Quantcast
Today @ PC World
News, opinion, and links from the PC World staff.

Extremely Critical Windows Security Hole

Posted by Erik Larkin | Wednesday, December 28, 2005 2:12 PM PT

Secunia, Kaspersky and others have alerts up today about a new vulnerability in the way Windows handles Metafile files (*.wmf). It's a bad one: it has the highest possible risk rating, there aren't patches yet, and there are known exploits in the wild that take advantage of the hole.

According to Kaspersky, it hits IE and "may function in Firefox if certain conditions are met." The AV company's post lists two Web sites that attempt to install a Trojan using the hole.

Both notices strongly caution against opening any untrusted *.wmf files and recommend setting your IE security setting to "High." And of course keep your AV programs updated.

Secunia report

Kaspersky report

Comments (28)

One wonders how long it will take companies to realize that the COO of MS Windows is far higher than MS claim? Running a windows shop is a process of staggering from one fix to the next. Good luck all you Windows users out there.

Hugh
December 28, 2005
9:21 PM PT

Same old, same old. Though mom and pop are sure out of luck using the abomination that MS makes, the IT guys can't be happier. Could mean a RAISE in 2006!

Les Kern
December 28, 2005
9:51 PM PT

It really is quite shameful, to have bug patches every month. Which makes one wonder, could NASA be as buggy as Microsoft? And if not, what makes the difference? Afterall, if you have a space shuttle out there, they could be stuck there forever. Can't commercial softwares instilled a bit more vigorous discipline in their software design and quality??

Les
December 28, 2005
10:31 PM PT

When he invented the internet, Al Gore should have done a better job! :^)

Roger
December 28, 2005
10:35 PM PT

Well I happen to be right there with you Hugh. Windows is a very vulnerable OS, however i would like to point out that if windows were not the number one OS used by less computer literate people (put lightly) and linux was the number one. Then people would then start looking in linux for the vulnerabilities. There would be pleanty found. The only reason i feel that linux is beter is that it has been made open source and you can fix it yourself. So in a bit of a debate with you, I would just like to say that no programmer in the world could build an OS and not have a single vulnerability to it. MS is doing a good job in my mind, Now only if they would get patches out quicker...

bob
December 28, 2005
10:45 PM PT

MS Windows + destructive virus-making idiots = mediocre but usable computer for the masses
Mac Os + desctructive virus-making idiots = good computer for a few who can afford them and who don?t mind putting up with the more limited selection of hardware and software
Linux + destructive idiots = mediocre but usable computer for computer nerds
New "invencible" OS + destructive idiots = mediocre but usable computer for the few who dare to change and another upcoming rich Bill Gates

The moral of the story... Don?t matter what OS or software that?s out there, as long as there are fools who want to cause caos, there will be threats that will have to be remedied.

billy boy
December 28, 2005
11:04 PM PT

Im safe! :P I have a Mac. BTW any Unix based system is WAY better off than any Windows even if everyone used them. Yes there would be viruses and holes I'm sure but do you really think there would be anywhere this many? Not a chance.

So why do we keep shoveling money at MS while other superior OS's are available?

Foxxxy
December 29, 2005
12:30 AM PT

Hello world!
Don't worry! MS will fix it like a piece of cake!
MS can create huge Windows systems which can fix the holes! holes are everywhere! no one can live without finding holes!
some holes are good! for IT to fix and keep their jobs or they will be sent home for lacking of works! holes are good for IT fixers! the more holes can be found the better chances IT boys can take assignments and obviously they will have more raises than all of you!
Who can find holes will not get raises but who can cover the holes these boys will take the money and go skiing with their girls!
don't worry boys!

tt

tt
December 29, 2005
12:39 AM PT

Im a Linux man too but to be fair I must say that the reasons of the (known) vulnerabilities of windows is the number of individuals working agains the MS giant. If the same efforts were given into attacking Linux probably the same situation woulld arise... specially when the source code is available; in that case people would scrutinize the open source nature of the OS. Not that threats do not exist but the efforts of more are not there due to the low percentage of machines using Linux...

