Microsoft users could be facing security attacks after code that takes advantage of a flaw in the way applications process JPEG images has been published on the web.
The code was published late last week, only days after Microsoft revealed the "critical" vulnerability and made available patches to fix the problem. Any application that processes JPEG images could be vulnerable.
So far only "proof-of-concept" code has been published, which can cause a vulnerable Web browser to crash or a PC to freeze. A fully developed exploit would allow an attacker to take control of a victim's computer by remotely opening a command prompt or downloading and running malicious software, one expert said Tuesday.
"Typically a proof of concept is a first step towards a full blown exploit," said Johannes Ullrich, chief technology officer at The SANS Institute's Internet Storm Center. "It is an indication that people are playing with it and experimenting to try and get it to work for other purposes, typically to open a remote shell or download and execute code."
Microsoft is aware of the exploit code and is investigating the matter, a Microsoft spokeswoman said. "Microsoft’s early investigation of this code indicates that it can cause a computer that does not have (the patches) installed to stop responding, but it does not execute code remotely," she added.
Microsoft urges all customers to install the software updates immediately. Customers who are still testing the patches should implement the workaround steps outlined in the bulletin, the vendor said.
While the race is on to create malicious code and there seems to be a real possibility for large scale exploitation of the JPEG processing weakness appears, Ullrich has some hope that it won't be.
"One thing that makes me think that this may not be this big is that these image format vulnerabilities, there are literally dozens of them, for whatever reason have not been widely exploited in the past," he said.
To take advantage of the flaw, an attacker would have to persuade a user to open a specially crafted image file. The image could be hosted on a Web site, included in an e-mail or Office document or hosted on a local network, Microsoft said last week. The vendor rates the flaw "important" for many of its products, but "critical" for Outlook versions 2002 and 2003, Internet Explorer 6 with Service Pack 1, Windows XP and Windows XP with Service Pack 1, Windows Server 2003, and the .Net Framework 1.0 with Service Pack 2 and .Net Framework 1.1.
In Microsoft's rating system for security issues, vulnerabilities that could allow a malicious Internet worm to spread without any action required on the part of the user are rated critical. Issues that do require a user action to spread a worm, but could still expose user data or threaten system resources, are rated important.