Feeds

Think unpatched Win XP hole's not a big deal? Hope you trust your local users

Vulnerability used to breathe life into Adobe Reader exploit, Microsoft warns

The Power of One eBook: Top reasons to choose HP BladeSystem

An unpatched vulnerability in Windows XP and Windows Server 2003 creates a means for hackers to gain admin rights on vulnerable Windows XP machines, Microsoft warned on Wednesday.

The zero-day local privilege escalation vulnerability is not suitable for remote code execution but might allow a standard user account to execute code in the kernel. As such, the bug is not that much use on its own, but potentially troublesome when mixed in a cocktail with other software vulnerabilities in order to formulate workable attacks.

Unfortunately this has already happened and the vulnerability has already been used in anger in conjunction with an Adobe Reader exploit to target a recently patched vulnerability in the widely used PDF reader software, anti-malware firm FireEye warns. Simply put, the Windows bug allows hackers to bypass Adobe's sandbox defences but only on older versions of Reader.

The combined exploit targets Adobe Reader 9.5.4, 10.1.6, 11.0.02 and prior on Windows XP SP3. XP users who are running the latest versions of Adobe Reader are immune from the attack, so upgrading to the latest version of Abode Reader is probably the best way of blocking potential attacks. Windows Server 2003 is also vulnerable to same privilege escalation vulnerability but are not anywhere near as at risk of attack (unless a BOFH opens a email containing rigged PDFs from a vulnerable server, or other unlikely scenarios), hence the focus on the millions upon millions of vulnerable Win XP systems.

Microsoft plays down the seriousness of the vulnerability while admitting it has been abused in "limited, targeted attacks".

The Adobe flaw was patched in August, according to cloud security firm Qualys.

"Users that have the latest version of Adobe Reader are immune to the attack, as well as users that are running on Windows Vista or later," Wolfgang Kandek, CTO a Qualys, explains in a blog post. ®

Designing a Defense for Mobile Applications

More from The Register

next story
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.