MS08-021: A Must-Patch Vulnerability

Less than a week after the release of patches for a pair of code execution flaws in Microsoft’s Windows graphics device interface, malicious hackers are firing in-the-wild exploits against those vulnerabilities.
According to virus hunters tracking malicious Internet activity, a booby-trapped file named TOP.JPG is in circulation, exploiting one of the vulnerabilities described in Microsoft’s MS08-001 bulletin.
“[The malicious .JPG file] was found hosted on sites, and arrives on a system as an executable which is now detected as EXPL_NEVAR.B,” says Christina Cruz, a virus analyst at Trend Micro.
The malware linked to the exploit is a Trojan downloader that creates a backdoor for silent communication with a malicious server.
According to Patrick Jungles, an analyst with Symantec’s DeepSight Threat Management System, the GDI attacks were first spotted on April 10, a mere two days after Microsoft’s Patch Tuesday release. “The attacks we identified weren’t successful; no honeypot instances were compromised,” Jungles said.
Upon further analysis, Jungles said the DeepSight team identified multiple images disguised as JPEGs being used to exploit the Microsoft Windows GDI Stack Overflow vulnerability.
Since then, attack code that provides a road map to launch attacks has been posted to Milw0rm.com, a publicly available repository for exploit code.
“We have tested the proof of concept and it does trigger the vulnerability, crashing Explorer on Win XP SP2,” Jungles added.
The appearance of in-the-wild attacks and public exploit code means that MS08-021 is a patch that should be deployed immediately, Jungles said.
The MS08-021 bulletin, rated “critical,” provides cover for all supported versions of Windows — from Windows 2000 SP4 through Windows XP SP2, Windows Server 2003 SP1, Windows Vista and Windows Server 2008.