Security experts have warned that hackers are already exploiting a zero-day vulnerability in Windows Help and Support Center, just days after a Google researcher published exploit code for the attack.Tavis Ormandy went public with the CVE 2010-1885 vulnerability last week, having given Microsoft just five days to develop a fix. The flaw affects Windows XP and Windows Server 2003.However, security vendor Sophos warned in a blog post yesterday that a compromised web site has been discovered that exploits the vulnerability by installing Trojan malware which could result in arbitrary code execution on a victim's machine.Sophos senior technology consultant Graham Cluley launched a scathing attack on Ormandy, arguing that he should have worked with Microsoft to fix the problem and disclosed the vulnerability only when a patch was available. "Do you feel proud of your behaviour? Do you think that you have helped raise security on the internet? Or did you put your vanity ahead of others' safety?" he wrote in a blog post."Five days isn't a sensible period of time to expect Microsoft to develop a fix which has to be tested thoroughly to ensure it doesn't cause more problems than it intends to correct."
Copyright ©v3.co.uk
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @itnews.com.au to your white-listed senders.