Subscribe by EmailWindows Zero-day “Animated Cursor” Vulnerability
April 2, 2007 by Kiltak |
By Matt Pearson
Contributing Writer, [GAS]
A lovely new zero-day vulnerability in Microsoft Windows has hit the public scene.
At the end of March, exploitation of a previously (publicly) unknown vulnerability in Windows’ animated cursor (ANI) processing was detected in the wild. This new vulnerability is now being widely exploited to install Trojan malware into unpatched Windows 2000, XP, Server 2003 and Vista systems.
The exploit involves the use of a maliciously-formed “.ANI” file. These files are used to create “animated cursors” that are often used to visually enhance web pages. Unfortunately, since the vehicle for this exploit is HTML, attack vectors can include web pages and email messages.
Apparently Microsoft has known about this vulnerability for awhile, and has only now been motivated to fix things with the public release of proof-of-concept exploit code. Thankfully, eEye Research has published an interim patch. This vulnerability is severe enough that Microsoft is pushing an out-of-cycle patch for this sucker.
A discussion with security guru Steve Gibson on this vulnerability, as well as some extra links, is online in the Security Now podcast.
- Free e-Book: Vulnerability Management for Dummies
- It’s Microsoft Patch Day… Again!
- Microsoft Patch Day: 7 Bulletins, 19 Flaws
- PWN to OWN: Hack a Mac, Win a Macbook Pro and $10000
I guess the point I got from this news is that it doesn’t really matter when the vendor learns of a vulnerability…what’s more important is the proximity of public knowledge of the vulnerability, working exploit code, and the release of a patch to fix the vulnerability. In this case, the advanced notice that Microsoft received from a responsible researcher was squandered when they failed to proactively release a patch before proof-of-concept code showed up in the wild and the vulnerability became public…and now it can be actively exploited until everyone’s Windows Update will grab the patch. And even then, autonomous worms will continue to propagate by this exploit when they can.
Also, it’s important to note that “patch released” does not mean “vulnerability negated.” Any unpatched systems will still be vulnerable…and we all know that all manner of people don’t know or care to update their systems. That’s why a clean, unpatched Windows install stays uninfected for mere minutes when connected to the public Internet.