M$ releases WMF patch [TANKS]

[Steve Edwards <sedwards-at-awger.net>]

Not tank related, but important enough that *EVERYONE* needs to take 
care of this *ASAP*

 From http://www.microsoft.com/technet/security/Bulletin/MS06-001.mspx

"A remote code execution vulnerability exists in the Graphics Rendering 
Engine because of the way that it handles Windows Metafile (WMF) images. 
An attacker could exploit the vulnerability by constructing a specially 
crafted WMF image that could potentially allow remote code execution if 
a user visited a malicious Web site or opened a specially crafted 
attachment in e-mail. An attacker who successfully exploited this 
vulnerability could take complete control of an affected system."

Translation: your Windows PC can now be hacked *just by displaying a 
picture*. If you visit a website containing a malicious image... your PC 
could be hacked. If you view an email containing a malicious image... 
your PC could be hacked. In short, unless you're running Windows in safe 
mode / command line only, your PC could be hacked.

Antivirus and personal firewall systems are insufficient protection 
against this vulnerability... ie, they will not protect you.

This is not a joke -- this is a very serious security hole that is 
currently being exploited. I personally figured that, by this time, 
everyone on the planet would have heard about this and patched their 
systems -- but I talked to some people today that were completely 
oblivious, and so I figured it couldn't hurt to spread the word a little 
more.

If you have not done so already, please visit the above link or 
Microsoft's Windows Update site and download the appropriate patch for 
your version of Windows. Do this now. Do not wait. Do not pass go, do 
not collect $200. It's that serious.

If you surf the web with Internet Explorer, I strongly recommend 
switching to Firefox. If you are already using Firefox, make sure you 
are running version 1.5 or above.

And if by some happenstance you should be confronted with a file that 
has a ".WMF" extension -- regardless of the source -- DO NOT OPEN IT.

    - Steve "Now removing my CISSP hat" Edwards