Microsoft is to put out an urgent fix for the latest Windows flaw, a week ahead of the next scheduled Patch Tuesday next week. The company has been forced to act because of the seriousness of the bug, which exploits the way Windows processes .ani Animated Cursor files that are used to create cartoon-like cursors in Windows.
Since the first attacks based on this flaw were reported, security experts say that more than 100 websites are now serving up malicious pages that take advantage of the bug, and a new worm has begun spreading in China, according to Symantec. On Saturday, hackers posted sample code that could be used to exploit the flaw.
"Over this weekend attacks against this vulnerability have increased somewhat," Microsoft Program Manager Christopher Budd wrote on the company's Security Response Center blog. "Additionally, we are aware of public disclosure of proof-of-concept code. In light of these points, and based on customer feedback, we have been working around the clock to test this update and are currently planning to release the security update that addresses this issue on Tuesday."
Such early patches are not unprecedented. Microsoft released similar "out-of-cycle" fixes in January and September last year.
For those who cannot wait until Tuesday, two unofficial patches for the problem are now available: The first is from eEye Digital Security, the second was released on Sunday by a volunteer group called the Zeroday Emergency Response Team.
Microsoft's patch has been in the works since security vendor Determina brought the flaw to Microsoft's attention late last year, Budd wrote. "We've been working on our investigation and a security update since then."