Vulnerabilities / Threats
7/30/2010
09:42 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Microsoft To Release Emergency Patch For Windows

The "out of band" emergency update addresses a Windows vulnerability that is being exploited by attackers using a "highly virulent strain" of malware.

Microsoft plans to release on Monday an emergency fix for a Windows vulnerability that is being exploited by attackers using a "highly virulent strain" of malware.

Because of the seriousness of the flaw, Microsoft has decided to publish the patch before the company's scheduled release of security patches Aug. 10. The so-called "out of band" release corrects a flaw that results in Windows incorrectly parsing shortcuts in a way that allows malicious code to be executed when the icon of a specially crafted shortcut is displayed, the company said.

"We're able to confirm that, in the past few days, we've seen an increase in attempts to exploit the vulnerability," Christopher Budd, spokesman for the Microsoft Security Response Center, said Friday. "We firmly believe that releasing the update out of band is the best thing to do to help protect our customers."

According to the Microsoft Malware Protection Center, attackers have used .LNK files to exploit the vulnerability. As malware writers have learned of the flaw, multiple techniques to exploit it are showing up on the Internet.

One family of viruses, called Sality, has caught the attention of security researchers, who have spotted a newly developed member Sality.AT that exploits the latest vulnerability.

"Sality is a highly virulent strain," the Protection Center says in its blog. "It is known to infect other files, making full removal after infection challenging, copy itself to removable media, disable security and then download other malware."

With the release of Sality.AT, developers of other virus families will likely move quickly to copy the technique to target the same vulnerability, the center said.

Affected versions of Windows include Windows 7, XP, Server 2003, Vista and Server 2008. Microsoft has posted a detailed list.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2014-0778
Published: 2014-04-19
The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651.

CVE-2014-1974
Published: 2014-04-19
Directory traversal vulnerability in LYSESOFT AndExplorer before 20140403 and AndExplorerPro before 20140405 allows attackers to overwrite or create arbitrary files via unspecified vectors.

CVE-2014-1983
Published: 2014-04-19
Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors.

Best of the Web