Microsoft: Attacks on Unpatched Windows Flaw
Microsoft warned today that hackers are targeting a previously unknown security hole in Windows XP and Windows Server 2003 systems to break into vulnerable PCs. Today's advisory includes instructions on how to mitigate the threat from this flaw.
In a security alert posted today, Microsoft said the vulnerability could be used to install viruses or other software on a victim's PC if the user merely browsed a hacked or booby trapped Web site designed to exploit the security hole. Redmond says at this time it is aware of "limited, active attacks that exploit this vulnerability."
Microsoft doesn't define "limited, active" attacks in the context of this vulnerability, but the SANS Internet Storm Center is reporting that thousands of newly compromised Web sites have been seeded with code that exploits this vulnerability. SANS also says instructions for exploiting the vulnerability have been posted to a number of Chinese Web sites.
According to a press release published by Symantec, one of the sites distributing malware in this attack is the official Web site for the Russian Embassy in Washington.
Vincent Weafer, vice president of Symantec Security Response, said the flaw affects Windows XP users with Internet Explorer 6 or 7 installed, but that IE8 users are not vulnerable.
Microsoft says the problem stems from a weakness in a Microsoft Video ActiveX Control, and that it is working on an official patch to plug the security hole. In the meantime, the company says customers should consider disabling the feature because there don't appear to be any by-design uses for this ActiveX control within Internet Explorer -- the default Web browser on Windows.
To do this, affected users can click on the "Fix This Problem" icon at this page to disable the vulnerable Windows component. Microsoft notes that "while Windows Vista and Windows Server 2008 customers are not affected by this vulnerability, we recommend that they also implement the workarounds as a defense-in-depth measure."
July 6, 2009; 2:40 PM ET
Categories: Latest Warnings , New Patches , Safety Tips | Tags: activex, ie, microsoft 0day
Save & Share: Previous: PC Invader Costs Ky. County $415,000
Next: Predicting Social Security Numbers
Posted by: Hemisphire | July 6, 2009 3:00 PM | Report abuse
Posted by: rsh43 | July 6, 2009 3:22 PM | Report abuse
Posted by: BTKrebs | July 6, 2009 3:37 PM | Report abuse
Posted by: bandoswuu | July 6, 2009 9:01 PM | Report abuse
Posted by: email@example.com | July 7, 2009 2:15 AM | Report abuse
Posted by: firstname.lastname@example.org | July 7, 2009 2:18 AM | Report abuse
Posted by: JBV1 | July 7, 2009 2:40 AM | Report abuse
Posted by: cduwel | July 7, 2009 6:05 AM | Report abuse
Posted by: 0nl00k3r | July 7, 2009 8:58 AM | Report abuse
Posted by: redhatnation | July 7, 2009 9:07 AM | Report abuse
Posted by: BTKrebs | July 7, 2009 9:12 AM | Report abuse
Posted by: Annorax | July 7, 2009 8:38 PM | Report abuse
Posted by: MayFran | July 8, 2009 9:42 AM | Report abuse
Posted by: tidalgraphics | July 8, 2009 10:59 AM | Report abuse
Posted by: bethjones | July 10, 2009 8:55 AM | Report abuse
Posted by: goneva | July 10, 2009 3:52 PM | Report abuse
The comments to this entry are closed.