Microsoft is urging users to upgrade their Windows 2000 and NT
installations with a patch to overcome another security hole found
in the operating system's debugging facility.
According to the Microsoft Security Bulletin MS02-024, the flaw
allows a would-be hacker to run any program on an affected machine,
by exploiting a feature in the Windows debugging environment
normally used to track down application software errors.
When a program fails, the debugging environment in Windows normally
allows users to run a debugging "session" which allows them to
trace where the problem occurred.
However, a flaw means a hacker could replace the debugging software
with their own malicious code.
This could then run the machine with system-level privileges - in
effect, as a system administrator. This would allow the hacker to
create fake accounts on the affected machine, delete files and
possibly install Trojan programs for capturing users' personal data
and passwords.
In order to exploit the flaw, a hacker would need to login into an
unpatched Windows NT/2000 machine.
Microsoft said the attack could be minimised by preventing users
from downloading and running software on their Windows PCs.
Details of the flaw and the patch can be found at:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-024.asp