Microsoft to Release WMF Fix on Patch Tuesday

By Michael Santo
Contributing Writer, RealTechNews

Despite calls from numerous companies, including F-Secure, Sunbelt and Panda for a quicker release, Microsoft is going to wait until next week’s Patch Tuesday to release the fix for the Windows Metafile vulnerability found last week.

The company says it needs time to test the fix and prepare it in 23 different languages for all affected versions of Windows.

“Our goal is to release the update on Tuesday, January 10, 2006, as part of the regular, monthly security update release cycle, although quality is the gating factor,” (Kevin) Kean (from the Microsoft Security Response Center) added.

“Although the issue is serious and the attacks are being attempted, Microsoft’s intelligence sources indicate that the scope of the attacks is limited,” Microsoft said in a statement. “In addition, attacks exploiting the WMF vulnerability are being effectively mitigated by anti-virus companies with up-to-date signatures.” Source: BetaNews

At the same time that Microsoft is encouraging users to wait until Patch Tuesday, researchers at the ISC (Internet Storm Center) is proposing that users take the initiative and install Ilfak Guilfanov’s unofficial patch, which they validated over the weekend.

“We have very carefully scrutinized this patch. It does only what is advertised, it is reversible, and, in our opinion, it is both safe and effective,” Tom Liston wrote in the diary.

“You cannot wait for the official MS patch, you cannot block this one at the border, and you cannot leave your systems unprotected,” Liston wrote. Source: PC World

We Say: By now I assume (hope?) all antivirus (AV) firms have updated their software to cover this vulnerability, as opposed to the results of a few days ago. If you have an up-to-date AV, you are probably safe. Still, if you don’t want to wait until next Patch Tuesday, you can try the unofficial patch above. At any rate, it’s important to be careful and not open suspicious attachments (there are reports of WMF files disguised as JPGs carrying various worms as well as MSN Messenger worms) and make sure your AV protection is up-to-date.