Microsoft fixes a security bug in its virus-scanner
Microsoft has patched a bug in its malware scanning engine that could be used as a stepping stone for an attacker looking to seize control of a Windows box.
The bug is fixed in an update to the Microsoft Malware Protection Engine that was pushed out to users of Microsoft's security products on Wednesday. It's what's known as an elevation of privilege vulnerability -- something that could be used by an attacker who already has access to the Windows system to gain complete administrative control.
Microsoft hasn't seen anyone take advantage of the bug yet -- the flaw was reported to the company by security researcher Cesar Cerrudo -- but Microsoft thinks that hackers could develop code that reliably exploits the issue. In an instant message interview, Cerrudo, the CEO of security research firm Argeniss, said he disclosed the bug publicly at the Black Hat security conference in July 2010. But because the hacker would already need have access to the machine to pull off this attack, he doesn't believe that it presents a major security risk to most users.
