Anti-Virus May Prove Insufficient in Battling Zero-Day WMF Exploit; PatchLink Makes Third Party Patch Available to Protect Its Customers.

SCOTTSDALE, Ariz. -- PatchLink Corporation, the global leader in security patch and vulnerability management solutions, today issued a temporary third party patch and Knowledge Base Article 290 as an option for protecting networks against what's being called the worst Microsoft vulnerability in the last 18 months because of the rapidly spreading zero-day threats in the wild exploiting it before an official patch is available.

Microsoft plans to issue a patch for Windows Metafile (WMF) vulnerability next week during its monthly Patch Tuesday. In the meantime, PatchLink has made available a third party patch as an option for IT administrators using Windows operating system who don't want to wait until the official patch is released. This is a SANS recommended temporary third party patch that can be applied as a short-term remediation for zero-day threats.

The patch comes on the heels of a new wave of attacks exploiting the vulnerability in the way versions of Windows from 98 through XP handle malicious files in the WMF. The vulnerability could allow an attacker to execute arbitrary code on a user's computer by hosting a specialty crafted WMF image on a malicious web site that can lead to total system compromise, and the need to completely rebuild impacted systems.

Chris Andrew, vice president of security technologies for PatchLink, stated: "Anti-Virus programs use pattern matching to recognize exploits and stop them. Unfortunately it only takes 15 minutes for a virulent exploit to spread across the global network; AV vendors take between two and 12 hours to update their virus definition files. While AV is a good cure for removal of infections after the fact, the only way to truly stop new exploits from penetrating your defenses is to patch and lock down your systems prior to an attack based on the latest threat intelligence."

The WMF vulnerability can get into a system via any browser, mail program, removable media, etc. From internal testing, PatchLink has discovered that existing exploits will require a complete system reinstall if infection actually occurs. PatchLink recommends organizations follow patch management best practices which include thoroughly testing the third party patch within their IT environments before deploying massive installation to ensure all systems are effectively protected until the official Microsoft patch is released next Tuesday. PatchLink highly recommends that PatchLink customers deploying this temporary patch carefully read and follow instructions listed in the Knowledge Base Article 290: http://www.patchlink.com/redirect.asp?IDr=152&IDd=300.

"While temporary policy lockdowns are the only true protection against known threats with active zero-day exploits in the wild, we've issued this interim patch to provide IT administrators more options to protect their networks prior to Patch Tuesday. It is better to use the Internet without pictures for a while, than to take down your entire corporate network," said Andrew.

"Best practices approach is for IT administrators to ensure all of their networks are truly ready and able to deploy remediation of this kind quickly and effectively across all workstations and servers in their control," said Andrew. "Also, after the patch deployment, they should check to make sure all nodes are covered and find new systems that fall outside of the policy."

SANS predicts that 2006 will bring a rapid increase in the number of zero-day exploits out in the wild. With vendors still taking 30 to 120 days to build and test a patch for even critical vulnerabilities and the overflow of vulnerabilities that weren't patched last year, the industry is falling behind in patch creation and application. As a result, more holes are being left open in the most commonly used operating systems and applications than ever before. IT administrators should take a hard look at how they are detecting vulnerabilities, managing the remediation process and establishing and enforcing strong security policies in the networks that they manage.

For more information on downloading the third party patch software, visit: http://handlers.sans.org/tliston/WMFHotfix-1.1.14.msi.

For more information on PatchLink's Knowledge Base Article 290, visit: http://www.patchlink.com/redirect.asp?IDr=152&IDd=300.

For more information on Microsoft WMF, visit http://www.patchlink.com/support/ms_wmf.html.

For more information on the Microsoft Security Advisory, visit: http://www.microsoft.com/technet/security/advisory/912840.mspx.

ABOUT PATCHLINK CORPORATION

PatchLink(TM) Corporation is a global leader for multi-platform, multi-vendor security patch and vulnerability solutions provider with offices in the United States, Australia, Hong Kong, Singapore and the United Kingdom. Providing a highly scalable, extensible, multi-platform technology for network security, including endpoints, PATCHLINK UPDATE(TM) gives customers access to the world's largest repository of tested security patches and mis-configuration updates for deployment across the enterprise.

(C)2005 PatchLink Corporation. All rights reserved. PatchLink, the PatchLink logo, and the PatchLink product names and logos are either registered trademarks or trademarks of PatchLink Corporation in the United States. In addition, other company names and products mentioned in this document, if any, may be either registered trademarks or trademarks of their respective owners.