WMF exploit, concerns all Windows versions.

It has recently been discovered that Windows Meta Files (A general use file, most often used as a type of image format, as all versions of Windows can use it) have a very serious security hole. Essentially what happens is this: When the metafile runs it uses the Windows graphical environment, which gives it certain abilities, it never uses most of them, but one of them allows it to run a program for error checking or whatever, this new virus tells the metafile to run a certain program using that code.

You're probably thinking "So I just won't download any metafiles", it's not quite that simple. As most applications consider them to be image files they simply open them, and that's all it takes. If you're browsing the internet and a website has one of these then simply by visiting the website you'll be infected.

On the plus side, by default Internet Explorer, Firefox, Mozilla, and Opera are unable to open these files and will ask you to use a different program to do so (usually Windows Picture and Fax Viewer). The simple solution is to simply not open it, and to not download any webpages that have them.

However, be careful with instant Messaging programs, e-mail, etc. As most IM programs and e-mail managers open these files without asking for permission.

[Source]

Don't quote me on this, but I heard Windows Update will have a patch for this vulnerability come January 10, so it's not like nothing's being done about it.

Originally Posted by Malloc()

Don't quote me on this, but I heard Windows Update will have a patch for this vulnerability come January 10, so it's not like nothing's being done about it.

People aren't too sure if Microsoft will have a fix ready any time soon, and many are scared that the 'fix' will simply be disabling all WMF files, which is what they've done to patch other kinds of holes.

I believe Malloc is right. I saw it on the news last night. The update should be up next week.

Microsoft isn't waiting until Patch Tuesday. A security update was released today and pushed through Microsoft Update.

I saw on the news today, that the primary worm that was exploiting the whole is set to go execute itself tommorow. Huh. Though, the TV news is often exagerating or mistaking details on these kinds of things.

LMAO, I went to the microsoft site to download it and you need Internet Explorer, now I need to actually BOOT UP IE (lol). Yea, I started using firefox yesterday and its been nothing but trouble. I've heard about this long before, being that I do advanced photo editing for some extra cash. I do use WMF files, and I was infected, McAfee updated itself around 2 minutes later, everythigns cool now. Damn, first the Xbox 360 exploit and now this... yea, Microsoft is screwed (not really...)