A new dangerous vulnerability has been discovered in Windows as of December 28, 2005. The security flaw is exploited when an application opens an infected file using the Windows Metafile processor. Web browsers, email clients, the Windows Picture and Fax Viewer, and many other programs may use this function.

This issue applies to all users of Windows, including those with the latest updates.

A patch to correct this issue has not been released by Microsoft at this time. Make sure that your Windows machine is set to receive automatic updates so that this vulnerability is fixed as soon as a patch is available.

There are a number of measures that you can take to protect against the Windows Metafile vulnerability discovered December 28th until Microsoft releases a patch, which will likely take several days.

Be Careful Online

• Do not open or download any image files (.wmf, .emf, .jpg, .bmp, etc.) unless you are positive that it is legitimate and from a trusted source.
• Do not click on any links unless they are expected and from a trusted source.
• Email messages can be spoofed. Check with the sender to make sure a message is legitimate.
• Be careful opening image files on Windows shares.

If your computer is managed or supported by an IT group, please contact them before taking any of the following measures.

• Confirm that Windows is set to accept and install Automatic Updates.
• Make sure you have installed Norton Antivirus software and set it to update daily. Norton Antivirus
• Update now by opening Norton and clicking 'Liveupdate'.
• Make sure you have installed CA PestPatrol software and set it to update daily. PestPatrol
• Update PestPatrol now by opening it and clicking "Advanced Settings", "Updates Options", and "Check Now".
• Microsoft has announced a fairly technical workaround for this vulnerability. To view it and more information, navigate to the relevant Microsoft Security Advisory and look for the section entitled "Suggested Actions."

Vulnerability summary at U.S. CERT

Microsoft Security Advisory

SANS Information on 0-Day Exploit

To reach this page quickly in the future, use the keyword wmf.

Send reports of security incidents, attacks, or questions to security@columbia.edu