WMF exploit in Windows

[moya]

Did you hear the one about the windows vulnerability which allowed hackers to run any kind of code they want on your PC? And all you have to do is look at a picture on your computer? No...?

Well get (http://www.wired.com/news/technology/0,69953-0.html?tw=rss.technology) yourself (http://handlers.dshield.org/jullrich/wmffaq.html) schooled (http://www.microsoft.com/technet/security/advisory/912840.mspx)!

In other news, Microsoft rate the flaw as CRITICAL OMG TEH WORLD IS GOING TO EXPOLDE! but say they're not gonna patch until next Tuesday. Ah.. It's good to see at least some things are running according to plan!

[Aku]

Bill Gates won't be finished counting his money from December until the end of the week, which is why the patch won't be ready until next tuesday.

[silversparrow]

You can get an unofficial patch from a link provided in this article (http://arstechnica.com/news.ars/post/20060102-5876.html). As suggested, you should also unregister "shimgvw.dll".

There was a similar problem with jpg files a while back before MS fixed it, why they didn't learn from this and secure other image formats is beyond me.

[moya]

Microsoft have caved and released the official patch ahead of time. Grab it here:

http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx