Microsoft warns of zero-day Windows flaw

The vulnerability affects Windows Server 2003, XP, Vista and Server 2008, according to an advisory issued on Thursday.

If exploited, the bug can allow a user's privilege status to jump from "authenticated user" to "LocalSystem," Bill Sisk, security response communications manager for Microsoft, told SCMagazineUS.com.

Separately, researchers at McAfee Avert Labs said on Thursday they have detected public exploit code taking advantage of a vulnerability in a Microsoft Works.

McAfee analyst Kevin Beets wrote on the company's blog that the flaw is located in the ActiveX control of Microsoft Works' Image Server. Researchers said the code was posted on a number of Chinese blog sites.

"Yes, it appears successful exploitation would allow for code execution via a controlled pointer," he said. "For this to occur, the victim would need to visit a malicious website."

The risk is mitigated somewhat because the affected ActiveX control is marked as unsafe, so users likely will see a warning pop up when trying to access it, Beets said. Still, users should set the kill bit for the affected control.

A Microsoft spokeswoman told SCMagazineUS.com that the company was aware of the issue and is investigating.

See original article on scmagazineus.com

Copyright © SC Magazine, US edition

microsoft securitysecuritywindows flaw