Windows zero day vulnerability in animated cursors

[john_childs]

There is a new Windows zero day vulnerability out in the wild. It is being actively exploited. I’ve seen reports of advertising banner sites possibly serving up the exploit (may be a false positive though).

There is some info on the vulnerability here by eEye Digital Security. The eEye link also has a temporary patch that will protect you till Microsoft gets an official fix. I would suggest you run the eEye patch just to be safe. And update your virus scanner to the latest updates as many of the antivirus programs are picking up on it now.

This one has a chance of being a doozy as far as lots of people getting hit.

[ivan]

I think I’ve got about five viruses on my computer. One of them in the boot sector. I’m gonna have to back up all the data and flush the hardrive. The problem is, it’s a laptop and I haven’t got a working a cd-drive. It doesn’t support network or usb booting either. Bollocks.

[john_childs]

Because of the in the wild exploits and the increase in attacks using the exploits, Microsoft is releasing a patch on Tuesday April 3rd. Till then I would suggest using the eEye temporary patch.

Microsoft Security Response Center Blog post about the April 3rd patch:
Latest on security update for Microsoft Security Advisory 935423

We have some new information tonight on the status of the security update that we’re working on that addresses the vulnerability in Windows Animated Cursor Handling.

From our ongoing monitoring of the situation, we can say that over this weekend attacks against this vulnerability have increased somewhat. Additionally, we are aware of public disclosure of proof-of-concept code. In light of these points, and based on customer feedback, we have been working around the clock to test this update and are currently planning to release the security update that addresses this issue on Tuesday April 3, 2007.

And the Microsoft Security Bulletin Advance Notification

So they’re releasing the patch a week early because the vulnerability is being exploited widely out in the wild.

All well and good, but they should have fixed it a month or two or three ago. Sigh.

[john_childs]

The security patch from Microsoft is out today. Be sure to run Windows Update and install it.

If you have a Realtek HD Audio system in your computer (built in many motherboards) you’ll get an error in Rthdcpl.exe when you reboot after applying the security patch. Go to Realtek and download the latest High Definition Audio Codecs. That will fix it.