• Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Phishing
    • Ransomware
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

MyAntiSpyware

Menu
  • Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Phishing
    • Ransomware
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

More exploits out for Windows flaws

Myantispyware team December 3, 2005    

Two new pieces of computer code that could be used in cyberattacks on Windows users were posted on the Web on Wednesday and Thursday.

The exploit posted Thursday is another that could allow a remote attacker to gain complete control over a vulnerable computer. The code takes advantage of a flaw in a Windows component for transaction processing, called the Microsoft Distributed Transaction Coordinator. Microsoft addressed the flaw in security bulletin MS05-051 in October.

The attack code published Wednesday is another that exploits a flaw in the way Windows handles certain graphics files and could cause a vulnerable system to crash. Microsoft provided a patch for the flaw in November with security bulletin MS05-053 and warned that the vulnerability could create an opening for spyware and Trojan horse attacks.

Including these last two, a total of four exploits have been released for the same two Windows flaws since Sunday, according to the French Security Incident Response Team, a security research company.

“It is reasonable to assume as we have seen so much proof-of-concept code distributed for these vulnerabilities that we will eventually see some class of attack,” said David Marcus, security research and communications manager at McAfee.

While availability of attack code could provide cybercriminals with ammunition, patches and security software should shield Windows users, said Steve Manzuik, security product manager at eEye Digital Security.

“I am sure some will try and use the exploits, but the reality is there are patches for these issues and almost every security vendor would have by now added signatures to protect against this stuff,” Manzuik said.

Michael Sutton, director at security intelligence company iDefense, a part of VeriSign, agreed. “These vulnerabilities were patched, so fortunately clients have had weeks to patch,” he said.

Unpatched IE bug is bigger threat

Microsoft is not aware of any attacks that use the latest exploits. However, the company warned this week of an attack that uses a yet-unpatched flaw in Internet Explorer. At least one exploit for that vulnerability also has been publicly released in the past two weeks.

“That’s the biggest threat out there, the Microsoft Internet Explorer vulnerability which has no patch,” Manzuik said. “Currently there are exploits on the Web for this that are not that malicious, but it wouldn’t be too hard for someone to take this and make it malicious.”

Sutton also warned computer users to be on guard for exploitation of the unpatched bug. “The one to pay attention to is the vulnerability that remains unpatched. Microsoft has released an advisory for this but no patch yet,” he said. Microsoft may issue a fix outside of its monthly patching cycle for this problem, Sutton said.

Microsoft’s next monthly patch release is scheduled for Dec. 13.

By Joris Evers, CNET News.com

Exploits & Vulnerabilities Malware removal

 Previous Post

Vulnerability in the Internet Explorer

Next Post 

IE flaw lets intruders into Google Desktop

Author: Myantispyware team

Myantispyware is an information security website created in 2004. Our content is written in collaboration with Cyber Security specialists, IT experts, under the direction of Patrik Holder and Valeri Tchmych, founders of Myantispyware.com.

Leave a Reply Cancel reply

New Guides

scam alert
Safe Sync GPS Tracker Reviews, Scam or Legit, Uncovering the Truth!
scam alert
TEKORON.com Scam Alert: Fake Bitcoin Promo Codes
scam alert
Avoid Sanobit.com Scam: The Truth About Bitcoin Promo Codes
Rexocoin.com BTCUS Promo Code Scam: What You Should Know
Plobsi.com Promo Code Fraud: A Bitcoin Scam to Watch Out For

Follow Us

Search

Useful Guides

Iphone Calendar virus spam
Iphone Calendar Virus/Spam 2022 (Removal guide)
Smart Captcha Virus redirect
What is a Virus that Redirects Web Pages? A Comprehensive Guide
browser redirect virus
How to remove Browser redirect virus [Chrome, Firefox, IE, Edge]
Malwarebytes won’t install, run or update – How to fix it
How to remove browser hijacker virus (Chrome, Firefox, IE, Edge)

Recent Guides

Vulnerability in the Internet Explorer
Determining Sun Java Vulnerability
Spyware: WebHancer – How to remove
KazaaBegone – A Kazaa uninstaller
How to use LSP Fix to repair Winsock 2 settings

Myantispyware.com

Myantispyware has been a trusted source for computer security and technology advice since 2004. Our mission is to provide reliable tech guidance and expert, practical solutions to help you stay safe online and protect your digital life.

Social Links

Pages

About Us
Contact Us
Privacy Policy

Copyright © 2004 - 2024 MASW - Myantispyware.com.