Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Critical Windows Bug Exploit Code Goes Public

Code that exploits a critical Windows vulnerability disclosed and patched last week has been posted to a public mailing list, raising the risk of an attack, security vendors said Wednesday.

The exploit code, which appeared on the Bugtraq list Tuesday, targets a flaw in Windows' Vector Markup Language rendering that was patched Jan. 9 in Microsoft's monthly security update. VML, an extension of XML that defines Web images in vector graphics format, had been patched before this month; in September 2006, for example, Microsoft issued a fix outside its normally scheduled cycle.

When Microsoft patched the VML bug in its MS07-004 security bulletin, it acknowledged that exploits were ongoing, even though attack code had not yet been released. Within hours of MS07-004's release, exploit code was made available to partners of Immunity, a Florida-based penetration testing vendor. It took a week, however, for code to go public.

According to Symantec's DeepSight threat management service, the posted exploit doesn't execute properly when run against Windows XP SP2 or Windows 2000 SP4 (English versions), but simply crashes Internet Explorer. "Additionally, Internet Explorer 6 running with the default security settings on XP SP2 will prompt the user regarding active content, further reducing the threat," the DeepSight warning read Wednesday.

Even the code's creator admitted poor results, saying that although the attack worked against the Korean edition of Windows XP SP2 and IE 6, it did so only about 20% of the time.

  • 1