The WMF security hole now has an official patch. It was released on Windows Update about an hour ago, so if you haven't got it, I suggest doing so now. It's <200kb but does require a reboot.
WMF Security Hole Patch Now Available
Miscellaneous Forums/General Discussion/WMF Security Hole Patch Now Available Do it. Now.
For those who have lived under a rock for the past week: this is a *major* flaw that affects all versions of windows from windows 3.0 through 2003. It was a zero-day exploit, meaning that it has been found in the wild before a fix was available from microsoft. Simply viewing a malicious .WMF (or more dangerously, a .WMF renamed to .JPG) to execute whatever embedded code they want on your computer. According to some reports there have been tons of spam messages and hundreds of malicious websites abusing this hole for the past week. Close it, while you still can!
For those who have lived under a rock for the past week: this is a *major* flaw that affects all versions of windows from windows 3.0 through 2003. It was a zero-day exploit, meaning that it has been found in the wild before a fix was available from microsoft. Simply viewing a malicious .WMF (or more dangerously, a .WMF renamed to .JPG) to execute whatever embedded code they want on your computer. According to some reports there have been tons of spam messages and hundreds of malicious websites abusing this hole for the past week. Close it, while you still can!
I was one such victum of this flaw by a site that installed some evil program called "spyaxe v3". I felt it best to just re-install this system in the end. Dont let yourself's get caught!
thanks for the info :) fixing it now :)
What if you haven't installed service pack 2? Do you still need to install this patch? Am i at risk i mean :o)
Yes. Everyone who doesn't have the patch is at risk AFAIK.
I'll bet Win98 is immume. (Ie The OS isn't compatible with the virus because it's too old.)
No, as Xlsior said, all versions of Windows are affected by this hole. I don't know if patches are available for Win9x yet though.
Worse, there may not BE a patch for the original edition Win98... Isn't it past M$'s end-of-life?
It's past their initial end of life cycle but serious issues may still be looked at. In any case, it'd be low priority.
Worse, there may not BE a patch for the original edition Win98... Isn't it past M$'s end-of-life?
Yes, but I doubt they'd leave it unpatched forever. It's bad publicity. Even if they do, someone else will patch it. Unofficial patches have been available for a few days, but I think they were NT-only as well.
Wow, MS just can't shut the door. I ask myself if this all is really unintentional. Or maybe they just have to let some backdoors open in every OS, for the secret services. Selling a backdoor must be a big business overthere.
I just read the page:
http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx
...
Are Windows 98, Windows 98 Second Edition, or Windows Millennium Edition critically affected by one or more of the vulnerabilities that are addressed in this security bulletin?
No. Although Windows 98, Windows 98 Second Edition, and Windows Millennium Edition do contain the affected component, the vulnerability is not critical because an exploitable attack vector has not been identified that would yield a Critical severity rating for these versions. For more information about severity ratings, visit the following Web site.
...
You must love Win98.
http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx
...
Are Windows 98, Windows 98 Second Edition, or Windows Millennium Edition critically affected by one or more of the vulnerabilities that are addressed in this security bulletin?
No. Although Windows 98, Windows 98 Second Edition, and Windows Millennium Edition do contain the affected component, the vulnerability is not critical because an exploitable attack vector has not been identified that would yield a Critical severity rating for these versions. For more information about severity ratings, visit the following Web site.
...
You must love Win98.
people, people, please don't panic.
Head over to Steve Gibsons place (grc.com), check out the secuity now section - his pod casts with Leo Laporte.
Steve has very kindly offered to come up with a patch for 9x and ME if Microsoft dont and there's really a problem (which at the time of writing is still debateable for those two systems as they do it differently enough that they may have escaped, but check back on that bit often as it seems to change often.)
They got a vuln checker and so far those I've tried it on (XPSP2 boxes) are fine now they got updated by MS. At grc They got a link for the patch for xp & 2000, which I used on my 2000 Pro machines and that's come up fine too. Seems this may be reduced to some older printers not working after patching.
