earlier this morning.

Thanks for a better explanation.

[meisje]

26. I got "The blue screen of death" after installing it:(

[Up2Late]

31. Ouch, what "service pack" do you have?

See above at #19 to see how to find that info.