Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
This topic is locked
Microsoft Security Advisory (935423)
Vulnerability in Windows Animated Cursor Handling
- http://www.microsoft...ory/935423.mspx
March 29, 2007 ~ "Microsoft is investigating new public reports of targeted attacks exploiting a vulnerability in the way Microsoft Windows handles animated cursor (.ani) files. In order for this attack to be carried out, a user must either visit a Web site that contains a Web page that is used to exploit the vulnerability or view a specially crafted e-mail message or email attachment sent to them by an attacker. As a best practice, users should always exercise extreme caution when opening or viewing unsolicited emails and email attachments from both known and unknown sources... ."
- http://isc.sans.org/...ml?storyid=2534
Last Updated: 2007-03-29 19:35:05 UTC
"...Mitigation:
- Microsoft is reporting that users of Internet Explorer 7 with Protected Mode* are protected from active exploitation. Note that this does not apply to Outlook !;
- Anti-virus detection is very spotty. We've tested some of the exploits and they were detected by Windows Live OneCare 1.2306 and McAfee 4995. One specific file was also discovered by a product triggering on a signature written for MS05-002, a similar vulnerability from 2005. This will not apply to most exploits in the wild..."
* http://www.microsoft...ware.mspx#EZPAC
"...This setting only works in Internet Explorer 7 with Windows Vista..."
> http://www.avertlabs...rch/blog/?p=230
"...Preliminary tests demonstrate that Internet Explorer 6 and 7 running on a fully patched Windows XP SP2 are vulnerable to this attack. Windows XP SP0 and SP1 do not appear to be vulnerable, nor does Firefox 2.0..."
> http://preview.tinyurl.com/26y4f8
(TrendMicro)
> http://nvd.nist.gov/...e=CVE-2007-1765
- http://isc.sans.org/...ml?storyid=2539
Last Updated: 2007-03-30 10:40:08 UTC ~ "A short overview of how the different email clients (in the supported list of Microsoft) are reacting to the animated cursor vulnerability depending on the actions and settings of the email client. The surprising element is that read in plain text mode makes some of the clients more vulnerable and actually only offers real added value for Outlook 2003..."
(Chart available at the URL above.)
> http://www.us-cert.gov/current/#WINANI
.
Edited by AplusWebMaster, 31 March 2007 - 05:36 AM.
