Microsoft patches critical Windows security hole

Microsoft is urging users to upgrade their Windows 2000 and NT installations with a patch to overcome another security hole found...

Microsoft is urging users to upgrade their Windows 2000 and NT installations with a patch to overcome another security hole found in the operating system's debugging facility.

According to the Microsoft Security Bulletin MS02-024, the flaw allows a would-be hacker to run any program on an affected machine, by exploiting a feature in the Windows debugging environment normally used to track down application software errors.

When a program fails, the debugging environment in Windows normally allows users to run a debugging "session" which allows them to trace where the problem occurred.

However, a flaw means a hacker could replace the debugging software with their own malicious code.

This could then run the machine with system-level privileges - in effect, as a system administrator. This would allow the hacker to create fake accounts on the affected machine, delete files and possibly install Trojan programs for capturing users' personal data and passwords.

In order to exploit the flaw, a hacker would need to login into an unpatched Windows NT/2000 machine.

Microsoft said the attack could be minimised by preventing users from downloading and running software on their Windows PCs.

Details of the flaw and the patch can be found at: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-024.asp

CW+

Features

Enjoy the benefits of CW+ membership, learn more and join.

Read more on IT risk management

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

-ADS BY GOOGLE

SearchCIO

SearchSecurity

SearchNetworking

SearchDataCenter

SearchDataManagement

Close