[ Technology Blogs Articles News Reviews ]

 
Google
www Technoclicks.com
Post Tech Blog Article News Reviews

Top Articles

Windows Media Player Worm Set To Strike

Posted by iMark - 2006-02-21

An exploit against the Windows Media Player vulnerability disclosed by Microsoft two days ago is nearly finished, a security company said Thursday, and may be only hours away from hitting unpatched users.

The bug, which was made public Tuesday in security bulletin MS06-005, allows attackers armed with malicious .bmp image files to hijack Windows PCs.

"There are two exploits circulating," said Mike Puterbaugh, the vice president of marketing at eEye Digital Security, the Aliso Viejo, Calif.-based company which first uncovered the Media Player vulnerability.

"One is somewhat minor, and can cause a denial-of-service, but the second we're taking far more seriously," said Puterbaugh. "It's 95 percent there as a propagated mass attack.

"All the guy needs to do is add shell code to it to remotely exploit machines."

The exploit, which was posted to the Bugtraq security mailing list is "minutes or days from being completed," Puterbaugh said. "The exploit hasn't been able to reliably write to the same part of memory every time, but once he gets that, it's game over."

The exploit's author -- identified only as "ATmaCA" -- claimed that the attack would work against Windows 98, Millennium, 2000, NT, XP, and 2003 Server systems. He also acknowledged that he was having trouble wrapping up the exploit.

"In this vulnerability, payload is loaded to different places in memory each time," a comment in the proof-of-concept code read. "But some time is very easy to call our shell code…but some times not."

While experts believed that the Windows Media Player flaw would be used by spyware and adware purveyors to silently install malicious software, as they had used the Windows Metafile bug that surfaced in December 2005, Puterbaugh said eEye's researchers believed ATmaCA would package the exploit into a mass-mailed, and self-propagating, worm.

Users can download Microsoft's patch via Windows Update, Microsoft Update, or direct from the developer's Download Center.



Related Category :

Security ||

Next ....: Tracking technology could have homeland defense apps

:: Previous Articles
:: Aladdin readies security devices
:: NetApp CEO: Security The Next Business Driver
:: Microsoft Hones IE 7's Drive-by-Download Defenses

Recent Articles

 


 

Home | | Members | Search | Upadtes | RSS | Tags | Site Map | Tags | Conact

© Technoclicks.com - All rights reserved.