Three new Windows security holes come at a bad time
By Angela Gunn, USATODAY.com
Three new vulnerabilities have been discovered in Microsoft’s Windows
operating system, leaving computers running that OS open to possible hacker
attacks – including PCs running the recently released XP SP2 (Service Pack
2).
The vulnerabilities were published on various online security newsgroups and
confirmed by antivirus firm Symantec. The discoveries raise particular
concern since, with the holidays underway, interested worm-writers may have
a significant head start on security professionals hoping to plug the hole.
According to a report on eWeek.com, one of the three vulnerabilities
involves image handling, which has posed problems for Windows and Unix
systems in the past. The other two vulnerabilities involve Windows’ Help
system and its .hlp files, and Windows’ ANI (Automatic Number
Identification) authentication capabilities.
The image-handling problem turned up in LoadImage, a Windows component that
loads icons, cursors or bitmaps on the desktop. An image with a malicious
payload could cause a heap buffer overflow, which would leave a system open
to exploitation.
Exploiting the ANI hole – known as the Windows Kernel ANI File Parsing Crash
and DoS Vulnerability - would require the target to click on a link or open
a message that would load a malicious ANI file. The file could trigger a
denial-of-service attack.
A Chinese security group reports not one but two possible ANI exploits.
Xfocus.org has published details on its Web site.
The Help system hole involves a potential decoding error when Help (.hlp)
files are run. Such an error could cause a heap buffer overflow, which would
(as with the LoadImage vulnerability) leave a system open to exploitation.
Machines running Windows NT, Windows 2000 or Windows XP with SP (Service
Pack) 1 are vulnerable to such exploits. Windows XP users who have applied
the SP2 service pack are protected from the image and ANI vulnerabilities,
but not from all possible aspects of the Help problem.
Users are urged to block e-mail attachments arriving with .hlp files
attached and strongly encouraged to read e-mail in plain-text format to keep
malicious images from utilizing LoadImage.
|
Similar Threads
