More Windows bugs appear

Three new and unpatched vulnerabilities in Microsoft Windows were made public on security mailing lists over Christmas weekend, pushing some security vendors to claim user systems may be open to attack and hijacking.

The vulnerabilities, first reported by a Chinese group and then posted to the Bugtraq mailing list, are in Windows' LoadImage API function, its animated cursor files, and in the way it handles help files.

All the bugs are as yet unpatched.

All supported versions of Windows -- Windows NT, 2000, XP, and Windows Server 2003 -- were affected by the three flaws, said Venustech, the Chinese security firm that posted analysis on Bugtraq.

Some affected Windows XP Service Pack 2 (SP2), some didn't.

The LoadImage API vulnerability -- the latest in a series of image-related vulnerabilities that have hit Windows, Unix, and Linux -- affected Windows NT through Windows Server 2003.

Whether Windows XP SP2 was at risk wasn't yet known.

This vulnerability could be exploited by attackers who entice users to a malicious website that includes a specially-crafted icon, cursor, animated cursor, or bitmap file, said Danish security firm Secunia in its alert.

Alternately, the malicious image could be delivered via HTML e-mail. Users who viewed such messages or visited such sites could find their systems hijacked by hackers, who would be able to run their own code remotely on the PC.

The second bug, which was in Windows' ANI, animated cursor files, could be used by an attacker to crash or freeze a Windows PC, said Venustech in its analysis. Windows XP SP2 was not vulnerable to that flaw.

The third flaw revolved around how Windows parsed help files. The bug could be exploited to create a buffer overflow giving attackers control of the computer, if users opened a maliciously-crafted help file posted on a site or sent to them via e-mail.

Secunia bundled the three bugs and labelled the group as a "highly critical" vulnerability, the second highest warning the firm used.

"Don't visit untrusted websites and don't open documents from untrusted sources," advised Secunia.

The SANS Institute's Internet Storm Center (ISC) gave similar advice.

"Try not to install help files until some Tuesday in, we hope, January," the centre said.

Microsoft releases its patches on the second Tuesday of every month. The next scheduled security bulletin day is 11 January 2005.