Language Selection

English French German Italian Portuguese Spanish

More problems for Windows, Internet Explorer users

Filed under
Security

Exploit code targeting a security hole Microsoft warned of in last week's patch release is in the wild, the Bethesda, Md.-based SANS Internet Storm Center (ISC) said Friday.

"We've received reports that the color management module ICC profile buffer overflow vulnerability has exploit code available and is being used out in the wild," ISC said on its Web site. "[To] mitigate this vulnerability, apply the appropriate patch. It appears that this version of the exploit code will only crash the browser, but it wouldn't be difficult to put in code for execution."

The French Security Incident Response Team (FrSIRT) has also put out an advisory on the exploit code.

Microsoft issued a bulletin for the vulnerability during its July patch release. The software giant said the problem is in how the color management module validates International Color Consortium [ICC] profile format tags. "Attackers could exploit this by constructing a malicious image file that could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message," Microsoft said. "An attacker who successfully exploited this vulnerability could take complete control of an affected system."

The flaw affects Windows 2000 SP4, Windows XP SP1 and SP2; Windows XP Professional x64 Edition; Windows Server 2003; Windows Server 2003 SP1; Windows Server 2003 for itanium-based systems; Windows Server 2003 with SP1 for itanium-based systems; Windows Server 2003 x64 Edition; Windows 98; Windows 98 Second Edition [SE] and Millennium Edition [ME].

Source.

More in Tux Machines

Three great Android tools for Linux and Windows sysadmin

Systems administration isn't a simple job — and being able to respond to issues quickly is a definite plus. Not long ago, server problems meant receiving a phone alert followed by a trip to the data center to fix whatever was wrong. Today, having full-powered computers such as smartphones or tablets literally in your hand is a tremendous help when doing sysadmin. Load Android with a few key applications and you can remotely monitor servers and services, get alerts and warnings as they occur, and solve problems without any travel at all. Read more

KDBUS Submitted For Review To The Mainline Linux Kernel

It looks like KDBUS, the Linux kernel D-Bus implementation, is posed to be added to the next kernel release after Greg Kroah-Hartman sent out its patches today. Read more

Windows Phone Shrinks In Android-Dominated Europe, As New iPhones Boost iOS’ Share

Spare a thought for Microsoft, a relative newcomer to the mobile making business, after Redmond completed its $7.2BN+ acquisition of former European mobile making powerhouse Nokia earlier this year. If Microsoft was hoping to see quick marketshare wins in Europe once its hands were fully on the levers of production that has not come to pass. The latest 12-week smartphone sales figures from Kantar Worldpanel ComTech, up to this September, indicate that Windows Phone’s already small share of the smartphone market has shrunk in Europe — dropping 0.3 percentage points in aggregate across the top five markets in Europe (the UK, France, Spain, Italy and Germany). Read more

35 Essential Android Apps for Daily Use

This list of essential Android apps are the ones you must have apps you need every day. They help with email, weather, music, and handful of other essential tasks. Read more