Three Serious Windows Vulnerabilities Surface

Security researchers warn of three unpatched vulnerabilities awaiting exploitation, including one for Windows XP SP2 systems.

Symantec Corp.s Security Response service on Friday confirmed that unpatched Windows vulnerabilities could pose a serious risk for exploits via malicious Web pages and e-mail messages.

One of the three security vulnerabilities involves image handling—a source of recent exploits on Windows and Unix operating systems. The other two risks are found in the Help system and in Windows ANI (Animated Cursor Image format) authentication.

Symantec said the Microsoft Windows LoadImage API Function Integer Overflow Vulnerability could be exploited via browsers or e-mail client software. Users who open an HTML message or Web page bearing the image could face security risks.

Another vulnerability that could only require users to click on a site or message is called the Windows Kernel ANI File Parsing Crash and DoS Vulnerability. Its vector, a malicious ANI file, could invoke a DoS (denial of service) attack that could bring down unprotected systems.

Resource Library:

These two issues potentially affect a wide range of Windows versions, including Windows NT, Windows 2000 and Windows XP with SP (Service Pack) 1, the report advised. Windows XP SP2 machines are not vulnerable.

Another "high-risk" issue concerns the interpretation of Windows Help files (.hlp), Symantec said. Some decoding errors during processing could cause a heap buffer overflow that could then be exploited. This vulnerability affects Windows XP SP2 systems as well as earlier versions.

Symantec said the three vulnerabilities were first reported by a Chinese community group called Xfocus Team. Microsoft has yet to confirm the vulnerabilities and was unavailable for comment.

Symantec suggested that users make sure their virus definitions include the Bloodhound.Exploit.19 signature, which should prevent the LoadImage API Function Integer Overflow.

To ward off the other problems, Symantec said, Windows users should block e-mail attachments with an .hlp extension, avoid untrusted sites or e-mail messages from unknown sources, and read messages in plain-text format.

Exploits of graphics libraries and APIs on Windows and other operating systems have been a common occurrence throughout 2004. Earlier this week, a number of Linux distributions offered patches for image-handling and PDF (Portable Document Format) libraries.

The problem also plagues developers of Web browsers. Earlier this month, America Online Inc. discovered its newly refreshed Netscape browser was open to an image-based attack when handling files in the PNG format. This vulnerability had already been fixed in earlier versions and on other platforms.

To read more about Windows graphics flaws, click here.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

Reader Comments: Three Serious Windows Vulnerabilities Surface >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By David Morgenstern