Critical Windows Bug Exploit Code Goes Public - InformationWeek
IoT
IoT
Software // Enterprise Applications
News
1/17/2007
12:50 PM
50%
50%

Critical Windows Bug Exploit Code Goes Public

Code that exploits a critical Windows vulnerability disclosed and patched last week has been posted to a public mailing list, raising the risk of an attack.

Code that exploits a critical Windows vulnerability disclosed and patched last week has been posted to a public mailing list, raising the risk of an attack, security vendors said Wednesday.

The exploit code, which appeared on the Bugtraq list Tuesday, targets a flaw in Windows' Vector Markup Language rendering that was patched Jan. 9 in Microsoft's monthly security update. VML, an extension of XML that defines Web images in vector graphics format, had been patched before this month; in September 2006, for example, Microsoft issued a fix outside its normally scheduled cycle.

When Microsoft patched the VML bug in its MS07-004 security bulletin, it acknowledged that exploits were ongoing, even though attack code had not yet been released. Within hours of MS07-004's release, exploit code was made available to partners of Immunity, a Florida-based penetration testing vendor. It took a week, however, for code to go public.

According to Symantec's DeepSight threat management service, the posted exploit doesn't execute properly when run against Windows XP SP2 or Windows 2000 SP4 (English versions), but simply crashes Internet Explorer. "Additionally, Internet Explorer 6 running with the default security settings on XP SP2 will prompt the user regarding active content, further reducing the threat," the DeepSight warning read Wednesday.

Even the code's creator admitted poor results, saying that although the attack worked against the Korean edition of Windows XP SP2 and IE 6, it did so only about 20% of the time.

The VML flaw was considered the top threat by most security professionals when Microsoft issued its January patches, in large part because users were vulnerable when they visited a specially crafted Web site. Internet Explorer 7, Microsoft's newest browser, also is at risk, reported Microsoft.

Symantec and others advised users to patch immediately. "We urge customers to apply the associated patches as soon as possible, because more stable variants of this exploit might emerge," said Symantec's alert.

Users unable to patch can protect themselves by disabling the flawed Vgx.dll file using the directions Microsoft has provided:

-- Click Start, click Run

-- Enter: "%SystemRoot%\System32\regsvr32.exe" -u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"

-- Click OK.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
[Interop ITX 2017] State Of DevOps Report
[Interop ITX 2017] State Of DevOps Report
The DevOps movement brings application development and infrastructure operations together to increase efficiency and deploy applications more quickly. But embracing DevOps means making significant cultural, organizational, and technological changes. This research report will examine how and why IT organizations are adopting DevOps methodologies, the effects on their staff and processes, and the tools they are utilizing for the best results.
Register for InformationWeek Newsletters
White Papers
Current Issue
Digital Transformation Myths & Truths
Transformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.
Video
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll