Windows graphics bug opens backdoor

Microsoft has released an update that plugs three vulnerabilities in the Windows operating systems. 

The flaw could allow an attacker to take control of a system with a specially crafted Windows Metafile (WMF) or Enhanced Metafile (EMF) image. Windows handles the images incorrectly, opening a backdoor in the operating system.

Security provider eEye first reported the flaw to Microsoft more than six months ago. A second vulnerability affecting only the WMF format was reported over two months ago.

Both bugs are rated critical because an attacker could exploit them by posting a maliciously crafted image on a website or sending it by email. After the system is infected, the attacker could install programs as well as view or change data.

The patch also fixes a bug in the EMF format with a 'moderate' severity rating. It causes a crash of the application that is trying to open the file, but does not open any backdoors.

The bugs affect systems running Windows 2000, XP and Server 2003. Users can update their systems through the Windows Update website.

Security issues relating to software that improperly handles image formats are not limited to Windows.

Apple issued a patch in September for critical vulnerabilities in its OS X operating system that affected the Pict image format and in the ImageIO tool.

The flaws could have been used to gain control over a system through a buffer overflow attack.

See also:

Windows Update Trojan causes havoc

Spoofed Microsoft patch catches unwary users  08 Nov 2005

Single fix for Microsoft's November patch Tuesday

Windows flaw rated 'critical'  07 Nov 2005

Windows chokes on latest Microsoft patch

Patch MS05-051 disables firewall for some users  17 Oct 2005

Microsoft warms up for security push

Beta of enterprise desktop security suite promised later this year  07 Oct 2005

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!