Mark Mull
December 29, 2005
12:49 AM PT

Windows Haters....
Guys if you cant tollerate such a bad OS as windows, i dont understand why the hell int he world do u keep track of these things. all said anddone, you take Windows the way it is. Love it or Hate it, you cant live without it...

sd
December 29, 2005
1:42 AM PT

Perhaps the media should expend the same effort exposing and assisting in the prosecution of people who reverse-engineer the OS to deliberatly target us users as they do on publicising every tiny loophole found.

These people cause malicious damage and destroy our livelihood, yet the media constantly blames MS for their actions.
Every car door in the world is unsafe as professional criminals learn new ways to circumvent manufacturers security, but we try and catch the thief, not attack GM or BMW.

I think we need to reprioritize and start locating and prosecuting the vandals, not the victims.

Gadget

Gadget
December 29, 2005
1:53 AM PT

Ahh! But did you hear the case about the man who's baby almost died because he could not get into his BMW (keys in the car of course) to save his suffering child! Not until he broke the window open. Darn locks on the doors wouldn't let in even the most skilled theif.

Why did BMW do this? Public pressure and the number of folks stealing BMW's! So, let's keep the pressure on!

Back to Windows...let's be fare guys...Why is Linux safer? Because from the beginning we try not to run things as "root". And we use a secure filesystem. A good Windows administrator will try not to let things run as "administrator" either. But...let's do so on a correctly setup NTFS system. Good luck FAT32 users!

As Windows admins will tell you, a "correctly" setup NTFS system is tough to do. But so is a correctly setup Linux (ext3 or reiser) filesystem.

And...every day (ok, month or two) RedHat issues a "security" warning were hackers might get "elevated" privileges in Apache or SSH (thanks SELinux for saving me!).

It's all the same guys...or is it...? I certainly do love my Linux box that's been in production for 3 years (still running RedHat 7...I think) with the only downtime being that the electricity was cut off at the Data Center.

Stability is the issue...not security. (IMHO)

james
December 29, 2005
2:33 AM PT

Did I hear someone say "HOLE"?

POLYFILLA always works !!!

In this case and others with Microsoft... I think we may need a few Tubs !!!

Zeemail
December 29, 2005
2:58 AM PT

Isn't it amazing how clear it is on a cold moonlit winter night in the mountains. If one stands at the edge of a cliff and looks up, one can almost see heaven through the stars.

Now if God created that blanket of twinkling lights to fill our minds with awe and wonder, why not just accept that we are all on a working journey towards a perfect operating system one step at a time?

Thank you Mr. Gates and all the other pioneers of our new electronic frontier for using your gifts and generosity to change the world in just a few short years.

Craig
December 29, 2005
3:16 AM PT

"Windows Haters....
Guys if you cant tollerate such a bad OS as windows, i dont understand why the hell int he world do u keep track of these things. all said anddone, you take Windows the way it is."

Because it fun! I love seeing people keep putting up with Windows BS, some people are just too stupid to change to Mac or Linux.

I ditched it 5 years ago and never looked back.

Tom
December 29, 2005
4:39 AM PT

"...however i would like to point out that if windows were not the number one OS used by less computer literate people (put lightly) and linux was the number one. Then people would then start looking in linux for the vulnerabilities."

Whoa boy! If that ain't a tired, unsubstantiated and typical MS apologist argument!

The Raven
December 29, 2005
4:39 AM PT

Anyone who can put us with the autistic Gates operating systems is a masochistic. Get Apple's OS X or Linux and don't believe the FUD manure the Micro-softies spread.

Ardie
December 29, 2005
6:11 AM PT

Plain and simple... I want to know what is going on with my system... in and out. I want access to my source code. I want to be able to whittle the non-essentials off of my system. I want y system to run sleek and trim to my liking. Windows allows illiterate users to feel nice and graphically safe. Why wait and hope MS will patch your problems away? Pull up your pants, grit your teeth, and take an active control over YOUR system, YOUR security, and Your responsibilities. Linux is my choice because it offers me a variety of paths and avenues without lulling me to sleep behind the wheel of the BIG BUS. Jump in the drivers seat and take an active roll in your system.

