Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Hacker releases working GDI-bug attack code

Researchers expect better exploits soon, urge everyone to patch Windows

April 14, 2008 12:00 PM ET

Computerworld - Security researchers on Monday spotted malicious code that triggers a critical vulnerability in the Chinese version of Windows 2000, and warned users of other editions to expect attacks.

Symantec Corp. confirmed that the proof-of-concept code publicly posted to the milw0rm.com site earlier in the day successfully attacks Chinese editions of Windows 2000 Service Pack 4 (SP4) by exploiting one of the two critical bugs in Windows GDI (graphics device interface) that Microsoft Corp. patched last week.

But while the attack code works on Chinese versions of Windows, it doesn't when pitched against other editions. Rather than allow hackers to execute additional code -- malware to hijack the PC, for instance -- the exploit simply crashes Explorer, the Windows file manager, on non-Chinese versions of the operating system.

"This exploit will not successfully allow for remote code execution against English systems, [but it] can successfully trigger a crash on English versions of Microsoft Windows," Symantec wrote in an analysis for customers of its DeepSight threat notification service.

The news followed reports from Symantec last Thursday that it had captured an exploit. Analysis then, however, determined that the attack -- made up of multiple Enhanced Metafile images disguised as JPEG files -- wasn't crafted properly and wouldn't actually trigger the vulnerability.

A week ago, Microsoft patched the GDI bugs in every currently supported version of Windows, including the very newest, Vista SP1 and Server 2008. Windows XP SP3, the not-yet-finished final service pack, did not require patching because it had been fixed two weeks before.

The publication of the exploit sent Symantec to the alarm button. "Due to the availability of this public exploit for Chinese versions of Windows, it is likely that attackers will modify this exploit to target English versions of the operating system," it said Monday. As it did last week, the company also urged users to deploy the fixes outlined by Microsoft in its MS08-021 security bulletin if they have not already done so.



Jump to comments

Windows

Additional Resources

Xerox
By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!
Microsoft
Save time and mitigate security risk. Deploy it now.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

What People Are Saying

White Papers & Webcasts

Share our Strength
Download Now  

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...