02 January 2006

Windows PCs face ‘huge’ virus threat; Affects every MICROSOFT OS shipped since 1990

**updated** 1:08 pm cst friday 06 january 2006 microsoft has released their own patch for the wmf flaw. to download and install it simply click your start button > then windows update> and follow the directions. microsoft website information here.

updated 1033 pm cst wed 04 january 2006 - we went ahead and downloaded Mr.Ilfak Guilfanov's unofficial .WMF flaw patch based on this post at the internet storm center

uh oh :-| note to self...be sure and check windows updates...often until this is taken care of. thankfully we use the Firefox browser the latest version 1.5 was released around the 29th november 05...must check into switching to linux for the new year lol. we have been watching this story brew for the past few days now its in red on drudge. we remember seeing something over the weekend about a patch some guy had made up until microsoft can be bothered to release one supposedly on tuesday the 10th january 2006 ...right now we are watching closely to see what happens...shame if we have to switch-off our pc.

Ilfak Guilfanov's unofficial .WMF flaw patch
-----------financial times ---------
Computer security experts were grappling with the threat of a new weakness in Microsoft’s Windows operating system that could put hundreds of millions of PCs at risk of infection by spyware or viruses.
The news marks the latest security setback for Microsoft, the world’s biggest software company, whose Windows operating system is a favourite target for hackers.

“The potential [security threat] is huge,” said Mikko Hyppönen, chief research officer at F-Secure, an antivirus company. “It’s probably bigger than for any other vulnerability we’ve seen. Any version of Windows is vulnerable right now.”

The flaw, which allows hackers to infect computers using programs maliciously inserted into seemingly innocuous image files, was first discovered last week. But the potential for damaging attacks increased dramatically at the weekend after a group of computer hackers published the source code they used to exploit it. Unlike most attacks, which require victims to download or execute a suspect file, the new vulnerability makes it possible for users to infect their computers with spyware or a virus simply by viewing a web page, e-mail or instant message that contains a contaminated image.

“We haven’t seen anything that bad yet, but multiple individuals and groups are exploiting this vulnerability,” Mr Hypponen said. He said that every Windows system shipped since 1990 contained the flaw.

Microsoft said in a security bulletin on its website that it was aware that the vulnerability was being actively exploited. But by early yesterday, it had not yet released an official patch to correct the flaw. “We are working closely with our antivirus partners and aiding law enforcement in its investigation,” the company said. In the meantime, Microsoft said it was urging customers to be careful opening e-mail or following web links from untrusted sources.

Meanwhile, some security experts were urging system administrators to take the unusual step of installing an unofficial patch created at the weekend by Ilfak Guilfanov, a Russian computer programmer.

Concerns remain that without an official patch, many corporate information technology systems could remain vulnerable as employees trickle back to work after the holiday weekend.

“We’ve received many e-mails from people saying that no one in a corporate environment will find using an unofficial patch acceptable,” wrote Tom Liston, a researcher at the Internet Storm Center, an antivirus research group. Both ISC and F-Secure have endorsed the unofficial fix.

Microsoft routinely identifies or receives reports of security weaknesses but most such vulnerabilities are limited to a particular version of the Windows operating system or other piece of Microsoft software. In recent weeks, the company has been touting its progress in combating security threats.

The company could not be reached on Monday for comment.

By Kevin Allison in San Francisco
Published: January 2 2006 18:18 Last updated: January 2 2006 22:19

tags:

EXTERNAL LINK

Posted by wst... at 18:36

Subscribe to: