Wednesday, 4 January 2006

Microsoft to Release WMF Security Patch on 10 January

Microsoft has completed a patch to fix the security vulnerability in Windows Media File (WMF) image processing. Currently being tested for quality and application compatibility, the fix will only be available from 10 January.

This WMF vulnerability can be exploited when visiting infected sites with Internet Explorer, Firefox or when previewing *.wmf format files with Windows Explorer. Hence, users are warned against visiting unfamiliar or untrusted websites that could potentially host the malicious code.

In addition, this flaw is a result of an error in the handling of corrupted Windows Metafile files. This can be exploited to execute arbitrary code on vulnerable Windows XP and Windows 2003 systems.

The security patch will be released worldwide simultaneously in 23 languages for all affected versions of Windows. The update will be available through Microsoft Update and Windows Update, as well as Microsoft’s Download Center and through Windows Server Update Services for enterprise customers. Customers who use Windows’ Automatic Updates feature will be delivered the fix automatically.