Microsoft is investigating claims that several new
vulnerabilities have been found in Windows XP Service Pack 2 by
security firm Finjan Software.
Finjan said it had found as many as 10 "serious" flaws in SP2.
Some of the vulnerabilities could be exploited by hackers to gain
complete remote control of a system or to download malicious code
to a compromised computer, according to Gil Arditi, Finjan's chief
security officer.
Finjan has notified Microsoft of the vulnerabilities and has
shared all relevant technical details with the company, Arditi
said. Finjan has also developed a proof-of-concept exploit capable
of taking advantage of the flaws, which it has shared with
Microsoft.
Finjan has no plans to go public with details of the flaws until
Microsoft has patches available for them, Arditi said.
However, the security company outlined several scenarios
describing how malicious attackers could take advantage of the SP2
holes to remotely access user files, escalate privileges and
execute malicious code without user intervention.
"By exploiting all vulnerabilities discovered in SP2 by Finjan,
attackers can silently and remotely take over an SP2 machine when
the user simply browses a web page," the company said.
Finjan said it released the news of its discovery in part
because many users are being lulled into a feeling of false
security by deploying SP2 and "may be letting their guard down",
said Tim Warner, Finjan's north European regional manager.
A Microsoft spokeswoman said the company is aware of the claims
by Finjan and is looking into them.
"At this time, Microsoft cannot confirm Finjan's claims of '10
new vulnerabilities' in Windows XP SP2," she said.
Microsoft is also currently unaware of any attacks attempting to
take advantage of the flaws described by Finjan, the spokeswoman
said.
"Our early analysis indicates that Finjan's claims are
potentially misleading and possibly erroneous regarding the breadth
and severity of the alleged vulnerabilities in Windows XP SP2," the
Microsoft said.
If any valid vulnerability is found in Windows XP SP2, Microsoft
said it will take "immediate and appropriate action to help protect
customers".
Jaikumar Vijayan writes for Computerworld