Windows exploit code threat multiplies
Published: 02 Dec 2005 09:30 GMT
Two new pieces of computer code that could be used in cyberattacks on Windows users were posted on the Web on Wednesday and Thursday.
The exploit posted on Thursday is another that could allow a remote attacker to gain complete control over a vulnerable computer. The code takes advantage of a flaw in a Windows component for transaction processing, called the Microsoft Distributed Transaction Coordinator. Microsoft addressed the flaw in security bulletin MS05-051 in October.
The attack code published on Wednesday is another that exploits a flaw in the way Windows handles certain graphics files and could cause a vulnerable system to crash. Microsoft provided a patch for the flaw in November with security bulletin MS05-053 and warned that the vulnerability could create an opening for spyware and Trojan horse attacks.
Including these last two, a total of four exploits have been released for the same two Windows flaws since Sunday, according to the FrSIRT, a security research company.
"It is reasonable to assume as we have seen so much proof-of-concept code distributed for these vulnerabilities that we will eventually see some class of attack," said David Marcus, security research and communications manager at McAfee.
While availability of attack code could provide cybercriminals with ammunition, patches and security software should shield Windows users, said Steve Manzuik, security product manager at eEye Digital Security.
"I am sure some will try and use the exploits, but the reality is there are patches for these issues and almost every security vendor would have by now added signatures to protect against this stuff," Manzuik said.
Michael Sutton, director at security intelligence company iDefense, a part of VeriSign, agreed. "These vulnerabilities were patched, so fortunately clients have had weeks to patch," he said.
Unpatched IE bug is bigger threat
Microsoft is not aware of any attacks that use the latest exploits. However, the company warned this week of an attack that uses a yet-unpatched flaw in Internet Explorer. At least one exploit for that vulnerability also has been publicly released in the past two weeks.
"That's the biggest threat out there, the Microsoft Internet Explorer vulnerability which has no patch," Manzuik said. "Currently there are exploits on the Web for this that are not that malicious, but it wouldn't be too hard for someone to take this and make it malicious."
Sutton also warned computer users to be on guard for exploitation of the unpatched bug. "The one to pay attention to is the vulnerability that remains unpatched. Microsoft has released an advisory for this but no patch yet," he said. Microsoft may issue a fix outside of its monthly patching cycle for this problem, Sutton said.
Microsoft's next monthly patch release is scheduled for 13 December.
Did you find this article useful?
113 out of 237 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
