I sent this e-mail to my friends/family this morning. There was a temporary patch available before Microsoft’s official release, but the MS solution appears to be the best now.

Hey Guys –

There is a fairly substantial security issue floating around on the net right now, and it needs your attention ASAP.

Here’s the deal. It’s not a “flaw” per se, but the way that Windows handles certain meta (image) files. If the image/meta code isn’t constructed properly, Windows allows the file to execute another routine. So, spyware/malware companies are creating incomplete image files, and adding malicious code to their backends that installs nasty stuff on your machine without your knowledge. It’s bad news.

The biggest problem is that you don’t have to download anything. Viewing an image on a website, or receiving one in e-mail is sufficient.

Seriously.

If you’re using Windows XP Service Pack 2, click here to get the patch:

Link

If you’re on 2000:

Link

If, by chance, you’re running 98 or Me…you could be screwed. So far, it doesn’t appear that MS intends to issue a patch for those two…though the guys over at http://www.grc.com are talking about developing one.

Pass it along. This one could get ugly.

-T

WMF, Microsoft, Patch