Windows Help Vulnerability Exploited In The Wild

The New Acunetix V12 Engine


So the other big news this week apart from the AT&T iPad/iPhone 4 screw-up is that a recently announced critical vulnerability in Windows XP is being exploited in the wild.

It was disclosed fairly recently and is a vulnerability in the Windows XP help system disclosed by Tavis Ormandy, a Google researcher who has appeared on this site quite a number of times.

It’s dangerous because a victim can be compromised completely (including remote code execution) just by visiting a malicious web page.

Five days after it was disclosed in a highly controversial advisory, a critical vulnerability in Microsoft’s Windows XP operating system is being exploited by criminal hackers, researchers from anti-virus provider Sophos said on Tuesday.

The flaw in the Windows Help and Support Center was disclosed on Thursday by researcher Tavis Ormandy. His public advisory came just five days after he privately informed Microsoft of the defect, prompting fierce criticism from some circles that he hadn’t given the software giant adequate time to fix the hole. That made it easier for attackers to target the bug, which allows attackers to take complete control of vulnerable machines when a user views a specially designed webpage, the critics howled.

According to Sophos, researchers have seen the first case of a website using the vulnerability to install malicious software on victim machines. “This malware downloads and executes an additional malicious component (Troj/Drop-FS) on the victim’s computer, by exploiting this vulnerability,” they warned.

Well there’s some discussion on the issue going on about responsible disclosure with people saying Tavis made the advisory public too quickly after informing Microsoft. It’s a fair comment considering Microsoft and it’s Patch Tuesday policy which limits the speed in which they can push patches out.

We all know how often Microsoft pushes out-of-bound patches out, very rarely if at all.

Add the fact that Windows XP is coming to the end of it’s life-cycle soon, it’s unlikely they are going to be scrambling to get a patch out.

Microsoft soon amended its own advisory on the vulnerability to say researchers are “aware of limited, targeted active attacks that use this exploit code.” Although the vulnerability also afflicts Windows Server 2003, Microsoft’s advisory said that OS wasn’t “currently at risk from these attacks.”

Ormandy’s advisory has reignited the age-old debate over full disclosure, in which researchers publish complete details of a vulnerability under the belief that it is the best way to ensure a company fixes it quickly. Ormandy has defended his decision to give Microsoft just five days of advanced warning saying in a recent tweet: “I’m getting pretty tired of all the ‘5 days’ hate mail. Those five days were spent trying to negotiate a fix within 60 days.”

Users of XP and Server 2003 should consider disabling features within Help Center that allow administrators to remotely log onto machines.

Oh well, the debates about disclosure will rage on I guess, either way it’s out there now and it’s being exploited in the wild – so as of now it’s a real risk.

For individual users you can use the online application from Microsoft here:

Vulnerability in Help Center could allow remote code execution

Source: The Register

Posted in: Exploits/Vulnerabilities, Windows Hacking

, , , , , , , ,


Latest Posts:


SCADA Hacking - Industrial Systems Woefully Insecure SCADA Hacking – Industrial Systems Woefully Insecure
airgeddon - Wireless Security Auditing Script airgeddon – Wireless Security Auditing Script
Airgeddon is a Bash powered multi-use Wireless Security Auditing Script for Linux systems with an extremely extensive feature list.
Acunetix v12 - Pause & Resume Acunetix v12 – More Comprehensive More Accurate & 2x Faster
Acunetix, the pioneer in automated web application security software, has announced the release of Acunetix v12 - more comprehensive, accurate & 2x faster.
CloudFrunt - Identify Misconfigured CloudFront Domains CloudFrunt – Identify Misconfigured CloudFront Domains
CloudFrunt is a Python-based tool for identifying misconfigured CloudFront domains, it uses DNS and looks for CNAMEs which may be allowed to be associated with CloudFront distributions.
Airbash - Fully Automated WPA PSK Handshake Capture Script Airbash – Fully Automated WPA PSK Handshake Capture Script
Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing, it is compatible with Bash and Android Shell.
XXEinjector - Automatic XXE Injection Tool For Exploitation XXEinjector – Automatic XXE Injection Tool For Exploitation
XXEinjector is an XXE Injection Tool that automates retrieving files using direct and out of band methods. Directory listing only works in Java applications.


Comments are closed.