We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Windows fix tackles malicious websites

Microsoft responds to hackers' Windows exploit

Microsoft has decided to rush out a fix for a flaw in its Windows operating system, saying that the problem has become too serious to ignore.

The flaw, which will be patched on Tuesday, was originally disclosed to Microsoft in December, but it was not publicly reported until last Wednesday. The bug lies in the way Windows processes .ani Animated Cursor files, which are used to create cartoon-like cursors in Windows.

Since the first attacks based on this flaw were reported, security experts say that more than 100 websites are now serving up malicious web pages that take advantage of the bug, and a new worm, has begun spreading in China, according to by Symantec.

On Saturday, hackers posted sample code that could be used to exploit the flaw, and shortly after that, Microsoft decided to rush out the emergency patch instead of waiting for its next regularly scheduled set of security updates, due 10 April.

"Over this weekend attacks against this vulnerability have increased somewhat," Microsoft programme manager Christopher Budd wrote on Sunday on the company's Security Response Center blog. "Additionally, we are aware of public disclosure of proof-of-concept code. In light of these points, and based on customer feedback, we have been working around the clock to test this update and are currently planning to release the security update that addresses this issue on Tuesday."

Such early patches are not unprecedented. Microsoft released similar ‘out-of-cycle’ fixes in January and September last year.

For those who cannot wait until Tuesday, two unofficial patches for the problem are now available: The first is from eEye Digital Security, the second was released on Sunday by a volunteer group called the Zeroday Emergency Response Team.

Microsoft's patch has been in the works since security vendor Determina brought the flaw to Microsoft's attention late last year, Budd wrote. "We've been working on our investigation and a security update since then."


IDG UK Sites

Amazon Kindle Voyage release date, price and specs UK: a high-end eReader with Amazon’s best-ever...

IDG UK Sites

Why local multiplayer gaming is rapidly vanishing: we look at the demise of split-screen and LAN...

IDG UK Sites

How to successfully bridge the gap between clients and creatives

IDG UK Sites

How to update your iPhone or iPad to iOS 8: including how to install iOS 8 if you don't have room