Microsoft admits Windows XP is under attack!

Davey Winder
Tuesday, 07 July 2009 05:03

Business IT - Security

A no-click vulnerability which impacts Windows XP users has been revealed by Microsoft which admits it is already being exploited in the wild.

With the Russian government gunning for Microsoft because of it, and cash machines using it revealed to be stealing PIN codes, things couldn't get much worse for Windows XP right now could they?

Well, yes, actually they could. A lot worse. Microsoft has issued a Security Advisory (972890) which details a vulnerability for the Microsoft Video ActiveX Control in Windows XP that could allow 'no-click' remote code execution.

Microsoft, which admits to being "aware of attacks attempting to exploit the vulnerability" says that an attacker who is successful in exploiting the vulnerability could gain the same user rights as the local user.

When you combine Windows XP (and Windows Server 2003 for that matter) with Internet Explorer 6 or 7 (although security analysts suggest that IE 8 is OK) that code execution becomes remote and does not require any user intervention.

Although Microsoft does say that there are "no by-design uses for this ActiveX Control in Internet Explorer which includes all of the Class Identifiers within the msvidctl.dll that hosts this ActiveX Control" it is recommending removing support for this ActiveX Control within Internet Explorer.

Indeed, it is even recommending that Windows Vista and Windows Server 2008 customers remove support as well, even though there is no evidence to suggest they are impacted by the vulnerability, as a defense-in-depth measure.

Microsoft is working on a security update to address the vulnerability, but in the meantime, instructions to remove support can be found in Knowledge Base Article 972890.