“Microsoft has released a security advisory with workarounds for a critical zero-day vulnerability affecting Windows users and warned that malicious hackers are already exploiting the flaw in live attacks,” Ryan Naraine reports for eWeek.
“The vulnerability is caused by an unspecified error in the XMLHTTP 4.0 ActiveX Control and is rated “extremely critical” by security alerts aggregator Secunia, in Copenhagen, Denmark,” Naraine reports. “Affected software includes Windows 2000 (including Service Pack 4), Windows XP Service Pack 2, Windows Server 2003 and Windows Server 2003 Service Pack 1.”
“According to an alert from IBM’s ISS X-Force, hackers are already using the Internet Explorer browser as an attack vector. ‘These exploits target Internet Explorer through a vulnerable ActiveX control. Successful exploitation of this vulnerability may result in remote code execution,’ the Atlanta-based company said,” Naraine reports. “All supported versions of Internet Explorer are vulnerable, including the newly released IE 7.”
“Microsoft confirms the flaw could use IE to trigger code execution attacks and warned that banner advertisements and other methods of distributing Web content could also be dangerous,” Naraine reports. “It is the second major zero-day confirmed by Microsoft during the past week. On Nov. 1, the company issued a warning for an ‘extremely critical’ vulnerability in Microsoft Visual Studio 2005 that could put users at risk of remote code execution attacks.”
Full article here.
MacDailyNews Take: Live attacks? What’re those? We’d much rather do the Macarena than use Windows and Internet Explorer. In fact, we’d rather do just about anything than use Windows and Internet Explorer. If you use garbage software, don’t be surprised when your data get trashed. Can you imagine that, right now, at this very instant, smiling Joe and Jane Six Packs are blissfully exiting Best Buys and Wal-Marts with their new Windows PCs? It never ceases to amaze us.
Related MacDailyNews articles:
Class-action suit accuses Microsoft of overcharging for Windows, causing damage with IE insecurity – November 07, 2006
‘Macarena’ malware does not exploit Mac OS X bug – November 06, 2006
‘Macarena’ code shows author’s frustration at trying to make effective Mac OS X virus – November 06, 2006
Ars Technica: ‘New Mac ‘virus’ is proof of concept that hysteria sells anti-virus software’ – November 05, 2006
Symantec details ‘Macarena’ Mac OS X ‘proof-of-concept virus’ – November 03, 2006
Symantec researcher: At this time, there are no file-infecting viruses that can infect Mac OS X – July 13, 2006
Symantec CEO: We think more people ought to buy Apple Macs – May 15, 2006
McAfee: Microsoft ‘taking security risks’ with long-delayed, oft-pared-down Windows Vista – October 02, 2006
Why is Apple’s Mac OS X so much more secure than Microsoft’s Windows? – October 01, 2006
Apple Macs are far more secure than Windows PCs – September 26, 2006
Chicago Tribune falls for the ‘Security Via Obscurity’ myth – August 14, 2006
Oxymoron: Microsoft security – August 12, 2006
With exploits in wild, Microsoft Windows braces for yet another critical worm attack – August 11, 2006
Sophos: Apple Mac OS X’s security record unscathed; Windows Vista malware just a matter of time – July 07, 2006
Sophos Security: Dump Windows, Get a Mac – July 05, 2006
Apple: ‘Get a Mac. Say ‘Buh-Bye’ to viruses’ – June 01, 2006
Apple Macs and viruses: Fact vs. FUD – May 26, 2006
Unix expert: Mac OS X much more secure than Windows; recent Mac OS X security stories are media hype – May 03, 2006
BusinessWeek: Apple should hire security czar to combat uninformed media FUD – March 09, 2006
Security company Sophos: Apple Mac the best route for security for the masses – December 06, 2005
Computer columnist: anti-virus software purely optional for Apple Macs, not so for Windows – November 01, 2005
Why Symantec’s ‘scare tactics’ don’t worry Mac users – September 28, 2005
16-percent of computer users are unaffected by viruses, malware because they use Apple Macs – June 15, 2005
Motley Fool writer: ‘I’d be surprised if Symantec ever sells a single product to a Mac user again’ – March 24, 2005
Symantec cries wolf with misplaced Mac OS X ‘security’ warning – March 23, 2005
Symantec’s Mac OS X claims dismissed as nonsense, FUD – March 22, 2005
Symantec warns about Mac OS X security threat – March 21, 2005