Core Securitys alert contained a ZIP-compressed image of a malformed PNG file that was intended to allow MSN Messenger users to check to see if they were vulnerable. "Were in the business of getting people to understand how secure their systems are and to help them test to see if they are vulnerable. Our proof-of-concept is used for those tests. It is not to be used by an attacker to arbitrarily control a target," Caceres said.As part of the new plan to make the upgrade mandatory, all MSN Messenger users who attempt to log into the system with a vulnerable version of the client will be told they need to upgrade in the coming days or they will no longer be able to use the service with that vulnerable client. MSN Messenger users running vulnerable clients will receive "toast" warnings about the vulnerability and directed to a download page. They will not be able to log into the Messenger service until they accept that upgrade. MSN also plans to communicate with users via security update via links on MSN properties and Web sites. How to Protect Against an Exploit:
MSN Messenger users should make sure their Windows and MSN Messenger software is current with the latest security updates released on Feb. 8. The latest versions of MSN Messenger can be downloaded here. Alternatively, users can install an evaluation copy (beta release) of the new MSN Messenger 7.0, which is not targeted by the exploit code.
Enterprise businesses should consider removing and blocking MSN Messenger from their environments. If this is not feasible, they should make sure every installed version of Windows and MSN Messenger is current with the latest security updates.
MSN Messenger is not intended for corporate environments and Microsoft recommends uninstalling the client from a business network. Corporate clients should switch to Windows Messenger, which is included with Windows.
Corporate users should also consider blocking access to MSN Messenger. This can be done by blocking outbound access to TCP port 1863 and blocking HTTP access to messenger.hotmail.com.
Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.
But Microsoft isnt buying that explanation. "A common practice among responsible researchers is to wait a reasonable period of time before publishing such code Microsoft is disappointed computer users were not given a reasonable opportunity to safeguard their computing environments."