Hi everyone, Stephen Toulouse here. Now that the monthly release has passed and people are deploying the updates I wanted to take a moment to discuss some things related to questions we’ve been receiving on the recent WMF issue. (Which was addressed in MS06-001). One question we’ve gotten is about SetAbortProc , the function that allows printing jobs to be cancelled. (The link is to the public documentation of the function) Specifically people are wondering about how the vulnerability was present...

Lennart Wistrand here. I wanted to write a few lines about the public post made over the weekend about a new specially crafted WMF image that could potentially cause the application using the Windows Graphics Rendering Engine to crash. As it turns out, these crashes are not exploitable but are instead Windows performance issues that could cause some WMF applications to unexpectedly exit. These issues do not allow an attacker to run code or crash the operating system. They may cause the WMF application...

Hi folks- Kevin Kean here again. We here in the MSRC have been hard at work on this WMF vulnerability and so I wanted to provide you all with an update on the situation. When the MSRC learned of the attacks on December 27, 2005, we mobilized under what we call the Software Security Incident Response Process (SSIRP) to analyze the attack, assess its scope and determine and the appropriate guidance for customers, as well as to engage with anti-virus partners and law enforcement. Based on...

Hi there. Mike Nash from Microsoft here. For those of you who don’t know me, I am the Corporate Vice President responsible for security at Microsoft. Given the recent events around the Windows Meta File format vulnerability, an ongoing dialogue I have had with some customers and our recent decision to release an update for Windows out of band to correct this vulnerability, I thought I would take a minute to give you a sense of the thought process behind Microsoft’s decision. As you know, we...

Mike Reavey here from the MSRC- I just wanted to provide another quick update on the WMF vulnerability situation. Microsoft is continuing to work on finalizing a security update for the vulnerability in WMF that is currently being exploited by some malicious attackers. The update has been on an expedited track since Microsoft became aware of the attacks on December 27th. We still anticipate releasing the security fix for this issue on January 10, 2006, once testing for quality and application compatibility...

Hi everyone, Stephen Toulouse here. There is a lot of activity happening within the MSRC this week so I wanted to make sure that, in addition to the guidance we’ve put out around the WMF vulnerability, that we also let you know that we’ve issued a security advisory regarding recent variants of the Win32/Sober worm. To be clear, these are separate and unrelated issues, however getting guidance out to customers is equally important when customers are faced with any sort of malicious threat. The...

I wanted to let you know about a new offering that those of you enterprise customers that download multiple security updates in multiple languages might find useful. Starting with the January 2006 release, each month we're making security and high-priority non-security updates that are available on Windows Update also available on an ISO-9660 CD image. This has items available from Windows Update only, so this means that you won't find updates for things like Office or Exchange. This isn't intended...

Hey folks – Mike Reavey here stepping in for Craig as he continues to work through some last minute issues on this Tuesday’s release. Today we’ve released two Security Bulletins. The first one, MS06-002 resolves a vulnerability in Font processing in Windows and is rated Critical. The second bulletin, MS06-003 is also rated Critical, and applies to Office and Exchange customers, and resolves an issue in Transport Neutral Encapsulation (TNEF). We’re actively working through a delay on getting the MS06...

Why is security@microsoft.com an auto-responder and not a redirect to secure@microsoft.com? Well, security@microsoft.com is the Microsoft internal physical security alias, and has been since we started using email. As I am sure you can imagine, the amount of email we get at that alias that is external is quite a lot. Thus the autoresponder instead of a human filter which informs you that secure@microsoft.com is the appropriate alias to report security vulnerabilities (and points to other security...

Hi everyone, just wanted to quickly point out that the Anti-malware team has posted a short note on the Win32/Mywife.E mass mailer worm. Pretty much all current AV protects against this worm, so running updated anti-virus is an important thing to do. In addition Windows OneCare members are also protected. The worm doesn't exploit a vulnerability, and requires user interaction. There's more over at the anti-malware blog . S. *This posting is provided "AS IS" with no warranties, and confers no...