Animated Cursor Exploit Patched

grc.com said:
At the end of March, exploitation of a previously (publicly) unknown vulnerability in Windows' animated cursor (ANI) processing was detected in the wild. This new vulnerability is now being widely exploited to install Trojan malware into fully patched Windows 2000, XP, Server 2003 and Vista systems.

All fully patched Windows systems are currently vulnerable.

Microsoft learned of this vulnerability in all versions of Windows more than three months ago, on December 20th, 2006, but did nothing to protect their customers.

Proof-of-Concept code has now been publicly released, guaranteeing rapid and widespread adoption of this exploit.

Microsoft was forced to publish this acknowledgement of the vulnerability and since they have known of it for many months they have now stated that they will be pushing out an early, out-of-cycle official update to eliminate this vulnerability on Tuesday, April 3rd, 2007.

Depending upon your level of concern and/or exposure you could install the eEye patch now, or wait (one day) for Microsoft's official update. But be sure to look for this update on or after Tuesday, April 3rd.
Click to expand...
 
the-void said:
What really tickles me is that people honestly believed that Vista was completely rewritten from scratch. *chuckles* :)
Click to expand...

I don't recall anybody saying it was completely rewritten from scratch, merely a large majority of it was - to which by the looks of things, the cursor functions were not, big deal, get over it.

*edit* - those who installed the eEye patch may also wish to install the offical Microsoft patch, as the eEye patch has been exposed to the vunerability again.
 
Last edited:
You must log in or register to reply here.
Back
Top Bottom