Re: Here is a real reality check for every PC user...

["Jim Franz" <franz400@xxxxxxxxxxxx>]

todays MS Critical vulnerability (with no patch available....)
and Joe is right - a "buffer overrun"....

A vulnerability has been discovered in Microsoft Windows that allows hackers 
to remotely access PCs and install malware through an imaging-handling 
technology in the operating system.
The vulnerability can also be triggered from the Internet Explorer browser 
if the malicious file has been saved to a folder and renamed to other image 
file extensions such as ".jpg," ".gif," ".tif," and ".png." It has been 
detected on a patched system running Microsoft
Windows XP SP2. Microsoft Windows XP SP1 and Microsoft Windows Server 2003 
systems also are affected.
Current exploits use the Windows Picture and Fax Viewer to attack any 
application that can handle Windows Metafiles. Disabling the Windows Picture 
and Fax Viewer will not eliminate the risk as the flaw exists in the Windows 
Graphical Device Interface library.
The flaw has also raised concerns that Google Desktop may be another 
potential attack vector, and that various antivirus software products cannot 
detect all known exploits for this vulnerability.

WMF images are graphical files that can contain both vector and bitmap-based 
picture information. Microsoft Windows contains routines for displaying such 
files, but a lack of input validation in one of these routines may allow a 
buffer overflow to occur, which in turn may allow remote code execution.
People who use Windows are advised to be wary when opening e-mail and links 
in e-mail from sources they don't trust. They should not save, open or 
preview image files from unfamiliar sources. And, as always, people are 
encouraged to update the patches for their operating systems.

jim franz