1  |   Order by index

Nov 13, 2004, 6:51pm

Hello All,

Source:
http://www.computerworld.com/securitytopics/security/holes/story/0,10801,97478,00.html

Microsoft probing reported flaws in Windows XP SP2
But it called the reports 'potentially misleading and possibly erroneous'


News Story by Jaikumar Vijayan

NOVEMBER 12, 2004 (COMPUTERWORLD) - Microsoft Corp. yesterday said it is
investigating claims that several new vulnerabilities have been found in
Windows XP Service Pack 2 by security firm Finjan Software Inc. in San
Jose. Finjan on Tuesday announced that it had found as many as 10
"serious" flaws in SP2.

According to Gil Arditi, Finjan's chief security officer, some of the
vulnerabilities could be exploited by hackers to gain complete remote
control of a system or to download malicious code to a compromised computer.

Finjan has notified Microsoft of the vulnerabilities and has shared all
relevant technical details with the company, Arditi said. Finjan has
also developed a proof-of-concept exploit capable of taking advantage of
the flaws, which it has shared with Microsoft.

Per its usual policy, Finjan has no plans to go public with details of
the flaws until Microsoft has patches available for them, Arditi said.
But in a release announcing its discovery, the security company outlined
several scenarios describing how malicious attackers could take
advantage of the SP2 holes to remotely access user files, escalate
privileges and execute malicious code without user intervention.

"By exploiting all vulnerabilities discovered in SP2 by Finjan,
attackers can silently and remotely take over an SP2 machine when the
user simply browses a Web page," the company said in a statement.

Finjan said it released the news of its discovery in part because many
users are being lulled into a feeling of false security by deploying SP2
and "may be letting their guard down," said Tim Warner, Finjan's North
European regional manager.

In an e-mail statement, a Microsoft spokeswoman said the company is
aware of the claims by Finjan and is looking into them. "At this time,
Microsoft cannot confirm Finjan's claims of '10 new vulnerabilities' in
Windows XP SP2," she said.

Microsoft is also currently unaware of any attacks attempting to take
advantage of the flaws described by Finjan, the spokeswoman said. "Our
early analysis indicates that Finjan's claims are potentially misleading
and possibly erroneous regarding the breadth and severity of the alleged
vulnerabilities in Windows XP SP2," the Microsoft statement said.

If any valid vulnerability is found in Windows XP SP2, Microsoft said it
will take "immediate and appropriate action to help protect customers."




Yours Sincerely,
Samuël ML Lison

--
DreamCities.net - A Community for All! (http://www.dreamcities.net)
Jobs Available: http://business.dreamcities.net/jobs.html
Contact Me: http://about.dreamcities.net/contact.html

1  |   Order by index