Ten SP2 flaws leave XP users open to hackers

Security researchers claimed today that millions of Microsoft customers are at risk from 10 serious security vulnerabilities uncovered in Windows XP patched with Service Pack 2 (SP2).

By exploiting all the vulnerabilities discovered in SP2 by security firm Finjan, attackers could "silently and remotely" take over an SP2 machine when the user simply browses a web page.

Finjan claimed that hackers could also switch between Internet Explorer security zones to obtain rights of local zone Internet Explorer users.

This could make it possible to elevate the privilege level of mobile code downloaded from the internet, thereby allowing the remote code to read, write and execute files on the user's hard drive.

According to Finjan, hackers could also bypass XP SP2's notification mechanism on the download and execution of .exe files, and therefore download files without any warning or notification.

Finjan's Malicious Code Research Center, which claims to have identified the flaws, has provided Microsoft with full technical details and has been assisting the software giant to patch the holes.

Although it warned users about the alleged flaws, the security firm refused to provide specific details.

"In order to prevent the creation of malicious viruses and worms, Finjan will not release any technical details about these vulnerabilities until they are fully patched by Microsoft," it stated.

Shlomo Touboul, chief executive and founder of Finjan Software, added: "The recently released XP SP2 operating system offers certain security features.

"However, it suffers because it is still basically the same operating system and has some major flaws which compromise end-user security."

See also:

Linux fan concedes Microsoft is more secure

Vulnerability research claims shocking results  17 Feb 2005

Microsoft re-releases security patch

Better safe than sorry  17 Nov 2004

Applications are the next hacker target

Has someone sold you a lemon?  17 Nov 2004

XP SP2 still causing costly IT headaches

Users installing security update by themselves wreak havoc  16 Nov 2004

Hackers strike at 'soft target' small firms

Financial Services Authority warns SMEs to tighten security  15 Nov 2004

Microsoft claims ongoing commitment to security

Trustworthy Computing programme lives on  04 Nov 2004

Companies still wary of XP Service Pack 2

Study claims half of IT managers expect migration 'issues'  03 Nov 2004

Microsoft issues patches for 21 software flaws

'Critical' vulnerabilities could allow attackers to gain complete control  13 Oct 2004

Upgrade for security, Microsoft boss tells customers

Safe surfing means switching to XP, says Steve Ballmer  05 Oct 2004

XP SP2: the business angle

What IT managers need to know about XP SP2  15 Sep 2004

Security

The latest wave of cyber-crimes and acts of vandalism have demonstrated once again that many systems are still vulnerable to attack.  15 Apr 2004

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!