Windows Security Fix released for graphics rendering bug

Microsoft Update | 12/5/06 | Self

[Cicero]

Microsoft has posted a security fix for the windows metafile bug, and it is available at the Windows Update site.

I can't speak for earlier operating systems, but I have downloaded and installed it for Windows XP and Windows 2000.

Because of the urgency, Microsoft released the fix early. Other updates will be available as usual next Tuesday at the Update site.

[Cicero]

I thought I'd post this since there has been so much discussion of this security problem in FR.

[Echo Talon]

this fix was available for me via automatic updates.

[MineralMan]

Even as I write, the Windows automatic update system is performing this update.

[Cicero]

Not everyone has AutoUpdate turned on.

[Boundless]

For Win2K, it's this one:

Security Update for Windows 2000 (KB912919)
Typical download size: 487 KB

[Windcatcher]

Just patched my Win2k box...hopefully I'll be back after the reboot :)

By the way, an unofficial Service Pack 5 for Win2k has been underway at http://www.msfn.org for some time (the Win2k Hotstream project). I'm sure this patch will be added to the service pack in short order. The USP5 is great for getting your Win2k installation up to speed in short order, and it's supposedly slipstreamable.

[Boundless]

> Not everyone has AutoUpdate turned on.

I don't, for example.
For several reasons:

1. Avoid MS updates that include time-bombs intended to
force me onto a subscription license in the future.

2. Avoid optional updates ("High Priority" updates not
really a threat to my config) that haven't been adequately
tested in the real world.

3. This is MS we're talking about, and it's just a
matter of time before some cracker co-opts the auto-u
for malicious purposes.

4. I have quite enough crap phoning home and tying up
my dial-up.

[Cicero]

Yes, those unofficial service packs are worth downloading and putting on CD, in case you have a bad problem and need to do a fresh install. It would save you a lot of time.

[fr_freak]

For those of us without auto-update turned on, here is the download link:

http://www.microsoft.com/technet/security/bulletin/ms06-001.mspx

[Echo Talon]

I know, just letting you know that this was covered by that.

[Echo Talon]

I have auto update setup to let me know before it downloads, it just informs me that a download is available and gives info on what the update is.

[George Smiley]

what's even better, you can build a w2k distribution CD that doesn't have IE, OE and a host of other security vulnerabilities that Windows is prone to.

And the poster fdv at msfn is Fred Vorck:

http://www.vorck.com/remove-ie.html

[Ernest_at_the_Beach]

Just posted this:

Newsmaker: Beating Microsoft to the punch ~ Russian authors patch for WMF flaw

[Cicero]

Yes, I saw. I waited for the Microsoft fix. I disabled the thumbnail function earlier and now have re-enabled it after doing the Windows Update.

This unofficial fix may very well work, but I hate to play games with the MS operating system files. For instance, what might it do when you go to Windows Update?

[nw_arizona_granny]

Ping.

[Ernest_at_the_Beach]

True!

[Aaron0617]

Just patched my Win2k box...hopefully I'll be back after the reboot :)

heh heh..I cringe every time I install one of the many updates from them. But looks like everything is still okay. I have Win XP Pro.

Just bumping to remind anyone else.

[TruthSetsUFree]

I have XP Home and installed it this afternoon and everything seems to be fine.

[firewalk]

bttt

[Boundless]

> I have auto update setup to let me know before it downloads,

It now turns out that Mr.Bill doesn't necessarily respect
that setting. See:

Microsoft patches without permission
http://www.theinquirer.net/?article=28899