Microsoft warns of zero-day Windows flaw

Share this article:
Microsoft is warning of a new vulnerability in Windows that could permit privilege escalation.

The vulnerability affects Windows Server 2003, XP, Vista and Server 2008, according to an advisory issued on Thursday.

If exploited, the bug can allow a user's privilege status to jump from "authenticated user" to "LocalSystem," Bill Sisk, security response communications manager for Microsoft, told SCMagazineUS.com.

Separately, researchers at McAfee Avert Labs said on Thursday they have detected public exploit code taking advantage of a vulnerability in a Microsoft Works.

McAfee analyst Kevin Beets wrote on the company's blog that the flaw is located in the ActiveX control of Microsoft Works' Image Server. Researchers said the code was posted on a number of Chinese blog sites.

"Yes, it appears successful exploitation would allow for code execution via a controlled pointer," he said. "For this to occur, the victim would need to visit a malicious website."

The risk is mitigated somewhat because the affected ActiveX control is marked as unsafe, so users likely will see a warning pop up when trying to access it, Beets said. Still, users should set the kill bit for the affected control.

A Microsoft spokeswoman told SCMagazineUS.com that the company was aware of the issue and is investigating.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Hackers grab email addresses of CurrentC pilot participants

Hackers grab email addresses of CurrentC pilot participants

Although the hack didn't breach the mobile payment app itself, consumer confidence may be shaken.

Operators disable firewall features to increase network performance, survey finds

Operators disable firewall features to increase network performance, ...

McAfee found that 60 percent of 504 surveyed IT professionals prioritize security as the primary driver of network design.

PCI publishes guidance on security awareness programs

PCI publishes guidance on security awareness programs

The guidance, developed by a PCI Special Interest Group, will help merchants educate staff on protecting cardholder data.