Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

FAQ: Here's the scoop on the Windows animated cursor bug

Microsoft is promising an early patch for the ANI vulnerability

April 2, 2007 12:00 PM ET

Computerworld - When a major vulnerability affecting every flavor of Windows -- including Vista -- breaks, it only seems like chaos ensues. Okay, so it is chaos. Witness the so-far short-lived flaw in Windows' animated cursors (ANI), which picked up enough steam over the weekend to power a turbine or two. IT staff, small business users and consumers have been trying to figure out which way is up, and whether this is a Big Deal or just another security industry siren blaring in the background. This FAQ on the flaw, explains what it is, which machines are at risk and what you can do to protect yourself.

What's the problem, anyway? A critical flaw in User32.dll, specifically in the code of that Windows .dll that loads animated cursor (.ani) files, which are used to trick out the cursor, changing it from a simple pointer to a short animation. Microsoft, for example, sometimes includes animated cursors in its optional visual theme downloads. Exploits targeting the bug can use ANI files to run malicious code on a victimized PC, infecting it with spyware, stealing identity information or adding it to a botnet of hijacked systems.

When did this pop up? Microsoft Corp. says it was first notified in late December 2006 by researchers at Determina Inc., but others -- including Marc Maiffret of eEye Digital Security -- point out that the vulnerability is very similar to one patched in January 2005 that also affected cursor files. It wasn't until last week -- March 28, to be exact -- that attacks using the exploit were spotted in the wild (by McAfee) and reported to Microsoft's Security Response Center (MSRC).

What versions of Windows are vulnerable? This is the cropper, isn't it? One of the things that makes the ANI bug so dangerous is that it affects every still-supported edition of Windows, including Windows 2000 SP4, XP SP2, Server 2003 (up to SP2), and even Vista. Both 32- and 64-bit versions are at risk.

What about Linux or Mac systems? Are they at risk, too? Hahahahahaha. Sorry. Nope.

Are hackers using the vulnerability? Funny. China's Internet Security Response Team (CISRT) warned over the weekend that a worm exploiting ANI was in the wild. Symantec Corp. tagged the worm as Fubalca, while other security companies -- no surprise here -- applied different monikers. McAfee Inc., for instance, calls it Fujacks.aa, while Computer Associates labeled it MSA-935423!exploit. Nothing like consistency. Other reports have cited one or more spam runs that include links to malicious sites hosting an ANI exploit, while the newest information from Websense Inc. is that there are at minimum 150 Web sites circulating the attack. So the short answer, unfortunately, is yes.



Jump to comments

FAQ

Additional Resources

Xerox
By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!
Microsoft
Save time and mitigate security risk. Deploy it now.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

What People Are Saying

White Papers & Webcasts

Share our Strength
Download Now  

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...