Exploits released for new Windows flaws Published: December 23, 2004, 3:31 PM PST

Exploits released for new Windows flaws
Published: December 23, 2004, 3:31 PM PST
By Robert Lemos
Staff Writer, CNET News.com

A Chinese security group has released sample code to exploit two new unpatched flaws in Microsoft Windows.

The advisory comes in the week before Christmas, a time when many companies and home users are least prepared to deal with the problems. Security firm Symantec warned its clients of the vulnerabilities on Thursday, after the Chinese company that found the flaws published them to the Internet.

One vulnerability, in the operating system's LoadImage function, could enable an attacker to compromise a victim's PC when the computer displays a specially crafted image placed on a Web site or in an e-mail. The other vulnerability, in the Windows Help program, likewise could affect any program that opens a Help file.

Because the flaws are in a library used by Windows programs, almost all browsers and e-mail clients are likely affected by the flaws, said Alfred Huger, senior director of engineering at Symantec.

"They are rather serious," Huger said. "Both can be exploited by anything that processes images or reads help files."

Because the flaws were accompanied by sample code--known as exploit code--that shows how to take advantage of the security holes, Huger expected the exploits to be quickly incorporated into the tools of malicious Internet users.

"The fact that there is an exploit out there is very concerning," he said. "I think you will see it in phishing scams and spyware in very short order."

A mass-mailing computer virus could also quickly begin using the vulnerabilities to spread.

Microsoft could not immediately be reached for comment on the issues.

The flaws came to light on Thursday, when a Chinese security forum, Xfocus Team, posted the issues to its Web site. The vulnerabilities were found by Chinese firm VenusTech and posted on Monday to the Internet, according to the Xfocus posts.

Software companies and corporate information technology departments are often short-staffed during the holiday season. That could mean that the response to this latest threat will be slow, Huger said.

"It is a bad time of year for this to come out," he said.

 

Re: Exploits released for new Windows flaws Published: December 23, 2004, 3:31 PM PS

Damn it, this is not a good christmas...

 

Re: Exploits released for new Windows flaws Published: December 23, 2004, 3:31 PM PS

As long as there are idiots in the world it will always be something bad on the net or something just waiting to get at us from the side lines. We just have to be smarter that they are, which usually isn't to hard

bigc

 

Re: Exploits released for new Windows flaws Published: December 23, 2004, 3:31 PM PS

Why do they always pick xmas week to release such news, now I am going to be more paranoid than ever until the new year.

 

Re: Exploits released for new Windows flaws Published: December 23, 2004, 3:31 PM PS

Security Focus

Microsoft Windows LoadImage API Integer Buffer overflow

Microsoft Windows Kernel ANI File Parsing Crash and DOS Vulnerability

Microsoft Windows winhlp32.exe Heap Overflow Vulnerability

Regards,

CrazyM

 

Re: Exploits released for new Windows flaws Published: December 23, 2004, 3:31 PM PS

doesn't look as if xpsp2 is vulnerable to this one. (Microsoft Windows LoadImage API Integer Buffer overflow). just the heap overflow.

 

Re: Exploits released for new Windows flaws Published: December 23, 2004, 3:31 PM PS

It seems malware writers want to give us a package for xmas too. I just dont want any of their presents or is it their presence on my computer.


Starrob

 

Re: Exploits released for new Windows flaws Published: December 23, 2004, 3:31 PM PS

Looks like it's a good time to install SP2 for those that haven't already..

 

And these are not IE failures, so unless MS can fix the holes, firewalling en AV/AT look like the only answers.

 

*sigh* Whats the point?

Jimbob