Windows cursor exploit spreads

Dawn Kawamoto CNET News

Published: 02 Apr 2007 11:05 BST

A zero-day exploit that takes advantage of a vulnerability in the Windows cursor could be spreading rapidly.

Read this

Talkback comment

"Anyone still using MSIE is flirting with danger. This has been proven to be the most vulnerable, insecure, browser on planet earth."

The hole in the Windows animated cursor, which was flagged in a Microsoft advisory on Thursday, has moved from a targeted attack to one that is widespread, said Johannes Ullrich, chief research officer for the Sans Institute, which also issued an advisory.

Attackers also on Thursday launched a Trojan spam that dupes users into thinking it's an IE 7 beta, according to a Sans advisory. The Trojan uses the same file name as Microsoft's legitimate IE 7 betas, making detection more difficult, Ullrich noted.

"Antivirus software was initially pretty useless in combating it," Ullrich said. "It was spammed out quickly and probably used an existing spam network."

He noted, however, that users have to click on a link to have their systems affected, so it is less of a threat than the Windows animated cursor zero-day flaw, or a security hole that has been publicly disclosed but not fixed.

"With the (animated cursor), you don't have to click on a link to get it to launch," Ullrich said. "You just have to open a malicious email or go to a malicious website."

Several dozen websites have become infected with the exploit in the past day, and Microsoft has yet to issue a patch, he added.

Microsoft said on Sunday it would issue an out-of-cycle patch for the problem.