Server

If you can grok assembler, you can see the details of the WMF patches, and how close the unofficial and official patches are. The amazing thing to me [at least] is that there was/is an MS staffer commenting and helping people out in that Something Awful thread I posted a few days ago. He (or she?) provided some very cool info on how it all went down.

See the changes to gdi here:

http://blogs.securiteam.com/index.php/archives/184

Also of note: This WMF stuff reminds me A LOT of 'the BBS days' when ANSI.SYS under DOS could remap keys and you could get ANSI bombed with a keystroke that would format your hard drive without any interaction. Use of a function meant for good, for bad purposes.

http://www.microsoft.com/technet/security/advisory/912840.mspx

http://www.microsoft.com/technet/security/bulletin/advance.mspx

KB article:
http://support.microsoft.com/kb/912919

Notes from Mike Nash:
http://blogs.technet.com/msrc/archive/2006/01/05/416980.aspx

If you are wondering if you should wait, check out this quote from Mike:
"With the update available today, you certainly have the choice of deploying now or waiting until your normal release process. If it were my decision, I would move up the schedule. That is what we are doing in our IT operation here at Microsoft."

I'm glad they didn't wait until the 10th to release this.
Kudos to them.