Five days after being disclosed publicly by a Google engineer, a zero-day security vulnerability affecting Microsoft Windows XP has come under attack. The controversial bug, which remains unpatched, gave rise to a new round of debate about responsible disclosure.
Attackers have begun exploiting a zero-day
to target Windows XP machines. The vulnerability has given
rise to renewed debate about responsible disclosure.
According to Sophos Senior Technology Consultant Graham Cluley, a legitimate
Website pushing open-source software was seen serving the exploit to PC
users. Cluley declined to name the site, but Microsoft confirmed that it was
aware the bug was being exploited and said the exploits had been "taken
An analysis of the exploits found that Windows Server 2003 systems are not
being targeted, according to an
However, the vulnerability lies within the Windows
Help and Support Center
function delivered in both XP and Windows Server 2003, meaning that Windows
Server 2003 systems could eventually be targeted.
A successful exploit could allow an attacker to remotely execute
code if the user views a specially crafted or compromised Web page
like the ones found by Sophos.
"The malware that is downloaded is a very large Delphi-based Trojan,
which includes an entire portable version of Firefox," Cluley said.
"It appears that they are trying to distribute this 'customized' version
of Firefox to make money through clickable banner ads."
The vulnerability was uncovered by Google engineer Tavis Ormandy, who published
on the Full Disclosure mailing list five days after notifying
Microsoft of his findings. Some have criticized Ormandy's actions, saying he
did not give Microsoft enough time to patch before going public with details of
the attack. Ormandy defended himself in his Full Disclosure post
on the grounds that had he gone public without a working exploit he
"would have been ignored."
Microsoft did not offer a definitive timeline for a patch, but told
eWEEK a security update for the issue is forthcoming. In the meantime, the
company has included information on a workaround in its advisory.
Customers concerned about the exploit can disable the HCP
protocol, which "will break all local, legitimate help links that use hcp://."
A tool that can be used to disable the HCP
protocol can be downloaded