Huge virus threat rocks Microsoft (fix here)

[Ziroc]

http://money.cnn.com/2006/01/03/tech...ex.htm?cnn=yes

Until Microsoft gets the patch out, I would install this temp fix, so you are safe.

http://isc.sans.org/diary.php?storyid=1010
(respected site that handles inet security)


----------
January 3, 2006: 3:42 PM EST


NEW YORK (CNNMoney.com) - The new year is off to a rocky start at Microsoft, where security experts are scrambling to confront a potentially massive virus threat to Windows PCs.

According to a report Tuesday in the Financial Times, the latest vulnerability involves a flaw which allows hackers to infect computers using programs inserted into image files. The threat was discovered last week. But it mushroomed over the weekend, when a group of hackers published the source code they used to exploit the flaw.

What makes this threat particularly vicious, according to the Times, is that unwitting victims can infect their computers simply by viewing a web page, e-mail, or instant message that includes a contaminated image. That differs from most virus attacks, which require a user to actually download an infected file.

"The potential [security threat] is huge," Mikko Hypponen, chief research officer at F-Secure, an antivirus company, told the Times. "It's probably bigger than for any other vulnerability we've seen.

"Any version of Windows is vulnerable right now," said Mr. Hypponen, including every Windows system shipped since 1990.

Microsoft said a security patch would be available for the problem on Tuesday, January 10 after it has passed rigorous testing procedures.

Because of the severity of the threat, the SANS Institute, a computer security group, has released a patch for the vulnerability until Microsoft's fix is available next week. It is available here.
--------------

[ 01-04-2006, 07:42 AM: Message edited by: Ziroc ]

[Madman-Rogovich]

Sounds nasty, cheers for the headsup man [img]smile.gif[/img]

[Timber Loftis]

Is this an issue if you don't use IE but Mozilla instead?

[shamrock_uk]

Yes, but it's more difficult to get infected. As Internet Explorer is basically the same as Windows Explorer you get affected immediately as you view the image in your browser.

In Mozilla I think you'll be ok viewing it in your browser, as long as you don't go viewing the file in your cache folder or download the picture yourself. If you access the picture using Windows explorer (ie when you look at a thumbnail) or the picture viewer then you're toasted as usual.

[ 01-04-2006, 02:04 PM: Message edited by: shamrock_uk ]