Risk: Medium
A critical weakness found in many Microsoft programs looks like it is about to be exploited by virus writers.
The bug has only come to light recently, but code is now circulating that could be used to attack vulnerable machines. Some security experts said conditions were right to turn the bug into a widely exploited problem.
But others said there was still time to patch machines and ensure that virus writers were prevented from scoring a big success.
Microsoft issued a critical security alert recently telling users that there were problems with the way Jpeg images are handled by Windows and many other programs it makes. The alert said that, theoretically, a malicious attacker could take over a vulnerable machine using a carefully crafted image that contained code to exploit the bug.
At the time the alert was issued, example code to exploit the bug had not been seen. However, sample code written for the bug has since appeared, leading some to speculate that a virus written to use it will follow soon. The code was posted to a closed circulation security mailing list and a publicly viewable website. This could mean that users find their machine under attack when they view images on the web or when their email program previews images contained in messages.
Pornography sites or those happy to spread spyware could be the major sources of virus carrying images. Another suspected reason for the release was that September hosts the annual Virus Bulletin conference and a virus is always released during this period, due to all the virus experts being away from home.
Security experts pointed out that machines patched with the SP2 update to XP, which closes many commonly exploited vulnerabilities, could be at risk from the Jpeg virus if they used other programs that still contained the loophole.
In all, more than a dozen programs are susceptible to the Jpeg exploit. Advice from analysts Gartner said the Jpeg bug could be hard for companies to protect themselves against because most computers have several versions of the vulnerable component installed.