Microsoft jumps the gun, does a quick-fix on WMF

Microsoft jumps the gun, does a quick-fix on WMF

The year has got off to a patchy start for Microsoft as it had to hurriedly release a fix to the Windows Meta File vulnerability discovered over the holiday season. Downplaying the gravity of the breach, the software giant had initially announced that it would unroll a patch only on January 10. However, it has launched the fire-fighting measure five days ahead of schedule.

Computers running all of the Windows operating systems launched since 1990 were under threat of spy ware and virus attacks due to a security vulnerability. This defect could allow criminal hackers to access sensitive data and assume control of computers by having users simply view an image on a website or through email.

The company admitted the release of the patch was expedited to placate customers demanding an early fix. Microsoft's security business VP, Mike Nash wrote on the Microsoft Security Research Center (MSRC) blog, "When I spoke to a number of customers and asked if the current situation warranted an out of band release of the update, they said yes". He has also recommended that enterprises deploy the fix as soon as possible.

Experts say another reason for the unduly prompt action by Microsoft is to scuttle the use of unauthorized patches with its software.
Those willing to settle for a third-party fix lapped up Russian programmer Ilfak Guilfanov's code, devised to protect computers against WMF exploits.

Security firms warned of the danger of 'exploits' or phishing scams -- programs/code leveraging the WMF vulnerability –saying they had proliferated with thousands of websites, legitimate and otherwise. Exploits are hacked to silently deploy malicious code and claim those looking for quick fixes as their victims.

The patch notwithstanding, a security professional said, the 'soft underbelly' would continue to plague Windows users for the next six to eight months.

Those wanting to get hold of the patch may visit the web page of Microsoft and click on the 'Security Update for WMF Vulnerability'.