Microsoft to release early patch for cursor flaw

gallery

Microsoft is to release an early patch to fix a flaw that allows malware to be installed under the guise of an animated cursor download.

As reported by IT PRO, the flaw affects multiple version of Windows and can find its way onto systems via cursor and icon customisation options. With a specially crafted email or web page, an attacker could persuade a user to view content could install malware on a user's computer. Windows 2000, XP, Server 2003 and Vista are all said to be affected, though IE7 on Vista provides some protection "from currently known web-based attacks" according to Microsoft's advisory.

According to Chris Budd, security program manager of Microsoft's Security Response Centre, the vulnerability has allowed an increased number of attacks on systems over the weekend and proof-of-concept code has been freely circulating the internet.

"This update was previously scheduled for release as part of the April monthly release on 10 April, 2007. Due to the increased risk to customers from these latest attacks, we were able to expedite our testing to ensure an update is ready for broad distribution sooner than 10 April", said Budd.

Microsoft will release the patch on 3 April, but Budd said this could be delayed if there are any last minute problems.

He said that Microsoft had been aware of the flaw from last December. Budd advised organisations to update anti-virus and other security products with the latest signatures to protect against the flaw in the meantime.

Email to a friend

Print this page