Microsoft is investigating claims that several new vulnerabilities have been found in Windows XP Service Pack 2...
by security firm Finjan Software.
Finjan said it had found as many as 10 "serious" flaws in SP2. Some of the vulnerabilities could be exploited by hackers to gain complete remote control of a system or to download malicious code to a compromised computer, according to Gil Arditi, Finjan's chief security officer.
Finjan has notified Microsoft of the vulnerabilities and has shared all relevant technical details with the company, Arditi said. Finjan has also developed a proof-of-concept exploit capable of taking advantage of the flaws, which it has shared with Microsoft.
Finjan has no plans to go public with details of the flaws until Microsoft has patches available for them, Arditi said.
However, the security company outlined several scenarios describing how malicious attackers could take advantage of the SP2 holes to remotely access user files, escalate privileges and execute malicious code without user intervention.
"By exploiting all vulnerabilities discovered in SP2 by Finjan, attackers can silently and remotely take over an SP2 machine when the user simply browses a web page," the company said.
Finjan said it released the news of its discovery in part because many users are being lulled into a feeling of false security by deploying SP2 and "may be letting their guard down", said Tim Warner, Finjan's north European regional manager.
A Microsoft spokeswoman said the company is aware of the claims by Finjan and is looking into them.
"At this time, Microsoft cannot confirm Finjan's claims of '10 new vulnerabilities' in Windows XP SP2," she said.
Microsoft is also currently unaware of any attacks attempting to take advantage of the flaws described by Finjan, the spokeswoman said.
"Our early analysis indicates that Finjan's claims are potentially misleading and possibly erroneous regarding the breadth and severity of the alleged vulnerabilities in Windows XP SP2," the Microsoft said.
If any valid vulnerability is found in Windows XP SP2, Microsoft said it will take "immediate and appropriate action to help protect customers".
Jaikumar Vijayan writes for Computerworld