ELM Bulletin - January 6, 2006
Windows and the WMF Exploit
On December 27, 2005, a flaw was discovered in the WMF (Windows Meta File) image format that affected all versions of Microsoft Windows. The nature of this flaw is such that simply viewing a specifically designed image of the WMF format could yield complete control of the computer system to remote attackers. It would not matter whether the image was viewed via email, over the internet, through an Instant Messenger application such as MSN Messenger or through an image viewer.
At the time of its discovery no workaround had been released or sanctioned by Microsoft (though a patch is now available from Microsoft, see below for details).
As the processing of WMF format images is integrated within the Windows operating system no protection from this flaw could be easily implemented by computer users. But since the WMF format is obsolete and not in common use, infected WMF images would generally be found only on websites or in emails specifically designed to make use of this flaw. The risk, however, remains considerable as there is no method within Windows of easily preventing WMF images from being viewed.
As of Thursday, January 5, 2006, Microsoft had released a patch to secure affected operating systems from the WMF flaw. Microsoft views this patch as a critical update and recommends its immediate installation. Users of current versions of Microsoft Windows can install the patch (and any other security updates) by visiting the Windows Update website:
Those of our readers who are more technically inclined and would like to read more on this issue can refer to Microsoft's Security Bulletin MS06-01 which gives further details of the flaw and how to protect against it:
http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx
ELM Computer Systems strongly recommends that all users of Microsoft Windows install the WMF exploit patch as soon as possible.
As always, please do not hesitate to contact me if you have any questions about this or any other issue.
Past issues of the ELM Bulletin are available from our website, feel free to forward them to anyone you wish.
You have received this ELM Bulletin either by request or because you have given your contact information to an ELM employee. If you no longer wish to receive the ELM Bulletin, send us an email with "Remove Me" in the subject line and we will remove your email address from our distribution list.
Peter Rhebergen Telephone |
Websites & Publications Product Websites |
.jpg)
