Microsoft releases fix for WMF flaw

09.01.2006
Citing "very strong customer sentiment" and an earlier-than-expected wrap-up of testing work, Microsoft Corp. last week released a patch for a flaw in a Windows image-processing module after initially saying the fix wouldn't be issued until tomorrow.

[View more Windows WMF vulnerability coverage] Microsoft's reversal of course on Thursday came as malicious hackers ratcheted up their attempts to exploit the flaw and IT managers and security analysts differed on whether corporate users should install an unofficial third-party fix or wait for the software vendor's patch.

Some IT executives interviewed by Computerworld said that before Microsoft issued the patch, they were in a quandary over how best to protect their systems against the Windows Metafile flaw.

"We frankly don't know quite what to do," said Matt Kesner, chief technology officer at Fenwick & West LLP. "To use the old colloquialism, we are damned if we do and damned if we don't."

Waiting until this week for Microsoft's patch could have exposed the Mountain View, California-based law firm's systems to exploits targeting the WMF vulnerability, Kesner said. Fenwick & West's IT staffers were unsure whether the work-around procedures initially suggested by Microsoft would have provided sufficient protection, he said.

But, Kesner added, installing an unofficial patch on the law firm's Windows servers could result in unforeseen consequences and raise potential support issues with Microsoft if the systems had technical problems in the future.