Official Microsoft Patch available for Windows WMF Exploit!

Question

Official Microsoft Patch available for Windows WMF Exploit!

Answer

This question was answered on January 4, 2006. Much of the information contained herein may have changed since posting.

Microsoft has posted a security advisory for an exploit that takes advantage of a vulnerability in the WMF graphics rendering engine of Windows machines. The exploit allows viruses, Trojans, worms, and other malware install automatically and without prompting the user.

Only hours after the discovery of the vulnerability, thousands of websites were found distributing the code. This is known as a zero-day bug, because security developers have virtually no time to develop a fix before the bug is exploited.

Microsoft released an official patch for the WMF vulnerability today (1/5/2006), outside of their normal Windows update schedule. If you've installed the unofficial patch from our previous warning, uninstall it from the Add/Remove Programs list, reboot your PC, and visit the Microsoft Update site for the official patch.

Author

Posted by Chad of Data Doctors on January 4, 2006