[via
netsquirrel] Long story short, if you have a new-ish computer running any of a host of Microsoft's newer software applications, your computer is probably vulnerable to attack through this JPEG processing vulnerability... even if you have a firewall and an up-to-date antivirus program.
How do you close the hole? Get the patch! But, because this JPEG
processing vulnerability effects so many different Microsoft
applications, there is actually a three step process you must follow
to ensure your computer has ALL of the patches it needs.
1. Run Windows Update by going to Tools > Windows Update in
Internet Explorer. Click on "Scan for updates." Then just
install all of the critical updates available for your
computer by clicking "Review and install critical updates."
You may need to restart after you install the critical updates,
and remember to always rerun Windows Update until it tells you
to go away.
Most people will stop here, thinking they have successfully
protected their computers from this new JPEG processing
vulnerability. And most people will be wrong. You still have
two more steps to go.
2. Run Office Update by going to
http://officeupdate.microsoft.com/ and clicking on "Check for
updates." Since the JPEG processing vulnerability is in both
Windows *and* Office, and since the older version of Windows
Update doesn't automatically scan Office for updates, the only
way--well, actually, the *easiest* way--to get the latest
critical updates for Microsoft Office is to manually go to
officeupdate.microsoft.com.
Have your Office installation CD-ROM nearby. Microsoft may
want to "sniff" your disk to make sure you actually own a
licensed copy of Office. But what if you can't find your
Office installation disk? Unfortunately, you're hosed. You
are going to have to borrow a disc from a friend. No disc, no
Office update. And this JPEG processing vulnerability is so
severe that you NEED to update Office as soon as possible.
3. The third and final step is to, in Internet Explorer, go to
http://www.microsoft.com/security/bulletins/200409_jpeg.mspx
and click on "Check for Affected Imaging Software." This
scans your computer to make sure that you don't have any
Microsoft imaging software hiding on your computer that is
also vulnerable to this JPEG processing vulnerability.
Remember, running Windows Update is only one-third of the patch
process. You also need to run Office Update and have Microsoft scan
your imaging programs.
And if you are thinking about putting this off for a few days, don't:
http://www.informationweek.com/story/showArticle.jhtml?articleID=47212221