WMF Vulnerability

Date: January 6, 2006

A serious vulnerability in how Microsoft Windows operating systems handle WMF files (Windows Meta File, a kind of graphics file) is now being exploited by virus and trojan writers.

Attacks using this vulnerability are particularly dangerous because just visiting a Web site or viewing the thumbnail of a graphics file can launch an attack on your computer.

What UW Technology is doing

UW computer security systems stop millions of attacks against UW email and networks each day. While these systems play a important role in protecting us, it is equally important that every computer run up-to-date operating systems, programs, and anti-virus programs. By ensuring that your computers have up-to-date software and by following a few common sense guidelines you can be protected here, at home, or on the road.

Fortunately, it is easy to set up your computer to automatically keep up to date. Just follow the steps outlined below.

How to protect your computer

ALL computers connecting to the UW network, including office, home, classroom, lab, and portable computers, should be properly managed to prevent them from becoming infected by viruses.

If your computer is managed or supported by someone else (e.g., configuration, installations, and updates are done for you), then do not change anything without explicit permission.

If you are maintaining your own computer, UW Technology strongly encourages you take the following steps:

Keep your Windows computer up-to-date by turning on automatic updating on the Windows Security Center control panel (Start -> Settings -> Control Panel -> Security Center -> Automatic Updates).
You can also check the Microsoft Update site anytime for critical updates.
Install an anti-virus program. All faculty, staff, and students at the UW can obtain McAfee anti-virus software by buying the UWICK CD at the University Book Store for $1 or by downloading it from the UW Software Guide If you have an old version of McAfee on your computer, you should upgrade to Version 8.
Update the data files for your anti-virus program regularly. Updates come out daily so the best way to keep up is to set your anti-virus program to download updates automatically whenever they are available. Your anti-virus program can only recognize new viruses if it has new data files.
Use caution when browsing the Web. Stick with sites you have good reason to trust. NEVER click on links in spam email messages.
Use caution in opening attachments in email and instant messages. Generally, you should only open attachments and files that you are expecting.

Additional Information

While the WMF file vulnerability is specific to MS Windows systems and Macintosh systems are not affected by it, the recommendations to keep system and anti-virus software up-to-date apply equally to Macintosh as well as MS Windows systems.
Microsoft has information and software updates about this problem. Go to the Microsoft Web site. and click on the "Windows Meta File security update" box.
If someone else manages your computer, work with them. They may already be doing some of the steps for you.
Using the McAfee anti-virus software provided on the UWICK CD or from the UW Software Guide site is recommended because it is pre-configured to work well at the UW. Just download the software and install it. All needed settings have already been made.
You can check when you last obtained new data files for McAfee by restarting your computer and then right clicking on the VirusScan icon in the Windows Toolbar and selecting the "About VirusScan" item. The "Created On" date is the date of the last update. If the date is more than a few days old, you should do an update by clicking on "Update Now".
For more information about the WMF vulnerability, see... Windows Metafile vulnerability (Wikipedia) or The Windows MetaFile (WMF) Exploit Vulnerability (Virusbusters).
Questions?
Send email to help@u.washington.edu
Call 206.221.5000