Microsoft released its WMF security patch early, by mistake, reports CNet:
"It really was an inadvertent thing that happened," Fry Wilson said. "We have the security update on a fast track...(and) somebody accidentally posted a prerelease version on a community site. It has been taken down, and we don't recommend customers use it -- it is not the version that we will be releasing on Tuesday."
The story adds:
Microsoft's fix appears to be nearly done, said Steve Gibson, the president of Gibson Research in Laguna Hills, Calif. "It works great," said Gibson, who downloaded the file and tested it. It even works with a patch developed by European programmer Ilfak Guilfanov, he said.
Steve Gibson comments: "The updated GDI32.DLL file contained in this patch, was built in the evening of December 28th, LAST WEDNESDAY. It is clear that Microsoft jumped on this problem — and had it resolved — almost immediately. But the nature of the installed base of Windows systems, and Microsoft's understandable need to be absolutely certain they don't break anything else with this new replacement GDI32.DLL, requires that they take the time to thoroughly test anything they change."
The WMF exploit has hit about a million PCs, which is less than 0.2% of the user base.
