Security researchers say hackers have published code that could let an attacker disable the built-in firewall  on computers running Microsoft 's Windows XP operating system.
The code, which has been available on the Internet since Sunday, could be used to disable the firewall on completely up-to-date Windows XP computers running Microsoft's Internet Connection Service (ICS), allowing malicious code to be planted on those machines.
The exploit details ways to send specially formed malicious data packets to force ICS to fail. Because ICS is connected to the Windows XP firewall, the packets could also cause the firewall to fail.
LAN Vulnerability
ICS is used to allow Windows XP computers to behave like routers to share an Internet connection with other computers on a local area network (LAN). It is primarily configured this way by home users and small businesses.
Microsoft has confirmed it is investigating the ICS issue, and said it has concluded that the issue affects Windows XP. "Microsoft is not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time," the company said in a statement.
The software giant first received the tip from Tyler Reguly, of security firm nCircle, who noted on his blog that hackers sending malformed data packets to vulnerable machines could disable and eventually bypass the operating system firewall.
So far, only Windows XP computers with the ICS service turned on are affected by the attack.
Exploits Limited
Security experts are saying the vulnerability is relatively obscure and easily fixable.
The attacks are expected to be limited because a hacker would have to be within a LAN in order to make the exploit work, and the attack would of course work only on systems running ICS, which is disabled by default. Additionally, the attack would have no impact on any third-party firewall being used.
"Once enabled, an attacker could only attempt to exploit this issue from the user's local network," Microsoft stated. "It cannot be remotely exploited." Microsoft also said it will continue to investigate the reports to help provide additional guidance for customers, as necessary.
"Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include issuing a security advisory or providing a security update through our monthly release process, depending on customer needs," the company stated.
|
Rackspace: It makes a difference when you focus on support.
House Lawmakers Push Ban on Peer-to-Peer Software
GAO: Los Alamos Computer Security Has Weaknesses
Computer Security Firm Fortinet Plans IPO This Week
Flat Shipments Hurt Dell Despite Increased Earnings
New Pogoplug 'Personal Cloud' Does Social Networking
Apple Tablet Rumored Delayed as Publisher Gears Up
Smartphones: A Bigger Target for Security Threats
FBI Says Hackers Targeting Law Firms, PR Companies