Web Security News

Microsoft warns of new Windows exploit

Friday, May 29, 2009

Microsoft is warning users of a critical web security vulnerability in Windows 2000, Windows XP and Windows Server 2003 that has been exploited in the wild. If left unfixed, the flaw could allow hackers to take control of PCs.

The vulnerability is in Microsoft DirectX - the Windows subsystem used for streaming video - which hackers have exploited using malicious QuickTime video files, according to a posting on the Microsoft Security Response Center (MSRC) blog.

"An attacker would try and exploit the vulnerability by crafting a specially formed video file and then posting it on a website or sending it as an attachment in email," the post said.

In a web-based attack scenario, an attacker would have to convince users to visit a malicious website. After a user clicks on a link to the site, they would be prompted to perform several actions. "An attack could only occur after they performed these actions," Microsoft said.

MSRC said the vulnerability is not in Apple's QuickTime and the vulnerable code was removed in crafting Windows Vista, Windows 7 and Windows Server 2008.

Microsoft said in a security bulletin it is aware of limited, active attacks that use the exploit and the company has activated its Software Security Incident Response Process (SSIRP) and is continuing to investigate the issue.

Details of workarounds are posted at Microsoft's security research and defense blog.
ADNFCR-1765-ID-19193217-ADNFCR

Related News:

Mac OS X malware game Lose-Lose deletes files - 11.5.2009
A graduate student has written a game for Mac OS X that resembles the classic video game Space Invaders, but Mac users should not download the game if they don't want to have it randomly delete files.

Adobe issues critical security update for Shockwave Player - 11.5.2009
Adobe Systems yesterday released a critical update for all versions of Shockwave Player and recommends that users upgrade to version 11.5.2.602 to protect against cyber attacks exploiting the vulnerability.

Microsoft Security Essentials detects malware that kills Windows XP - 11.5.2009
A new Trojan malware detected by Microsoft Security Essentials as Win32/Daonol steals credential information and redirects web traffic, Microsoft said on its malware protection blog.

FBI warns of malware targeting corporate bank accounts - 11.4.2009
A new report from the FBI cyber crime division said hackers have attempted theft of $100 million from online bank accounts, using sophisticated malware that steals bank account passwords.

Microsoft issues Internet Explorer security update - 11.3.2009
Microsoft on Monday issued a security bulletin that updates a previous patch for Internet Explorer to resolve two issues. The IE bug only affects users who already applied the earlier patch.
View Related Resources
Or
Watch an Online Demo
Or
Have us call you now