Exploit posted for Microsoft JPEG flaw
476912
Computer code that takes advantage of a flaw in the way many Microsoft Corp. applications process JPEG images has been published on the Internet and could be a precursor to actual attacks on vulnerable PCs, experts said.
663754
Microsoft has confirmed the existence of a vulnerability affecting the Windows Shell. The issue exists in the WebViewFolderIcon ActiveX control, and exploitation could result in an attacker gaining the same rights as a local user.
121334
Microsoft issued a patch for what it says is a &quot;critical&quot; security flaw in the way Windows programs handle JPEG images. According to a security bulletin accompanying the patch, the flaw
493162
InfoWorld - Just one day afterÂ Microsoft issued a massive set of security patches for its software, hackers have begun posting code showing how to exploit one of the flaws.
217773
Users of Microsoft Windows who have not downloaded the SP2 update are at risk of exposure to hackers when they open jpeg picture files, the BBC said Thursday.
240803
(InfoWorld) - It has become a familiar pattern: A hacker posts exploit code to a security Web site; Microsoft follows soon after with a warning to customers. The pattern was repeated again Thursday, only this time Microsoft's warning that it is investigating "new public reports" of a critical bug in Windows comes more than two months after sample code showing how to take advantage of the flaw was posted to the Web. Microsoft's advisory can beÂ found here. The flaw that Microsoft warned about is in an ActiveX control (called WebViewFolderIcon) used by the Windows' graphical user interface software. It was first disclosed on July 18 as part of aÂ month-longÂ project byÂ hacker HD MooreÂ to expose problems in browser software. Moore's blog post on the flaw can beÂ found here. Moore called his project theÂ "Month of Browser Bugs"Â and ended up disclosing a total of 22 Microsoft vulnerabilities during the period. A few days ago, Moore quietlyÂ added exploit codeÂ for this latest flaw to his Metasploit hacking tool. The exploit caught Microsoft's attention after it was posted to theÂ milw0rm.com Web site,Â Moore said. But the security researcher believes that any competent hacker could have developed an exploit based on his July blog posting. So far, Microsoft has patched only two of Moore's flaws. In fact, Microsoft engineers haven't even been able to investigate close to a third of the vulnerabilities, Moore said. Microsoft executives could not immediately be reached for comment, but the company's security advisory said this latest WebViewFolderIcon bug will be patched on Oct. 10. "We have been in contact with HD Moore and at this time our investigations have revealed that most issues relating to Internet Explorer in particular will result in the browser closing unexpectedly," Microsoft's public relations agency said Thursday in a statement. "Because of their nature, most of these issues will more likely be resolved through a service pack release rather than a security update." Microsoft has been busy this month, rushing out an emergency, "out-of-cycle" fix for a flaw in Internet Explorer's Vector Markup Language (VML) rendering engine that was being widely exploited by attackers. Microsoft has even more work ahead of it, according to Moore. In early August, he handed Microsoft another 70 bugs that he had not publicly disclosed. Still, he believes that more of his flaws should have been fixed by now. "I was kind of amused that they would do an out-of-cycle patch for the VML bug, but would let all of these lapse," he said. Microsoft has told him that at least four of his bugs are "exploitable issues," meaning that an attacker could take advantage of them to run unauthorized software on a victim's computer, Moore said. Earlier this week, SymantecÂ said that Microsoft was the slowest of the major browser-makers at patching its bugs during the first half of this year. But according to Symantec's numbers, Microsoft patched IE bugs, on average, nine days after the public disclosure of a flaw. Most of the 22 Month of Browser Bugs flaws have been in public for two months now.
134795
NEW YORK - In a harbinger of security threats to come, hackers have exploited a newly announced flaw in Microsoft Corp. programs and begun circulating malicious code hidden in images that use the popular JPEG format.
342495
A flaw in the Microsoft programs that was announced on Sep 14, has already paved the way for a deluge of new security threats. The hackers have begun circulating malicious code hidden in images that use the popular JPEG format.
360592
Exploit code affecting an unpatched flaw in an image uploader used by both Facebook and MySpace is circulating publicly.
63078
Security researchers have discovered another vulnerability in Windows XP Service Pack 2, but it doesn&#39;t appear to be an immediate threat.
80037
A security flaw in the way many Microsoft applications process JPEG images could allow an attacker to gain control over a computer running the software, Microsoft warned this week.
553871
One of the standard security tactics enterprises apply won&#39;t work when defending PCs against threats posed by the image processing flaw found last week in Windows and numerous applications, according to security experts.
427995
Microsoft is offering a patch for a critical security flaw related to the processing of JPEG images by its operating systems and other applications.
408370
Microsoft Corp. announced Tuesday it has found a new security flaw with its Windows XP operating system and warned that an attacker could infiltrate other computers by persuading their owners to open a specialized graphics file.
86222
In brief Exploit circulating for unpatched vuln
121787
A toolkit designed to exploit a recently-disclosed Microsoft JPEG vulnerability has been released onto the net.
711347
Code that exploits a "critical" Windows flaw has been posted on the Net, opening the door for a worm to be created.