This is a little rare, but I am glad to see it! Microsoft made the announcement today that they would issue a patch for what has been called "Microsoft Windows Animated Cursor Handling Buffer Overflow". That's a mouthful. For those of you who don't know, Microsoft releases patches to the general public every second Tuesday of the month (AKA "Patch Tuesday"). Last month, Microsoft did not release any patches, which is also quite rare.
What is the "Microsoft Windows Animated Cursor Handling Buffer Overflow"?
This vulnerability was announced on various information security sites more than four (4) days ago. The issue stems from the method in which Microsoft operating systems (Windows 2000 SP4 - Vista) handle the processing of malformed .ani, cur, and .ico files, resulting in possible memory corruption and buffer overflow.
Should I Care?
Yes, you should. The is a remotely exploitable vulnerability which could lead to the ability to execute arbitrary commands and/or denial of service.
What does The Trusted Toolkit recommend?
Apply the patch tomorrow when it becomes available from Microsoft. In the meantime, follow other good security practices.
More Info:
Microsoft: http://www.microsoft.com/technet/security/advisory/935423.mspx
Secunia (rated "Extremely critical"): http://secunia.com/advisories/24659/
1 comment:
The patch is released. Microsoft Security Bulletin Summary for April 2007 is here. It has been verified that you can also get the patch on the Windows Update site.
Be sure to apply this patch ASAP. Exploits have been out for some time, and more will surely come.
Post a Comment