|
PureBytes Links
Trading Reference Links
|
A security vulnerability has been reported in Microsoft Windows XP and
Server 2003 operating systems. This issue exists in the Help and Support
Center (HSC) and is due to how the feature handles HCP invocation URIs.
This issue could be exploited from a malicious web page or HTML e-mail to
cause a malicious executable to be run on a vulnerable system. This would
occur in the context of the victim user, though it has been reported that
significant user interaction is required for exploitation to occur.
While this issue may be exploited through Internet Explorer, it should also
be noted that third-party web client software could also invoke HSC via a
HCP URI.
Recommendations
Run all client software as a non-privileged user with minimal access rights.
All non-administrative tasks such as reading e-mail and browsing the web
should be performed as an unprivileged user with minimal access rights. This
will reduce the consequences of successful exploitation.
Do not follow links provided by unknown or untrusted sources.
This issue may be exploited from a malicious web page. Users should be wary
of visiting websites of questionable integrity or following links provided
by unfamiliar or suspicious sources.
Do not accept communications that originate from unknown or untrusted
sources.
This issue may potentially be exploited via HTML e-mail. Disabling support
for HTML e-mail in the mail client may limit exposure to this attack vector.
HTML e-mail may also be filtered using other means.
Make sure that all MS patches are current. Use something other than
anti-virus such as Pest Patrol at all times. Have a personal Firewall
operating at all times.
-----Original Message-----
From: marc miller [mailto:marcmiller@xxxxxxxxx]
Sent: Thursday, May 20, 2004 9:42 AM
To: omega-list@xxxxxxxxxx
Subject: Norton Intnt Security 2002 update bug-5-14-04
are you running Norton applications? A LiveUpdate they distributed on 5/14
screwed up systems as described in the forum below. Apparently it
only
screws up systems that are running Norton Internet Security 2002
----------------------------------------------------------------------------
----
http://www.dslreports.com/forum/remark,10248995~mode=flat~days=9999
|