Microsoft warns of zero-day Windows flaw

Share this article:
Microsoft is warning of a new vulnerability in Windows that could permit privilege escalation.

The vulnerability affects Windows Server 2003, XP, Vista and Server 2008, according to an advisory issued on Thursday.

If exploited, the bug can allow a user's privilege status to jump from "authenticated user" to "LocalSystem," Bill Sisk, security response communications manager for Microsoft, told SCMagazineUS.com.

Separately, researchers at McAfee Avert Labs said on Thursday they have detected public exploit code taking advantage of a vulnerability in a Microsoft Works.

McAfee analyst Kevin Beets wrote on the company's blog that the flaw is located in the ActiveX control of Microsoft Works' Image Server. Researchers said the code was posted on a number of Chinese blog sites.

"Yes, it appears successful exploitation would allow for code execution via a controlled pointer," he said. "For this to occur, the victim would need to visit a malicious website."

The risk is mitigated somewhat because the affected ActiveX control is marked as unsafe, so users likely will see a warning pop up when trying to access it, Beets said. Still, users should set the kill bit for the affected control.

A Microsoft spokeswoman told SCMagazineUS.com that the company was aware of the issue and is investigating.

Share this article:

Sign up to our newsletters

More in News

DDoS attacks remain up, stronger in Q2, report says

DDoS attacks remain up, stronger in Q2, report ...

Prolexic's second quarter DDoS report noted the proliferation of shorter attacks that ate up more bandwidth.

Superman soars above fellow superheroes as most toxic search term

A McAfee study found that searches pertaining to Superman exposed users to the most infected websites.

Black Hat talk on Tor weaknesses canceled

Black Hat organizers say legal counsel for the Software Engineering Institute and Carnegie Mellon University nixed the session.