Microsoft warns of zero-day Windows flaw

Share this article:
Microsoft is warning of a new vulnerability in Windows that could permit privilege escalation.

The vulnerability affects Windows Server 2003, XP, Vista and Server 2008, according to an advisory issued on Thursday.

If exploited, the bug can allow a user's privilege status to jump from "authenticated user" to "LocalSystem," Bill Sisk, security response communications manager for Microsoft, told SCMagazineUS.com.

Separately, researchers at McAfee Avert Labs said on Thursday they have detected public exploit code taking advantage of a vulnerability in a Microsoft Works.

McAfee analyst Kevin Beets wrote on the company's blog that the flaw is located in the ActiveX control of Microsoft Works' Image Server. Researchers said the code was posted on a number of Chinese blog sites.

"Yes, it appears successful exploitation would allow for code execution via a controlled pointer," he said. "For this to occur, the victim would need to visit a malicious website."

The risk is mitigated somewhat because the affected ActiveX control is marked as unsafe, so users likely will see a warning pop up when trying to access it, Beets said. Still, users should set the kill bit for the affected control.

A Microsoft spokeswoman told SCMagazineUS.com that the company was aware of the issue and is investigating.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.