Animated cursor flaw puts Windows at risk

Stephen Withers
Friday, 30 March 2007 06:36

Your IT - Home IT

Microsoft has warned users of a new vulnerability that puts Windows at risk due to the way it handles animated cursors.

The flaw can be exploited via web pages or HTML emails, according to a security advisory issued yesterday.

Windows 2000, XP, Server 2003 and Vista are all affected. It appears that a deliberately malformed .ani animated cursor file can be used to cause a system to execute arbitrary code.

According to the company, Internet Explorer 7's protected mode (for Vista) provides a defence against current web-based attacks exploiting this flaw.

As a temporary workaround against email exploits, Microsoft suggest Outlook and Outlook Express users read emails in plain text format.

Windows Live OneCare has been updated to detect exploits, and other security software vendors have been notified.
 
Microsoft says it will release an update to address the flaw, either as part of its monthly releases or as "an out-of-cycle security update, depending on customer needs."