More WMF woes for Microsoft

Even as Microsoft was releasing its latest batch of patches, two previously undocumented Windows Meta File (WMF) flaws have been exposed. 

The new vulnerabilities were discovered by a computer enthusiast known as 'cocoruder' and affect all Windows operating systems beyond Windows 95.

The flaws are in the Graphics Rendering Engine and could allow a hacker to exploit a memory overrun and crash a PC. 

"Our initial investigation has found that these are not security vulnerabilities but rather performance issues that could cause an application to stop responding," said Microsoft in a statement.

"These issues do not allow an attacker to run code or crash the operating system. They may cause the WMF application to crash, in which case the user may restart the application and resume activity.

"Microsoft had previously identified these issues as part of its ongoing code maintenance and is evaluating them for inclusion in the next service pack for the affected products."

The flaws were posted on the Bugtraq mailing list, and code purporting to exploit the flaws appeared shortly afterwards.

See also:

Windows WMF patch promised for next week

'Extremely critical' vulnerability to remain unpatched for another week  04 Jan 2006

Hackers target zero-day Windows vulnerability

Users could get infected just by visiting a website  29 Dec 2005

Windows graphics bug opens backdoor

Software improperly handles graphic files  09 Nov 2005

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!