Do yourself a big favour, go to Steve Gibson's place, listen to the handful of pod casts since end of December onwards, learn the latest on we are facing and do the things they suggest, they seem to work. And that's about as good as it's likely to get from the sound of things so far.
Stay cool and calm, it'll be fine.
Hope this helps.
Head over to Steve Gibsons place (grc.com), check out the secuity now section - his pod casts with Leo Laporte.
Steve has very kindly offered to come up with a patch for 9x and ME if Microsoft dont and there's really a problem (which at the time of writing is still debateable for those two systems as they do it differently enough that they may have escaped, but check back on that bit often as it seems to change often.)
They got a vuln checker and so far those I've tried it on (XPSP2 boxes) are fine now they got updated by MS. At grc They got a link for the patch for xp & 2000, which I used on my 2000 Pro machines and that's come up fine too. Seems this may be reduced to some older printers not working after patching.
Do yourself a big favour, go to Steve Gibson's place, listen to the handful of pod casts since end of December onwards, learn the latest on we are facing and do the things they suggest, they seem to work. And that's about as good as it's likely to get from the sound of things so far.
Stay cool and calm, it'll be fine.
Hope this helps.
just don't open wmfs.... hahahaha
well you don't have to touch them, if they are embeded, or eg., they are renamed to jpg and referenced in the IMG SRC tag, MSIE, clever as it is, will run it. (Not so long ago it used to run XML code found inside a "JPG" - when will they ever learn something).
I was unable to use the windows update tool, it kept giving me some kind of error and I rtried registering some DLL's that wre supposed to fix the problem and one of them wouldn't register, so I was stuck, but I found this link on another page which used to have an unofficial patch, so if you have a problem installing the fix with the automatic update tool you can download this from MS instead:
http://www.microsoft.com/downloads/details.aspx?familyid=0C1B4C96-57AE-499E-B89B-215B7BB4D8E9&displaylang=en
http://www.microsoft.com/downloads/details.aspx?familyid=0C1B4C96-57AE-499E-B89B-215B7BB4D8E9&displaylang=en
Wow, I love the internet radio station thing. Could listen to that all day. Going to download them all.
WMF has introduced me to internet radio - thanks buddy - Large.
WMF has introduced me to internet radio - thanks buddy - Large.
JEEZ!!!
I HAD 6 (SIX) TROJANS ON MY SYSTEM.
They probably were all due to this exploit.
I HAD 6 (SIX) TROJANS ON MY SYSTEM.
They probably were all due to this exploit.
/me falls on the floor.
I always wondered about WMF since to me they always seemed a bit more than just an image file... Spooky.
I think my machine got updated last night, so i should be fine.
I always wondered about WMF since to me they always seemed a bit more than just an image file... Spooky.
I think my machine got updated last night, so i should be fine.
just don't open wmfs.... hahahaha
Good luck with that. A .WMF renamed to .JPG will still be handled by the same image rendering library, which will detect it as really being a WMF and execute the payload.
All it takes is one shady pop-up banner supplier to use those malformed files, renamed to JPG, and you can expect a whole host of programs you really don't want to be auto-installed on your system. It *is* actively being exploited by the spyware scum right now, this is not just hypothetical stuff.
The problem is that this is not really a bug, but a 'feature' of WMF: they can contain their own executable error handling code in case of a rendering failure. It is by design -- in hindsight it's amazing this didn't get exploited a decade ago.
you realize I was joking.... right?
No, I didn't. :-)
But anyway, better safe than sorry.
But anyway, better safe than sorry.
And BTW, contrary to what I thought first, it's not only a MSIE/Outlook thing like the JPG exploit was, but it's browser independent since WMF will be delegated to the windows service that is the cause for the troubles. I guess if it's remaned to JPG, at least Opera will ignore it, because it's using its own JPG viewer that won't process JPGs any further that are not valid images AFAIK.