I saw this on yahoo news today
.I hope i'm not effect with my winxp
.
My friend gave me the newest ver when I bought pc from him.
Why are theses people always break into major companyies web sites.
I know internet is getting worst with theses viruses and spyware.
And last month they something with old ver firefox being hack last couple weeks ago
and it was posted on yahoo news.
http://news.yahoo.com/s/nf/20051229/tc_nf/40530;_ylt=AlO.iCNrPFgr3Hzh8pBv8Wis0NUE;_ylu=X3oDMTA3ODdxdHBhBHNlYwM5NjQ-(here's what on web site saids)
Critical Flaw Detected in Windows Metafile Jay Wrolstad, newsfactor.com
Thu Dec 29, 4:10 PM ET
A vulnerability has been discovered in Microsoft Windows that allows hackers to remotely
access PCs and install malware through an imaging-handling technology
in the operating system.
Microsoft acknowledged the release of exploit code that could allow an attacker to
execute arbitrary code when someone visits a Web site that contains
a specially crafted Windows Metafile (WMF) image. Security authority Secunia labeled
the vulnerability "extremely critical."
Malicious Graphics Files
WMF images are graphical files that can contain both vector and bitmap-based picture information.
Microsoft Windows contains routines for displaying such files,
but a lack of input validation in one of these routines may allow a buffer overflow to
occur, which in turn may allow remote code execution.
The vulnerability can also be triggered from the Internet Explorer browser if the malicious file
has been saved to a folder and renamed to other image file extensions such as
".jpg," ".gif," ".tif," and ".png." It has been detected on a patched system running
Microsoft Windows XP SP2.
Microsoft Windows XP SP1 and Microsoft Windows Server 2003 systems also are affected.
Current exploits use the Windows Picture and Fax Viewer to attack any
application that can handle Windows Metafiles.
Disabling the Windows Picture and Fax Viewer will not eliminate the risk as the
flaw exists in the Windows Graphical Device Interface library.
The flaw has also raised concerns that Google Desktop may be another potential attack
vector, and that various antivirus software products cannot detect
all known exploits for this vulnerability.
A Familiar Problem
By default, Explorer on those operating systems runs in a restricted mode known
as Enhanced Security Configuration,
which Microsoft said mitigates this vulnerability as far
as e-mail is concerned, although clicking on a link in a
message would still put users at risk.
Yankee Group senior analyst Andrew Jaquith characterized the vulnerability
as a serious security issue that has cropped up before in browsers,
including Firefox and Safari. "It's particularly nasty because the browser
automatically loads images when users visit a Web site. There is no built-in protection," he said.
Jaquith predicted that additional exploits of the vulnerability are expected since there
is no patch available and the security hole is difficult to plug.
People who use Windows are advised to be wary when opening e-mail and links
in e-mail from sources they don't trust. They should not save,
open or preview image files from unfamiliar sources. And, as always, people are
encouraged to update the patches for their operating systems.
Microsoft vowed to investigate the vulnerability and to provide a
security update when it becomes available. Customers who believe they may have been
affected may contact the company's Product Support Services.
