It wasn't until last week - March 28, to be exact - that attacks using the exploit were spotted in the wild (by McAfee) and reported to Microsoft's Security Response Center (MSRC).
says it was first notified in late December 2006 by researchers at Determina Inc., but others - including Marc Maiffret of eEye Digital Security - point out that the vulnerability is very similar to one patched in January 2005 that also affected cursor files. Exploits targeting the bug can use ANI files to run malicious code on a victimized PC, infecting it with spyware, stealing identity information or adding it to a botnet of hijacked systems. Microsoft, for example, sometimes includes animated cursors in its optional visual theme downloads. dll that loads animated cursor (.ani) files, which are used to trick out the cursor, changing it from a simple pointer to a short animation. What's the problem, anyway? A critical flaw in User32.dll, specifically in the code of that Windows. This FAQ on the flaw, explains what it is, which machines are at risk and what you can do to protect yourself. IT staff, small business users and consumers have been trying to figure out which way is up, and whether this is a Big Deal or just another security industry siren blaring in the background.
Witness the so-far short-lived flaw in Windows' animated cursors (ANI), which picked up enough steam over the weekend to power a turbine or two. When a major vulnerability affecting every flavor of Windows - including Vista - breaks, it only seems like chaos ensues.
0 kommentar(er)
