cursor xp
malware ?
Saturday, March 31, 2007 by millwall_rangers | Discussion: Community
anyone seen this
http://blogs.download.com/Spyware-Hunt/post.php?p=1409
http://blogs.download.com/Spyware-Hunt/post.php?p=1409
Ingui
Reply #3 Saturday, March 31, 2007 4:21 PM
Reply #3 Saturday, March 31, 2007 4:21 PM
a little more on the exploit..
[UPDATE: March 29, 2007 @ 1:15 PM Eastern] Microsoft has confirmed that this is indeed a zero-day flaw that will require a security update. Although Internet Explorer is the primary attack vector, this is a vulnerability in the way Windows handles animated cursor (.ani) files.
From Redmond's security advisory:
The threat is caused by insufficient format validation prior to rendering cursors, animated cursors, and icons.
An attacker could try to exploit the vulnerability by creating a specially crafted web page. An attacker could also create a specially-crafted email message and send it to an affected system. Upon viewing a web page, previewing or reading a specially crafted message, or opening a specially crafted email attachment the attacker could cause the affected system to execute code. While animated cursors typically are associated with the .ani file extension, a successful attack is not constrained by this file type.
A zero-day vulnerability in Microsoft's dominant Internet Explorer browser is being used in drive-by attacks against fully patched Windows XP SP2 systems, according to warnings from anti-virus vendors..
McAfee was the first to raise the alert for the attacks, warning that the exploit simply requires that a user is lured to a maliciously rigged Web page:
Preliminary tests demonstrate that Internet Explorer 6 and 7 running on a fully patched Windows XP SP2 are vulnerable to this attack. Windows XP SP0 and SP1 do not appear to be vulnerable, nor does Firefox 2.0. Exploitation happens completely silently.
According to McAfee researcher Craig Schmugar, the flaw exists in the way IE handles malformed .ani files. (The .ani file format is used to read and store Windows Animated Cursors) and can be easily placed on an attacker's Web site to trigger the vulnerability).
Multiple sources in the anti-malware community have confirmed McAfee's discovery, which includes the use of arbitrary .exe files and Trojan downloaders.
Trend Micro has posted an alert with a diagram explaining the characteristics of the attack:
[UPDATE: March 29, 2007 @ 1:15 PM Eastern] Microsoft has confirmed that this is indeed a zero-day flaw that will require a security update. Although Internet Explorer is the primary attack vector, this is a vulnerability in the way Windows handles animated cursor (.ani) files.
From Redmond's security advisory:
The threat is caused by insufficient format validation prior to rendering cursors, animated cursors, and icons.
An attacker could try to exploit the vulnerability by creating a specially crafted web page. An attacker could also create a specially-crafted email message and send it to an affected system. Upon viewing a web page, previewing or reading a specially crafted message, or opening a specially crafted email attachment the attacker could cause the affected system to execute code. While animated cursors typically are associated with the .ani file extension, a successful attack is not constrained by this file type.
A zero-day vulnerability in Microsoft's dominant Internet Explorer browser is being used in drive-by attacks against fully patched Windows XP SP2 systems, according to warnings from anti-virus vendors..
McAfee was the first to raise the alert for the attacks, warning that the exploit simply requires that a user is lured to a maliciously rigged Web page:
Preliminary tests demonstrate that Internet Explorer 6 and 7 running on a fully patched Windows XP SP2 are vulnerable to this attack. Windows XP SP0 and SP1 do not appear to be vulnerable, nor does Firefox 2.0. Exploitation happens completely silently.
According to McAfee researcher Craig Schmugar, the flaw exists in the way IE handles malformed .ani files. (The .ani file format is used to read and store Windows Animated Cursors) and can be easily placed on an attacker's Web site to trigger the vulnerability).
Multiple sources in the anti-malware community have confirmed McAfee's discovery, which includes the use of arbitrary .exe files and Trojan downloaders.
Trend Micro has posted an alert with a diagram explaining the characteristics of the attack:
Uvah
Reply #5 Sunday, April 1, 2007 6:24 AM
Reply #5 Sunday, April 1, 2007 6:24 AM
Checked out the link RadialFX...perhaps Stardock Admins should also (if they already haven't). Could make someone's day pretty messed up.
Ingui
Reply #7 Sunday, April 1, 2007 10:44 AM
Reply #7 Sunday, April 1, 2007 10:44 AM
No prob Millwall 
(For once i actually KNEW the answer to something around here)
But as Rad and Uvah pointed out , I would think Stardock would want to nip any confusion in the bud so to speak. There is no patch currently available even though Microsoft knew about the flaw months ago
WWW Link
(For once i actually KNEW the answer to something around here)
But as Rad and Uvah pointed out , I would think Stardock would want to nip any confusion in the bud so to speak. There is no patch currently available even though Microsoft knew about the flaw months ago
WWW Link
RadialFX
Reply #8 Tuesday, April 3, 2007 2:15 AM
Reply #8 Tuesday, April 3, 2007 2:15 AM
It looks like at least some of the confusion may have been cleared up.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Saturday, March 31, 2007 4:10 PM