AfterDawn: News

Criminals target unpatched Windows XP bug

A few days ago, we reported about a controversial disclosure of an exploitable vulnerability that affects Windows XP and Windows Server 2003. Google engineer Tavis Ormandy had alerted Microsoft of the problem and then just five days later published an advisory detailing the bug, even though no patch had been distributed by Microsoft for the problem.

Ormandy was heavily criticized for not waiting until the Redmond software giant had pushed out an update for the bug, which affects the Windows Help and Support Center. His affiliation with Google also fueled some speculation of his motivation for publishing the advisory early. However, Ormandy has consistently defended himself, indicating this is probably the only way to ensure that Microsoft will release a patch.



The flaw was disclosed only last Thursday, but anti-virus provider Sophos has already found that the vulnerability is being targeted by criminal hackers. The bug could potentially allow an attacker to execute code on a victims computer using specially crafted webpages or crafted links in e-mail messages.

While the original bug affects Windows Server 2003, Microsoft's analysis found that only Windows XP is vulnerable to the attacks. Currently, the crafted webpages download an execute malware (Troj/Drop-FS) on a victims computer, according to Sophos.

Microsoft amended its own advisory on the bug, adding that the company is aware that limited, targeted active attacks are happening as a result of the issue.

Windows XP users concerned about the bug can use Microsoft's online FixIt application to disable vulnerable features in the Help and Support Center.

Written by: James Delahunty @ 15 Jun 2010 22:43

• Previous article

• E3 2010: PlayStation Plus premium PSN access revealed, 50 million PSN accounts

• Next article

• NVIDIA pushing '3D PC' spec

• 5 comments

• KillerBug

  I'm sure MS will get right on this...as soon as their lawyers tell them they have to.

  15.6.2010 22:51 #1

• biglo30

  The guy who released the code is a serious bitch, who cares about how long Microsoft took to fix the vulnerability at least we know they will get it fixed, its not like they don't have anything else to do lus they already want to drop support for it. Now this idiot has exposed a vast amount of xp users to it which could have been prevent had he not released it with detail. No excuse that was just wrong.

  15.6.2010 23:03 #2

• KillerBug

  "at least we know they will get it fixed"
  
  That is just the thing; microsoft leaves a lot of security holes open for years and years while hackers know about the holes; they patch the easy ones, but the hard ones don't even get fixed for the service packs; in fact some of the security holes in windows 7 have been there since windows 2000, and some even go back to NT4! At least my making a big, public spectacle of the problem, he has forced microsoft to fix the problem...oh wait, it still isn't fixed; they just released a tool to disable features until they fix them...and it isn't even an automatic update. Microsoft should spend less time blaming the person who reported the problem and more time fixing the problem!

  16.6.2010 01:29 #3

• Dela

  Originally posted by KillerBug: "at least we know they will get it fixed"
  
  That is just the thing; microsoft leaves a lot of security holes open for years and years while hackers know about the holes; they patch the easy ones, but the hard ones don't even get fixed for the service packs; in fact some of the security holes in windows 7 have been there since windows 2000, and some even go back to NT4! At least my making a big, public spectacle of the problem, he has forced microsoft to fix the problem...oh wait, it still isn't fixed; they just released a tool to disable features until they fix them...and it isn't even an automatic update. Microsoft should spend less time blaming the person who reported the problem and more time fixing the problem! Asked you the last time you commented on these security holes, which security hole are you referring to that's been around since NT debuted that still affects Windows 7?

  16.6.2010 11:40 #4

• ChappyTTV

  Originally posted by Dela: Originally posted by KillerBug: "at least we know they will get it fixed"
  
  That is just the thing; microsoft leaves a lot of security holes open for years and years while hackers know about the holes; they patch the easy ones, but the hard ones don't even get fixed for the service packs; in fact some of the security holes in windows 7 have been there since windows 2000, and some even go back to NT4! At least my making a big, public spectacle of the problem, he has forced microsoft to fix the problem...oh wait, it still isn't fixed; they just released a tool to disable features until they fix them...and it isn't even an automatic update. Microsoft should spend less time blaming the person who reported the problem and more time fixing the problem! Asked you the last time you commented on these security holes, which security hole are you referring to that's been around since NT debuted that still affects Windows 7? Exactly....please elaborate with facts, or STFU.
  MS doesn't make a habit of not patching known security holes, and there are zero NT to W7 cross platform exploits that I'm aware of (that aren't patched), and I've worked in the PC Security industry (Independant analyst/tester).
  I think you're just a "bash MS" bandwagon rider myself, willing to float whatever rumor suits your fancy, without ever explaining them.
  Sure...everyone knows Windows is a security nightmare, I'll just drop this made up (but plausible sounding) post out there, all the other wagon jumpers will surely line up to rattle the cages even more, and nobody will ever be the wiser...right?
  
  Wrong...this sh!t is getting old really fast. Normal PC users trying to make a name for themselves on forums by being all blustery and flying the bash flag higher than the others. Maybe all of the others will think you're a cool geeky type because you post claims that all the other wagoneers will roll with gleefully without question, but those in the know are sick of this cr@p and are gonna start calling you on this.
  
  Despite what you think, the entire security industry will think this guy is in the wrong by releasing exploit data before a proper fix can be released. The only thing he's "forcing" is the criminals...to exploit as much as they can before a patch is released thru WU.
  
  Now, go burn up Google search trying to find something that can back up your "claims" and get back to us ASAP.
  

  17.6.2010 22:42 #5