[ad]<\/p>\n
So the other big news this week apart from the AT&T iPad\/iPhone 4<\/a> screw-up is that a recently announced critical vulnerability in Windows XP<\/a> is being exploited in the wild.<\/p>\n It was disclosed fairly recently and is a vulnerability in the Windows XP help system disclosed by Tavis Ormandy<\/a>, a Google<\/a> researcher who has appeared on this site quite a number of times.<\/p>\n It’s dangerous because a victim can be compromised completely (including remote code execution) just by visiting a malicious web page.<\/p>\n Five days after it was disclosed in a highly controversial advisory, a critical vulnerability in Microsoft’s Windows XP operating system is being exploited by criminal hackers, researchers from anti-virus provider Sophos said on Tuesday.<\/p>\n The flaw in the Windows Help and Support Center was disclosed on Thursday by researcher Tavis Ormandy. His public advisory came just five days after he privately informed Microsoft of the defect, prompting fierce criticism from some circles that he hadn’t given the software giant adequate time to fix the hole. That made it easier for attackers to target the bug, which allows attackers to take complete control of vulnerable machines when a user views a specially designed webpage, the critics howled.<\/p>\n According to Sophos, researchers have seen the first case of a website using the vulnerability to install malicious software on victim machines. \u201cThis malware downloads and executes an additional malicious component (Troj\/Drop-FS) on the victim\u2019s computer, by exploiting this vulnerability,\u201d they warned.<\/p><\/blockquote>\n Well there’s some discussion on the issue going on about responsible disclosure with people saying Tavis made the advisory public too quickly after informing Microsoft. It’s a fair comment considering Microsoft and it’s Patch Tuesday<\/a> policy which limits the speed in which they can push patches out.<\/p>\n We all know how often Microsoft pushes out-of-bound patches<\/a> out, very rarely if at all.<\/p>\n Add the fact that Windows XP is coming to the end of it’s life-cycle soon, it’s unlikely they are going to be scrambling to get a patch out.<\/p>\n Microsoft soon amended its own advisory on the vulnerability to say researchers are \u201caware of limited, targeted active attacks that use this exploit code.\u201d Although the vulnerability also afflicts Windows Server 2003, Microsoft’s advisory said that OS wasn’t \u201ccurrently at risk from these attacks.\u201d<\/p>\n Ormandy’s advisory has reignited the age-old debate over full disclosure, in which researchers publish complete details of a vulnerability under the belief that it is the best way to ensure a company fixes it quickly. Ormandy has defended his decision to give Microsoft just five days of advanced warning saying in a recent tweet: \u201cI’m getting pretty tired of all the ‘5 days’ hate mail. Those five days were spent trying to negotiate a fix within 60 days.\u201d<\/p>\n Users of XP and Server 2003 should consider disabling features within Help Center that allow administrators to remotely log onto machines. <\/p><\/blockquote>\n Oh well, the debates about disclosure will rage on I guess, either way it’s out there now and it’s being exploited in the wild – so as of now it’s a real risk.<\/p>\n For individual users you can use the online application from Microsoft here:<\/p>\n Vulnerability in Help Center could allow remote code execution<\/a><\/p>\n <\/p>\n