'Critical' Patch Released For Windows

Wednesday Nov 9th 2005 by Lauren Simonds
Share:

November's monthly fix from Redmond includes a critical fix to three bugs affecting the graphics-rendering engine in several versions of Windows.

Microsoft has released a bulletin for a Windows patch labeled critical.

The security bulletin addresses three vulnerabilities, each affecting the graphics-rendering engine in Windows 2000, Windows XP SP1/SP2, Windows Server 2003 and Windows Server 2003 SP1. The bulletin's number is MS05-053.

The main culprit behind this security bulletin is a critical vulnerability in the Windows rendering engine. Any program rendering a Windows Metafile (WMF) or Enhanced Metafile (EMF) image is open to attack by (malware) writers.

WMF and EMF are two graphics file formats used in Windows; WMF is for 16-bit computing and EMF is for 32-bit systems; the two file formats hold vector and bitmap graphics information when they are exchanged between applications.

If the WMF image is compromised by an attacker it leaves the system open to remote manipulation, allowing him to add, delete or modify files on the computer. If the EMF image is attacked, it could open the system up to a (denial-of-service attack), eventually crashing the machine.

While the graphics rendering engine vulnerability is a critical fix for the five operating system versions mentioned in the bulletin, not every system is affected by the particular image file formats. The WMF vulnerabilities, for example, don't affect systems running Windows XP SP2 and Windows Server 2003 SP1.

As is the case with most vulnerabilities, the only way to open yourself to attack is to open a file or folder with the altered image, view an HTML e-mail message or to visit a Web site with an image containing an exploit to the vulnerability.

In the security bulletin officials said they have not found, nor have been informed of, any exploits in the wild targeting this vulnerability.

The company also released updated virus definitions for the Microsoft Windows Malicious Software Removal Tool. Microsoft renamed its anti-spyware offering, Windows AntiSpyware, to Microsoft Defender.

The Redmond, Wash., software giant releases security vulnerabilities affecting its software on the second Tuesday of every month, popularly known as Patch Tuesday.

Adapted from Internetnews.com.

Do you have a comment or question about this article or other small business topics in general? Speak out in the SmallBusinessComputing.com Forums. Join the discussion today!
Share:
Home
Mobile Site | Full Site
Copyright 2017 © QuinStreet Inc. All Rights Reserved