Microsoft Windows Vulnerable To 'Huge' Virus Threat

Russian Programmer Develops Unofficial Fix

All versions of Microsoft Windows are now thought to be vulnerable to viruses and spyware exploiting Windows Metafile (WMF) files.

From Financial Times via The Drudge Report:

The flaw, which allows hackers to infect computers using programs maliciously inserted into seemingly innocuous image files, was first discovered last week. But the potential for damaging attacks increased dramatically at the weekend after a group of computer hackers published the source code they used to exploit it. Unlike most attacks, which require victims to download or execute a suspect file, the new vulnerability makes it possible for users to infect their computers with spyware or a virus simply by viewing a web page, e-mail or instant message that contains a contaminated image.

“We haven’t seen anything that bad yet, but multiple individuals and groups are exploiting this vulnerability,” Mr Hyppönen said. He said that every Windows system shipped since 1990 contained the flaw.

...some security experts were urging system administrators to take the unusual step of installing an unofficial patch created at the weekend by Ilfak Guilfanov, a Russian computer programmer.

The Russian patch is available here. Guilfanov recommends uninstalling it as soon as Microsoft gets off the dime and offers their own patch. I can't vouch for the patch. Most corporate system administrators will not use unofficial patches. If you install it, read everything carefully and proceed at your own risk.

Also posted at The Jawa Report.