Jaime "thug geek"
December 29, 2005
8:01 AM PT

It just dawned on me that the MS OS is very appropriately named. 'Windows' are, in fact, holes. In our world, we plug most of them with glass and install shades to control access. We need them to maintain a "connection" to the outside world while providing protection from the elements. MS gets more stones thrown at it because it is the skyscaper amongst the office buildings. Ease up on the bashing. The other commenters are correct...if Linux distros or another OS was as prevelant and popular, the hackers would be throwing stones at their 'windows' too.

DB
December 29, 2005
9:55 AM PT

The some basic rules of thumb for software:

1. The more complex/features in the software, the more bugs/holes it has.

2. The more useability the software has, the more bugs/holes.

3. The more compatibility the software has, the more bugs/holes it has.

4. The more people that use a piece of software, the more likely bugs/holes are encountered/discovered

5. The more people that use a piece of software, the more criminals will try to attack that software to be able to target the most people.

Additional: The dumber (or less informed if you want to be PC) the user, the more likely to trigger an attack on themselves with ANY software.

Any IT person that knows their stuff knows these things. The problem with Windows that we have is stability, NOT security. Those that bash Windows for security reasons might as well bash all email programs/services for being the largest vector of viruses, spam and scams on the internet.

Remember, different OSs have different strengths, some have more versatility, some have better security. None is entirely superior. And most of them are trying to make a profit.

Eric K.
December 29, 2005
10:08 AM PT

regsvr32/ushimgvw.dll workaround not found. I added space behind 32 cuz looked like might be there, still no luck. Then added, , after dll. When searching anywhere in file found 3. Name 0
REGSVR32.EX_ in C:\WINDOWS\I386 4.35 KB (4,459 bytes) size on disk 8.00 KB (8,192 bytes)
Said Win can't open, is it CA or AVG anti-virus?

regsvr32.exe prop said Microsoft(C) Register Server ok dig this.

regsvr32.exe prop said C:\WINDOWS\ServicePackFiles\i386 Think ok too
What is the real deal for my XP-home? thanks

Chas.A.Graves
December 29, 2005
10:59 AM PT

PC World should install software to automatically check grammar and spelling before posts are made.

Anonymous
December 29, 2005
12:42 PM PT

As a person who posted a grammatical error, I have to concur. Not only is my grammar horroble (y instead of my), my brain should be patched with every patch and service pack MS has ever created/released.

"thug geek"
December 29, 2005
1:17 PM PT

another windows hole, what a shocker! I have software that scans the internet for new bugs and I average a new security problem with windows or windows software every 14 hours...

linux lova
December 30, 2005
9:20 AM PT

I really enjoy watching you platform zealots argue. Keep up the good work.

- The Windows, Mac OS, LINUX, UNIX user

The Lightning Stalker
December 30, 2005
11:54 PM PT

I have been using xp for quite some time now and have had few problems May you people need a lesson in internet security, or Better yet just keep using linux and apple.I'm sure that microsoft does not need your support .p.s if you don't like xp don't use it .and shut up .

geekboy
January 03, 2006
9:56 AM PT

I don't recall anyone seriously microhating. I just see ppl ranting about WHY they feel their particular flavor of OS is better or more desirable for their wants/needs. I notice how microusers always default to the same argument, "if you don't like .... don't use it... shut up... and Bill Gates is god...". When we get to name calling and throwing around hateful invectives it really shows who wins the argument! Linux rules! Thank you for your time, geekboy.

thug geek
January 03, 2006
10:54 AM PT

True I can't live without winblows, but that's becuase the games I like to play only work on winblows. And boy have I been looking forward (since the day I heard of the project) to the day when the WINE/Gentoo people make WINE work..well, near enough flawlessly. It's even made me switch from Slack to Gentoo on my game console, err I mean my winblows machine. People don't choose winblows, winblows choses people in the store when the buy a computer.

Some companies (like Dell) don't even give you the option to not have winblows preinstalled. How many of you change the parts of your cars that you don't like. Not many I would guess since you don't know how to or have the time or energy for it. It's times like these I'm happy I'm not a computer illiterate.

Anyway, my point (yes there is one) is that winbows is used by 90% of the people because most of them got it shoved their throats to begin with. Thus the majority of the software companies make software that only supports windows because, guess what, 90% of the people use windows. Hey isn't that what they call the vicious circle of addiction???

Essi
May 09, 2006
1:13 PM PT