Windows Vista Gets WMF Patch; Windows 98 Users Left Out to Dry

Published: January 18, 2006

by Alex Woodie

Over the last couple of weeks, there has been some confusion about which versions of Windows are critically susceptible to the Windows MetaFile (WMF) flaw, and which versions Microsoft would patch. Microsoft itself was the source of some of this confusion in its initial security advisory, which said that the WMF flaw was a critical vulnerability on every version of Windows, going back to Windows 3.0.

However, Microsoft backtracked on this stance a bit when it finally came time to release the patches, and it only issues patches for the more current versions of Windows. This move reflected the company's policy to patch all critical vulnerabilities, no matter if the product is under mainstream support, but to not patch non-critical vulnerabilities for products that are no longer under mainstream support. Microsoft rolled back the severity of the WFM flaw from critical to important on those older releases, so it didn't issue a patch.

So, while Windows 98/SE/ME--even though it is vulnerable to the WMF flaw and is still in use--did not receive a patch, Microsoft elected to issue a patch for a version of Windows that hasn't even been officially released yet: Windows Vista. The patch was delivered for the Community Technology Preview (CTP) beta release of Windows Vista that Microsoft made available last month to MNDN subscribers and other beta testers.