Exploit Released for Unpatched Windows Flaw

woodchuck writes "Washington Post reports that another Windows hole has been found and exploit code is now running lose that makes swiss cheese of current patches and security measures. From the article: "Security researchers have released instructions for exploiting a previously unknown security hole in Windows XP and Windows 2003 Web Server with all of the latest patches applied. Anti-virus company Symantec warned of the new exploit, which it said uses a vulnerability in the way Windows computers process certain image files (Windows Meta Files, or those ending in .wmf). Symantec said the exploit is designed to download and run a program from the Web that downloads several malicious files, including tools that attackers could use to control vulnerable computers via IRC.""

Upside.

[grub]

With Vista you'll be able to get this from the comfort of an RSS feed!

Re:They call hackers researchers now?

[slavemowgli]

ESR is not a hacker... he's a nut. :)

In other news...

[guruevi]

Microsoft said in it's late night response on new years day that a patch is being made, the flaw is not critical since no-one actually uses WMF and the rest who do use them never should surf to porn and warez sites anyway. A patch will be available in Windows Shoehorn.

Re:They call hackers researchers now?

[Anonymous Coward]

They're not hackers, they are crackers.

Nice...racist. And I suppose that if they were black, it wouldn't be okay to call them niggers.

Scary.

[Anonymous Coward]

Surfing for porn with IE on Windows is like having unprotected anal sex with everybody on the internet.

steps ahead (again)

[fihzy]

Once again, as noted previously here [slashdot.org] and here [slashdot.org]:

10) find big remote vulnerability in product
20) perfect the exploit
30) have fun with it for months
40) find another big hole in same product
50) perfect exploit for hole
60) alert vendor about original hole
70) have fun with new hole
80) goto 40

Re:Say it isn't so!!

[raistphrk]

Say it isn't so!! (Score:1, Redundant) by Foofoobar (318279) Alter Relationship on Wednesday December 28, @07:56PM (#14355427) Windows Exploit? Isn't that redundant?

Wow...sometimes, Slashdot ratings really DO match the content in posts!

Re:They call hackers researchers now?

[Ohreally_factor]

So, if you root his box, that makes you a nut cracker? Sweet!

this may sound bad but

[Revek]

Hell bring it on. I opened my own shop about 4 months ago and can clean most anything off a machine. Its 95% of my buisness so far and im tired of being poor. This week alone Ive cleaned 8 xp home boxes all still sp1 with no antispy or antivirus still running. Only one of the machines needed parts. It had a winlogon popup running that killed windows update and automatic update (senslogn key was missing). I think the real proplem with the current state of affairs is not that the exploits are produced and released but that microsoft builds to fast and to often. They need to can vista and put more R&D into fast fixes. If they want discreet disclosure of exploits they should offer $$ for it. Just tell them and get a check :)..... nah never happen they will just build the new big security hole called a OS.

Re:They call hackers researchers now?

[lawpoop]

I knew a very smart and experienced admin from Slovenia. He was trying to tell me about script-kiddies. He asked me what the word was for "the froth of piss". I told him we didn't have such a word in English. Well, that was his ideas of script kiddies.

SO, to re-cap:

• Crackers are hackers
• hackers aren't nessearily (or usually) crackers.
• Script-kiddies are the froth of piss.

Re:Breaks thumbnails and Windows Picture Viewer

[jafiwam]

Yeah, so how am I supposed to sort my porn without thumbnails?

I'll take my chances, they still gotta get me to open a stupid .wmf in the first place.

Re:They call hackers researchers now?

[Ignominious Cow Herd]

The last scene was interesting from the point of view of a professional logician, because it contained a number of logical fallacies, that is invalid propositional constructions and syllogistic forms, of the type so often committed by my wife.

"All wood burns", states Sir Bedivere. Therefore he concludes, "all that burns is wood". This is, of course, pure bullshit.

Universal affirmatives can only be partially converted; all of Al McCogan is dead, but only some of the class of dead people are Al McCogan. Obvious, one would think.

However, my wife does not understand this necessary limitation of conversion of a proposition, so consequently she does not understand me. For how can a woman expect to appreciate a professor of logic if the simplest cloth-eared syllogism causes her to flounder.

For example, given the premise all fish live underwater and all mackerel are fish, my wife will conclude not that all mackerel live underwater, but that if she buys kippers it will not rain, or that trout live in trees or even that I do not love her any more.

This she calls "using her intuition". I call it "crap" and it gets me very irritated because it is not logical.

"There will be no supper tonight!", she will sometimes cry, upon my return home. "Why not?", I will ask ask; "Because I have been screwing the milkman all day!", she will say, quite oblivious of the howling error she has made.

"But", I will wearily point out, "even given that the activities of screwing the milkman and getting supper are mutually exclusive, now that the screwing is over, surely then, supper may now logically be got."

"You do not love me anymore!" she will now often postulate. "If you did you would give me one now and again, so I would not have to rely on that rancid Pakistani for my orgasms."

"I will give you one", I now scream, "after you have gotten my supper, not before." as you see, making her bang contingent on the arrival of my supper.

"Good, you turn me on when you're angry you ancient brute", forcing her sweetly throbbing tongue down my throat.

"Fuck supper!" I now invariably conclude, throwing logic somewhat joyously to the four winds. And so we thrash about on our milk-stained floor, until we sink back exhausted onto the cartons of yougurt. ...I seem to have strayed somewhat from my original brief. But in a nutshell, sex is more fun than logic. One cannot prove this. But it is in the same sense that Mt. Everest is or that Al McCogan isn't.

Good night.

(from the Soundtrack, of the Trailer, of the Film, of Monty Python and the Holy Grail)